Analysis
-
max time kernel
119s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-09-2022 00:59
Static task
static1
Behavioral task
behavioral1
Sample
55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe
Resource
win10v2004-20220812-en
General
-
Target
55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe
-
Size
95KB
-
MD5
16071c37dbf1f60aec45dcc15743f6e3
-
SHA1
8b721e24288ad0a788dd2c683f1e57dc67ea1bed
-
SHA256
55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5
-
SHA512
25da3566fac8ed030b8e882c22afb01bdc3cd6e8d29c0d17b9387efddf0f81d0d2bb06963136816cbac609e94f625c712cbad6caad6707583368b252b91c3de6
-
SSDEEP
1536:EpgpHzb9dZVX9fHMvG0D3XJ3B/f2gUBglcADKd56zAmxFGlbJUcFJVKM5aUrr:ygXdZt9P6D3XJ3JOgkjADKd5H+FkFJnD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1912 installstat.exe -
Loads dropped DLL 4 IoCs
pid Process 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 1912 installstat.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\EditPlus\kk31.icw 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c5c690d8cbd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B15C2C11-37CB-11ED-A064-6A6CB2F85B9F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000ea9f4f07932142f2bd954cf5eae73c46cde55cb43df7acb026f12c4191f60619000000000e800000000200002000000094831817c2b734b0847059d1757e63bda0d07f9a1c26ea7bce042d66520149f920000000d9700bd0c5943b654fe3c89c58f32ccd1254ebd9aa047e07b0222708b4721db640000000512819988d97f17b2c0d7d378cf2793e95b74d9c2aab06814059b2142b228187f6302b8eb9b8911d0c13a18e86c23f8c278862d84ba7852419c67aa206badaae iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370323328" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000004b1dd1de858740035f99125914392091ec360694a7f7a02de34ad1cd81fddfbd000000000e80000000020000200000002bfb7612b597fc9c6cb04afa0b71905bc8eec5acca9bcb113d96081af0ba2dea9000000023c10e3e0d092579d5016d7f33e5ab339027c42f46ca6439ae44244846d8924418a8493ca5373d3c77f831dbea10f36f0b341ad610474f5b0cc82a58925a5209b7e60d46d0a8c0a2f81375b502daf3a4ba926a350864fc2ac6e62b4fe3d121f0aae794f31f4120cbbc4854a8bbf42ab0b7ba276e9f9373ea567518acd072554b697710497ddb415cb9a1def0ab2efdc940000000265ebd26a000a6f29f275c975c94ea845e9a5e37e1f197eed21c0821681c999ab07ca7d00a3c331ff309cd148a358f3111d8834639290e4bd10082b721150b00 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icwfile 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command\ = "%SystemRoot%\\SysWow64\\WScript.exe \"%1\" %*" 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.icw 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.icw\ = "icwfile" 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\ScriptEngine\ = "VBScript" 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\ = "´ò¿ª(&O)" 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\icwfile\Shell\Open\Command 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe Token: SeBackupPrivilege 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 944 iexplore.exe 944 iexplore.exe 928 IEXPLORE.EXE 928 IEXPLORE.EXE 928 IEXPLORE.EXE 928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1620 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 28 PID 2000 wrote to memory of 1620 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 28 PID 2000 wrote to memory of 1620 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 28 PID 2000 wrote to memory of 1620 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 28 PID 2000 wrote to memory of 1620 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 28 PID 2000 wrote to memory of 1620 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 28 PID 2000 wrote to memory of 1620 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 28 PID 1620 wrote to memory of 1764 1620 cscript.exe 30 PID 1620 wrote to memory of 1764 1620 cscript.exe 30 PID 1620 wrote to memory of 1764 1620 cscript.exe 30 PID 1620 wrote to memory of 1764 1620 cscript.exe 30 PID 1620 wrote to memory of 1764 1620 cscript.exe 30 PID 1620 wrote to memory of 1764 1620 cscript.exe 30 PID 