Analysis
-
max time kernel
168s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 20:50
Behavioral task
behavioral1
Sample
47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe
-
Size
764KB
-
MD5
ef67e4fb0ef1a45ff4bdd981597389c4
-
SHA1
3d243bf25dbe9978ac82fcf2605dde0ff25d1f94
-
SHA256
47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0
-
SHA512
4b7722d8fe895e734845ceb10b23d329f3b1aaf1bc2eca8a0599fcbe2613347a1e7af6dfaf69cf2bda8daa06a99549079adf05528407ef7080b1529d74250543
-
SSDEEP
12288:VM5DSN6aAH0XN32GXeWa7U8oico9hJMBex+SQL0:VM5D18N370NVlxhF
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1756 lsass.exe -
resource yara_rule behavioral1/memory/1780-60-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/files/0x0007000000013359-61.dat upx behavioral1/files/0x0007000000013359-62.dat upx behavioral1/memory/1780-65-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/files/0x0007000000013359-64.dat upx behavioral1/files/0x0007000000013359-67.dat upx behavioral1/memory/1756-68-0x0000000000400000-0x000000000052D000-memory.dmp upx behavioral1/memory/1756-69-0x0000000000400000-0x000000000052D000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\run32 = "C:\\Win\\lsass.exe" lsass.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run lsass.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\g: lsass.exe File opened (read-only) \??\k: lsass.exe File opened (read-only) \??\q: lsass.exe File opened (read-only) \??\t: lsass.exe File opened (read-only) \??\l: lsass.exe File opened (read-only) \??\s: lsass.exe File opened (read-only) \??\e: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\i: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\k: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\m: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\t: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\b: lsass.exe File opened (read-only) \??\a: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\p: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\x: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\n: lsass.exe File opened (read-only) \??\w: lsass.exe File opened (read-only) \??\e: lsass.exe File opened (read-only) \??\v: lsass.exe File opened (read-only) \??\f: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\g: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\q: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\r: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\y: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\a: lsass.exe File opened (read-only) \??\y: lsass.exe File opened (read-only) \??\z: lsass.exe File opened (read-only) \??\j: lsass.exe File opened (read-only) \??\o: lsass.exe File opened (read-only) \??\j: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\s: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\v: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\w: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\h: lsass.exe File opened (read-only) \??\i: lsass.exe File opened (read-only) \??\h: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\l: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\u: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\z: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\r: lsass.exe File opened (read-only) \??\b: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\f: lsass.exe File opened (read-only) \??\u: lsass.exe File opened (read-only) \??\n: 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe File opened (read-only) \??\m: lsass.exe File opened (read-only) \??\p: lsass.exe File opened (read-only) \??\x: lsass.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 37 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000000c55177c100041646d696e00380008000400efbe0c55cb700c55177c2a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c003100000000000c55e47210204c6f63616c00380008000400efbe0c55cb700c55e4722a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000000c55cb701100557365727300600008000400efbeee3a851a0c55cb702a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a0031000000000034554341102054656d700000360008000400efbe0c55cb70345543412a00000001020000000002000000000000000000000000000000540065006d007000000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = c6003100000000003455434117203437433436317e310000ae0008000400efbe34554341345543412a000000ab5400000000140000000000000000000000000000003400370063003400360031003600360039003600640031003600660036006200640064003900310033003500300066003600610035006600610064003500640063003100310034003500300062003300610030003200350039006300370033006300390039003600630035003000340034006200610034003800660065003000000018000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000000c55cb70122041707044617461003c0008000400efbe0c55cb700c55cb702a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1756 lsass.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1780 wrote to memory of 1284 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 28 PID 1780 wrote to memory of 1284 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 28 PID 1780 wrote to memory of 1284 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 28 PID 1780 wrote to memory of 1284 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 28 PID 1780 wrote to memory of 1756 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 30 PID 1780 wrote to memory of 1756 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 30 PID 1780 wrote to memory of 1756 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 30 PID 1780 wrote to memory of 1756 1780 47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe"C:\Users\Admin\AppData\Local\Temp\47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe C:\Users\Admin\AppData\Local\Temp\47c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe02⤵PID:1284
-
-
\??\c:\Win\lsass.exec:\Win\lsass.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: GetForegroundWindowSpam
PID:1756
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1228
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
764KB
MD5ef67e4fb0ef1a45ff4bdd981597389c4
SHA13d243bf25dbe9978ac82fcf2605dde0ff25d1f94
SHA25647c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0
SHA5124b7722d8fe895e734845ceb10b23d329f3b1aaf1bc2eca8a0599fcbe2613347a1e7af6dfaf69cf2bda8daa06a99549079adf05528407ef7080b1529d74250543
-
Filesize
764KB
MD5ef67e4fb0ef1a45ff4bdd981597389c4
SHA13d243bf25dbe9978ac82fcf2605dde0ff25d1f94
SHA25647c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0
SHA5124b7722d8fe895e734845ceb10b23d329f3b1aaf1bc2eca8a0599fcbe2613347a1e7af6dfaf69cf2bda8daa06a99549079adf05528407ef7080b1529d74250543
-
Filesize
764KB
MD5ef67e4fb0ef1a45ff4bdd981597389c4
SHA13d243bf25dbe9978ac82fcf2605dde0ff25d1f94
SHA25647c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0
SHA5124b7722d8fe895e734845ceb10b23d329f3b1aaf1bc2eca8a0599fcbe2613347a1e7af6dfaf69cf2bda8daa06a99549079adf05528407ef7080b1529d74250543
-
Filesize
764KB
MD5ef67e4fb0ef1a45ff4bdd981597389c4
SHA13d243bf25dbe9978ac82fcf2605dde0ff25d1f94
SHA25647c4616696d16f6bdd91350f6a5fad5dc11450b3a0259c73c996c5044ba48fe0
SHA5124b7722d8fe895e734845ceb10b23d329f3b1aaf1bc2eca8a0599fcbe2613347a1e7af6dfaf69cf2bda8daa06a99549079adf05528407ef7080b1529d74250543