Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 19:47
Behavioral task
behavioral1
Sample
771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Resource
win10v2004-20220901-en
General
-
Target
771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
-
Size
59KB
-
MD5
6fd49e78e842ad294701332392cfcf87
-
SHA1
5afd01afe8a25b434b603bdede319d9383c165e4
-
SHA256
771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b
-
SHA512
a13699d4b78ae28dc4a4ec9480900761c41307f8452e2d4eef66220210bd7f57224a3c3983be8544fadb8b84f0b153ce0def95b0e2971b6399d49c4a5900b35a
-
SSDEEP
1536:9+1MKLlB0OcRUM0+siQr5MCgj/rSLsybOOb:ZKRB0vUX+siQr5Mf/8b
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ϵͳ°²È«Ä£¿é(Í£Ö¹¿ÉÄÜ»áÒýÆðϵͳ±ÀÀ£) = "D:\\Program\\3601\\AliWangWang.exe" regedit.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ϵͳ°²È«Ä£¿é(Í£Ö¹¿ÉÄÜ»áÒýÆðϵͳ±ÀÀ£) = "D:\\Program\\3601\\AliWangWang.exe" regedit.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce regedit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\msscp.reg 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe File opened for modification C:\Windows\SysWOW64\msscp.reg 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\web\Index.htm 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe File opened for modification C:\Windows\web\Index.htm 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe File created C:\Windows\web\Index.html 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe File opened for modification C:\Windows\web\Index.html 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TYPEDURLS 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.18286.net/?shen" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.18286.net/?shen" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D) 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O) 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\1 = "20221001" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M) 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "0" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\cdafile2 = "22154" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "1" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.18286.net/?shen" 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8} 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R) 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe -
Runs .reg file with regedit 2 IoCs
pid Process 1188 regedit.exe 472 regedit.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1188 1388 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 27 PID 1388 wrote to memory of 1188 1388 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 27 PID 1388 wrote to memory of 1188 1388 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 27 PID 1388 wrote to memory of 1188 1388 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 27 PID 1388 wrote to memory of 764 1388 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 28 PID 1388 wrote to memory of 764 1388 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 28 PID 1388 wrote to memory of 764 1388 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 28 PID 1388 wrote to memory of 764 1388 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 28 PID 764 wrote to memory of 472 764 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 29 PID 764 wrote to memory of 472 764 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 29 PID 764 wrote to memory of 472 764 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 29 PID 764 wrote to memory of 472 764 771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe"C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exeC:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg3⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:472
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186B
MD597bb432b5cae0536bff55662c52b9c12
SHA1961f2656f1cdf0f259aabdbbf8153c5b77e773b2
SHA25644838bc72e7c1cfd43b7b93618c322a495d12354f996763dce55ac0be3f6db8b
SHA512d6bd0f9f9e44777c1e622205e39c4bbde340e742fb6f947e6829d47f3a3f278a74b670452293fd8542d617e60161e2245d9f4ead5ab531fe2214008c734f8a46
-
Filesize
186B
MD597bb432b5cae0536bff55662c52b9c12
SHA1961f2656f1cdf0f259aabdbbf8153c5b77e773b2
SHA25644838bc72e7c1cfd43b7b93618c322a495d12354f996763dce55ac0be3f6db8b
SHA512d6bd0f9f9e44777c1e622205e39c4bbde340e742fb6f947e6829d47f3a3f278a74b670452293fd8542d617e60161e2245d9f4ead5ab531fe2214008c734f8a46