Analysis
-
max time kernel
131s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 06:24
Behavioral task
behavioral1
Sample
75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe
Resource
win10v2004-20220901-en
General
-
Target
75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe
-
Size
13KB
-
MD5
34456b6e8b46f7d803d7a1dd70260e75
-
SHA1
37c34f4c173c26a5751919c29cc06d081c816dfb
-
SHA256
75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e
-
SHA512
ca8f22395730ff9c50fde2c598128f1fe1d8cc4e5667bab193d4ef4fafa26d7e04e243d5a563b24bf1f3929e7d753454befdf379af46d79e23fbec5ffca19509
-
SSDEEP
384:WZF0z9VgnB7iKNddKVQyJb6k4J5D6GwGBCIw:WZF0zTgnBZdd7yJbgX3EN
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/668-54-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" \DelayServices 75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c2061619ccd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{344CE111-380C-11ED-808D-42A98B637845} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000009d3e789985b37d64aa9c17fed8167a918d05b058c1a9f08394732c3e17ebfbe7000000000e800000000200002000000025ae999b42c10ab193c32945590493aaa2aa9a077859c2194736ca075595a35b200000009bf1d8a388423795cd5d3f280ae987e649586d0e918df1a4e5f8cd4b4bb5976d40000000b1d7926f97fadebef92cf1e7e72c29c0c046624fc99e5ff6e4fd07dc6e54064a38c419986e99b3d4d6955b99a42dedcb43ba6b68bf23106f241df1b119920280 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a3000000000200000000001066000000010000200000009acd366cdcbc520b2df2dfeb8ec553ae0651150391f044e51266adb063e9e209000000000e80000000020000200000002380a4c721e0043457cd4c8979bec4ba9c2df8a6df502f4261f185db5ad7ab7190000000a29c6117f9aaa52361744a9873beb69f18bd9616bea0b638eb21622764219a9495a634eb2f3a14adbaee9310d3fbfd3a5d0868963ca70a1b735413d043fc6ffe5a9fe022faaa46694087dc15c40cd4201f6a449850678bd476328c566ef4f5db6a4d660b976f67a91df440758635dab017be5e4d7de72771795fdd003bb7a85c8b6cc9c31bd8d9e40ce3d8a55bdb896640000000191880630bb0e637bb2b40c9b23859420cd22f94db8a473012a5a724910c0209f92f16d3f9eb80deb7e3f1d62edd85211fcefcf76ae5c2a21bff2d9936f7eb4a iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 668 75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe 668 75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1892 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1892 iexplore.exe 1892 iexplore.exe 852 IEXPLORE.EXE 852 IEXPLORE.EXE 852 IEXPLORE.EXE 852 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 668 wrote to memory of 1892 668 75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe 28 PID 668 wrote to memory of 1892 668 75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe 28 PID 668 wrote to memory of 1892 668 75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe 28 PID 668 wrote to memory of 1892 668 75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe 28 PID 1892 wrote to memory of 852 1892 iexplore.exe 30 PID 1892 wrote to memory of 852 1892 iexplore.exe 30 PID 1892 wrote to memory of 852 1892 iexplore.exe 30 PID 1892 wrote to memory of 852 1892 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe"C:\Users\Admin\AppData\Local\Temp\75f0869a82f31c20f5dedb5a3de531680b1c3635f105a8758ae55c0a2ac9343e.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.download787.com/sanity.php?1=149121-100002⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:852
-
-