Overview

overview

6

Static

static

5

3d423c0817...22.exe

windows7-x64

6

3d423c0817...22.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-10-2022 23:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe

  • Size

    873KB

  • MD5

    0184f48ae44b8cd7b20173d0e53dd120

  • SHA1

    311c933431ee3bc397e702c77bff933ead1262f1

  • SHA256

    3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22

  • SHA512

    194320b330ec4258d9b95d03602245713721293d32a63a01abf1d2c85a1de36ea9ad3ca7a12475337900f2b405210be2617e2afabc49c77fb14bc041bfcbca72

  • SSDEEP

    12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4avG9ORZ4JxKiHaZQHuMtL2:5RmJkcoQricOIQxiZY1iavG4wzxY

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 50 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
    "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
      "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1312
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:472072 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:988
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:3224583 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:268
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:3224598 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:860
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:3945490 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2108
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:3945514 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2396
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:2896919 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2664
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:3159100 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2932
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:2765879 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2264
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:1717288 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1900
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:2438197 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2360
    • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
      "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        3⤵
          PID:1804
      • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
        "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
        2⤵
          PID:1528
        • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
          "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
          2⤵
            PID:1920
          • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
            "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
            2⤵
              PID:1000
            • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
              "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
              2⤵
                PID:1628
              • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                2⤵
                  PID:1480
                • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                  "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                  2⤵
                    PID:2208
                  • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                    "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                    2⤵
                      PID:2300
                    • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                      "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                      2⤵
                        PID:2488
                      • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                        "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                        2⤵
                          PID:2568
                        • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                          "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                          2⤵
                            PID:2756
                          • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                            "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                            2⤵
                              PID:2868
                            • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                              "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                              2⤵
                                PID:3028
                              • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                                "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                                2⤵
                                  PID:2100
                                • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                                  "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                                  2⤵
                                    PID:2368
                                  • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                                    "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                                    2⤵
                                      PID:1876
                                    • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                                      "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                                      2⤵
                                        PID:2844
                                      • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                                        "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                                        2⤵
                                          PID:1604
                                        • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                                          "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                                          2⤵
                                            PID:688
                                          • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                                            "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                                            2⤵
                                              PID:2888
                                            • C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe
                                              "C:\Users\Admin\AppData\Local\Temp\3d423c08177f0939ec0a4c010d0c8513e2d78c38cfc6b3b35cbe974589086b22.exe"
                                              2⤵
                                                PID:2228

                                            Network

                                            MITRE ATT&CK Matrix ATT&CK v6

                                            Initial Access

                                            Execution

                                            Persistence

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1060

                                            Privilege Escalation

                                            Defense Evasion

                                            Modify Registry

                                            2
                                            T1112

                                            Credential Access

                                            Discovery

                                            System Information Discovery

                                            1
                                            T1082

                                            Lateral Movement

                                            Collection

                                            Exfiltration

                                            Command and Control

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MFFO83MU.txt
                                              Filesize

                                              603B

                                              MD5

                                              071c9680e8592f580d77ea8022ac1bcf

                                              SHA1

                                              9f57ef12357e73fa7631e46083f179a78c721452

                                              SHA256

                                              fc4fb428e224b59c0548febbc5b62b02ea3f6f87a947012187951c6495c15a00

                                              SHA512

                                              ab0554d62678b11e843c6b967a207e41c7910efa54e846247dae210a7c7c5c7f08242313400f2b2ee74b248316bf62763a00a34c9c487dcb61380aec9377e1a7

                                              Download Submit
                                            • memory/688-271-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1000-105-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1208-72-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1208-75-0x0000000000402000-0x0000000000436200-memory.dmp
                                              Filesize

                                              208KB

                                              Download
                                            • memory/1480-127-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1528-86-0x0000000000402000-0x0000000000436200-memory.dmp
                                              Filesize

                                              208KB

                                              Download
                                            • memory/1528-83-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1604-260-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1628-119-0x0000000000402000-0x0000000000436200-memory.dmp
                                              Filesize

                                              208KB

                                              Download
                                            • memory/1628-116-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1756-54-0x0000000076871000-0x0000000076873000-memory.dmp
                                              Filesize

                                              8KB

                                              Download
                                            • memory/1876-238-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1904-64-0x0000000000402000-0x0000000000436200-memory.dmp
                                              Filesize

                                              208KB

                                              Download
                                            • memory/1904-63-0x0000000000402000-0x0000000000436200-memory.dmp
                                              Filesize

                                              208KB

                                              Download
                                            • memory/1904-61-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1904-60-0x0000000000400000-0x000000000043C000-memory.dmp
                                              Filesize

                                              240KB

                                              Download
                                            • memory/1904-55-0x0000000000400000-0x000000000043C000-memory.dmp
                                              Filesize

                                              240KB

                                              Download
                                            • memory/1904-56-0x0000000000400000-0x000000000043C000-memory.dmp
                                              Filesize

                                              240KB

                                              Download
                                            • memory/1904-58-0x0000000000400000-0x000000000043C000-memory.dmp
                                              Filesize

                                              240KB

                                              Download
                                            • memory/1904-59-0x0000000000400000-0x000000000043C000-memory.dmp
                                              Filesize

                                              240KB

                                              Download
                                            • memory/1920-94-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/1920-97-0x0000000000402000-0x0000000000436200-memory.dmp
                                              Filesize

                                              208KB

                                              Download
                                            • memory/2100-216-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2208-138-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2228-293-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2300-149-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2368-227-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2488-160-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2568-171-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2756-183-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2844-249-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2868-194-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/2888-282-0x000000000043600E-mapping.dmp
                                              Download
                                            • memory/3028-205-0x000000000043600E-mapping.dmp
                                              Download