Analysis
-
max time kernel
229s -
max time network
233s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 16:27
Behavioral task
behavioral1
Sample
ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe
Resource
win7-20220718-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe
-
Size
2.4MB
-
MD5
554c30366b3fc26e19239dbe08e79fbc
-
SHA1
b5b5e980d392c02d28cd3b63a945b1222dcbf49e
-
SHA256
ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d
-
SHA512
3f9524f2c988b0df55b8037db7cfaea9aba75dd1e5efa814e3270e53900556b9daa2ce312a845c210d3507bc1bec05c3e7b837ae37867e2265eb984437ad2516
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1840-130-0x0000000000530000-0x0000000000CBA000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\DOMStorage\adobe.com ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\Total = "48" ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "48" ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\auth.services.adobe.com\ = "48" ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe = "11001" ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Key created \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adobe.com\NumberOfSubdomains = "1" ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exepid process 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exedescription pid process Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe Token: SeIncreaseQuotaPrivilege 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exepid process 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe 1840 ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe"C:\Users\Admin\AppData\Local\Temp\ce0c1ef791a24ee3b0df441926421a8cae5d785a46741d8f0fcc28f2a523730d.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1840-130-0x0000000000530000-0x0000000000CBA000-memory.dmpFilesize
7.5MB