1620 wrote to memory of 1764 1620 cscript.exe 30 PID 2000 wrote to memory of 1912 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 33 PID 2000 wrote to memory of 1912 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 33 PID 2000 wrote to memory of 1912 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 33 PID 2000 wrote to memory of 1912 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 33 PID 2000 wrote to memory of 1912 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 33 PID 2000 wrote to memory of 1912 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 33 PID 2000 wrote to memory of 1912 2000 55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe 33 PID 944 wrote to memory of 928 944 iexplore.exe 34 PID 944 wrote to memory of 928 944 iexplore.exe 34 PID 944 wrote to memory of 928 944 iexplore.exe 34 PID 944 wrote to memory of 928 944 iexplore.exe 34 PID 944 wrote to memory of 928 944 iexplore.exe 34 PID 944 wrote to memory of 928 944 iexplore.exe 34 PID 944 wrote to memory of 928 944 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe"C:\Users\Admin\AppData\Local\Temp\55d785129f3dfd02438a2cffa5625575484146af3c290e4939218185596c13b5.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\system32\cscript.exe" "C:\Program Files (x86)\EditPlus\kk31.icw"2⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWow64\WScript.exe"C:\Windows\SysWow64\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\kk31.icw"3⤵PID:1764
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\installstat.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:944 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:928
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132B
MD5680d4f1a3232585e2e7fb3a52813f84d
SHA17f4dd536a6cb2ffbb738d7ee49dffe28f030af24
SHA256d1be6c7a3743f1bab0a67fb89da988e4357fa32478ea6cb75dd9ab8261f1801a
SHA512888eedc4907fe636361cfcd498205bb04e8af728a5f096d333460ba8939e61afcddfc3b16e51a32373e5120b42d1fe4495a281d64700fb71c8e8075e86917e98
-
Filesize
608B
MD51948d88353abc9f03d56af149dd99a17
SHA1e9a4ec41e7e8f1e8ef6cbc4507b86b82840b464c
SHA256a208d5f7ca1e8ba990f5af7b6b25d7e9551df5bc725300dd902c695c5df5fe96
SHA5121e3ceba29e4536c2fa4e732d6572f5db919d09f71a1f6f1bfbf3e8e7b5c50c84748e614a77227c733f9804c75d57c225ef9870c31442b289d061bb63bf9c8cd7
-
Filesize
44KB
MD57c30927884213f4fe91bbe90b591b762
SHA165693828963f6b6a5cbea4c9e595e06f85490f6f
SHA2569032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994
SHA5128aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab
-
Filesize
742B
MD5f735c2d1e7c8f24a86e48b9e45a61b24
SHA142c53fcd79b4078b8742e9b29e88d87f8384830f
SHA25697a2e076424949b5bb26e4818548be6507f78ba4d3ede5dbfb42f61b6973a979
SHA512495abc7d36400651d4c004bf521a1715880f64ac892e3206fb8100eddf15167d711a5a6b29e66a3ec013c4f6f95fbb13ca25889615c66fee4a07f03ef31cdb28
-
Filesize
80KB
MD5d2a43490acc2c80d87139db0dedb537e
SHA18f36e5865a03511b04961692af6053ce4365db96
SHA256b9e841ae979cff45a71df03cdc18a7908cc36a79d2aa72896714248be818644d
SHA512d8b3382755848e0b53b785054effd034546eb5919b4c1f248de484a56342ebe5d62a2ff3f4629e72361e32bad0cee179d5eaedaf9508e106ef74740413197a34
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
6KB
MD5acc2b699edfea5bf5aae45aba3a41e96
SHA1d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA256168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
SHA512e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
Filesize
44KB
MD57c30927884213f4fe91bbe90b591b762
SHA165693828963f6b6a5cbea4c9e595e06f85490f6f
SHA2569032757cabb19a10e97e158810f885a015f3dcd5ba3da44c795d999ea90f8994
SHA5128aadb5fd3750ab0c036c7b8d2c775e42688265b00fe75b43a6addaefc7ee20d9fa3f074dd7943570c8519943011eda08216e90551b6d6a782b9ed5ce20aa6bab
-
Filesize
80KB
MD5d2a43490acc2c80d87139db0dedb537e
SHA18f36e5865a03511b04961692af6053ce4365db96
SHA256b9e841ae979cff45a71df03cdc18a7908cc36a79d2aa72896714248be818644d
SHA512d8b3382755848e0b53b785054effd034546eb5919b4c1f248de484a56342ebe5d62a2ff3f4629e72361e32bad0cee179d5eaedaf9508e106ef74740413197a34