771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b

Analysis

max time kernel
102s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2022, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Size

59KB
MD5

6fd49e78e842ad294701332392cfcf87
SHA1

5afd01afe8a25b434b603bdede319d9383c165e4
SHA256

771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b
SHA512

a13699d4b78ae28dc4a4ec9480900761c41307f8452e2d4eef66220210bd7f57224a3c3983be8544fadb8b84f0b153ce0def95b0e2971b6399d49c4a5900b35a
SSDEEP

1536:9+1MKLlB0OcRUM0+siQr5MCgj/rSLsybOOb:ZKRB0vUX+siQr5Mf/8b

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ÏµÍ³°²È«Ä£¿é(Í£Ö¹¿ÉÄÜ»áÒýÆðÏµÍ³±ÀÀ£) = "D:\\Program\\3601\\AliWangWang.exe"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ÏµÍ³°²È«Ä£¿é(Í£Ö¹¿ÉÄÜ»áÒýÆðÏµÍ³±ÀÀ£) = "D:\\Program\\3601\\AliWangWang.exe"	regedit.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msscp.reg	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
File opened for modification	C:\Windows\SysWOW64\msscp.reg	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\web\Index.html	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
File created	C:\Windows\web\Index.htm	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
File opened for modification	C:\Windows\web\Index.htm	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
File created	C:\Windows\web\Index.html	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.18286.net/?shen"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.18286.net/?shen"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)\Command\ = "Rundll32.exe"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "0"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\1 = "20221001"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "1"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\cdafile2 = "22154"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.18286.net/?shen"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)"	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)\Command	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe

Runs .reg file with regedit 2 IoCs

pid	Process
4440	regedit.exe
1280	regedit.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 4440	2248	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	82
PID 2248 wrote to memory of 4440	2248	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	82
PID 2248 wrote to memory of 4440	2248	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	82
PID 2248 wrote to memory of 4636	2248	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	83
PID 2248 wrote to memory of 4636	2248	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	83
PID 2248 wrote to memory of 4636	2248	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	83
PID 4636 wrote to memory of 1280	4636	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	84
PID 4636 wrote to memory of 1280	4636	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	84
PID 4636 wrote to memory of 1280	4636	771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe	84

C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
"C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
  2⤵
  - Adds Run key to start application
  - Runs .reg file with regedit
  PID:4440
- C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
  C:\Users\Admin\AppData\Local\Temp\771fc4adb65a14245b48bbeebb9a117c64533b2ae25aaf1b19441e64e70f188b.exe
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\regedit.exe
    C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
    3⤵
    - Adds Run key to start application
    - Runs .reg file with regedit
    PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msscp.reg

Filesize
186B

MD5
97bb432b5cae0536bff55662c52b9c12

SHA1
961f2656f1cdf0f259aabdbbf8153c5b77e773b2

SHA256
44838bc72e7c1cfd43b7b93618c322a495d12354f996763dce55ac0be3f6db8b

SHA512
d6bd0f9f9e44777c1e622205e39c4bbde340e742fb6f947e6829d47f3a3f278a74b670452293fd8542d617e60161e2245d9f4ead5ab531fe2214008c734f8a46

Download Submit
C:\Windows\SysWOW64\msscp.reg

Filesize
186B

MD5
97bb432b5cae0536bff55662c52b9c12

SHA1
961f2656f1cdf0f259aabdbbf8153c5b77e773b2

SHA256
44838bc72e7c1cfd43b7b93618c322a495d12354f996763dce55ac0be3f6db8b

SHA512
d6bd0f9f9e44777c1e622205e39c4bbde340e742fb6f947e6829d47f3a3f278a74b670452293fd8542d617e60161e2245d9f4ead5ab531fe2214008c734f8a46

Download Submit
memory/2248-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2248-139-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4636-138-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads