Analysis
-
max time kernel
139s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe
Resource
win7-20220812-en
General
-
Target
513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe
-
Size
301KB
-
MD5
77d0ce0683aa2f27c161f1c1c3ac87f4
-
SHA1
f9c6f8db507e5ae9e7ee3bce6682d2310b31b7da
-
SHA256
513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4
-
SHA512
1d3267aaa1e84038c2b833dec662aaac272709985bf0b120dd66606eb299bba9ea95940d6b51eedbf3f14f011ce6f6c69fcc37fd3efc80f1ecd36efa5fb9401c
-
SSDEEP
6144:NCjVktZuPRDf+cxRPxEYhBHStiVuU9r8wYbF0wp3kskcRAdAVx64eI7oFcnzd8PA:NCjutZu5Dm27HStVMr8wYbF0wp3kskcX
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4928 PebbleJamb.exe 4892 PebbleJamb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe -
Loads dropped DLL 1 IoCs
pid Process 4564 regsvr32.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F} regsvr32.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\HarridanTaper\KnockerLevitate.exe PebbleJamb.exe File opened for modification C:\Program Files\HarridanTaper\KnockerLevitate.exe PebbleJamb.exe File created C:\Program Files\DissonantImpose\DissonantAxis.exe PebbleJamb.exe File opened for modification C:\Program Files\DissonantImpose\DissonantAxis.exe PebbleJamb.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ZAYUOZBIDUJF.dll 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\HELPDIR\ = "C:\\Windows" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\ProgID\ = "Thunder.xunlei.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\TypeLib\ = "{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\ = "{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\ = "Thunder 1.0 Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\0\win32\ = "C:\\Windows\\ZAYUOZBIDUJF.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ = "Ixunlei" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\ = "xunlei Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei.1\CLSID\ = "{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\ = "xunlei Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\ = "{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\ = "xunlei Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CLSID\ = "{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\VersionIndependentProgID\ = "Thunder.xunlei" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ = "Ixunlei" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05D67BE6-2A57-DB9A-2C0A-BF2753C5CC9F}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Thunder.xunlei\CurVer\ = "Thunder.xunlei.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\InprocServer32\ = "C:\\Windows\\ZAYUOZBIDUJF.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4BAEFBE-7CF3-0EA8-3E22-080C5180AC1F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{11D9AE74-3FC1-41D6-911B-F5F503BBD8FE}\TypeLib\Version = "1.0" regsvr32.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 4928 PebbleJamb.exe 4928 PebbleJamb.exe 4892 PebbleJamb.exe 4892 PebbleJamb.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1968 wrote to memory of 4564 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 82 PID 1968 wrote to memory of 4564 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 82 PID 1968 wrote to memory of 4564 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 82 PID 1968 wrote to memory of 4928 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 83 PID 1968 wrote to memory of 4928 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 83 PID 1968 wrote to memory of 4928 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 83 PID 1968 wrote to memory of 4892 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 84 PID 1968 wrote to memory of 4892 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 84 PID 1968 wrote to memory of 4892 1968 513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe"C:\Users\Admin\AppData\Local\Temp\513adfc4da83e238e2610c874859bc9e943d7ab8af40544cdd935cd52adc23c4.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Windows\ZAYUOZBIDUJF.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4564
-
-
C:\Users\Admin\AppData\Local\Temp\PebbleJamb.exe"C:\Users\Admin\AppData\Local\Temp\PebbleJamb.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4928
-
-
C:\Users\Admin\AppData\Local\Temp\PebbleJamb.exeC:\Users\Admin\AppData\Local\Temp\PebbleJamb.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8
-
Filesize
28KB
MD56697555ead62e6b9fb71a0ffb6d62992
SHA155b57b52fe0d4af8716db57a98ab011b1dbe4181
SHA256683a7e3bc4e63ba70bf88c23ae895109d19fc02c9d084ddd759a5569b56d2cd6
SHA51236b7c24cbc5cef1ea6cca65c2054e3baae7096932bbb2caa4857d4f324407fe5a92e610d7baf979dfa881d82f9c99c74037b774967cd5d31af5a120bd9eefdf8
-
Filesize
333KB
MD5b97630aa0bfe1420c162a253610d170a
SHA116c9ea06288ab5948612d2dcb28be2df719dda35
SHA256d9ecd3a1bcabe58164820a4dc28277652ac2f5f6efeff6ab46cf8d3b88a37b65
SHA5126dd5296f88d6fadb59b1722a92e716a4135bb6f37b1b9ac31b884ff1f9d8c4ebc8d96914e68f67074254d24fc8a4cbaaf1ce5fb9980875d77a8173da49189ec2
-
Filesize
333KB
MD5b97630aa0bfe1420c162a253610d170a
SHA116c9ea06288ab5948612d2dcb28be2df719dda35
SHA256d9ecd3a1bcabe58164820a4dc28277652ac2f5f6efeff6ab46cf8d3b88a37b65
SHA5126dd5296f88d6fadb59b1722a92e716a4135bb6f37b1b9ac31b884ff1f9d8c4ebc8d96914e68f67074254d24fc8a4cbaaf1ce5fb9980875d77a8173da49189ec2