24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd

Analysis

max time kernel
41s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd.exe
Size

2.1MB
MD5

62d0806bbced68c19cc35e7e903f615c
SHA1

05156114b1d73e71b5c7d49d6ea6ab9016be53c5
SHA256

24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd
SHA512

db80743294917ed69a3914ea4f5c702ae991acd4b2c5f0dd501ba03608ee97237e641659ab41f9ae6aa75120687d88fd10e0b3a05a00b3a61a0aa66fffdbcfb7
SSDEEP

24576:h1OYdaO9qU2Uzf5VilCfBJylWSzDBXEZc78KU88SmhrOzcg:h1OsLqBI5VilCfevvOhrm7

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1068	KB28Rt753T1sBi4.exe
612	KB28Rt753T1sBi4.exe

Loads dropped DLL 4 IoCs

pid	Process
1456	24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd.exe
1068	KB28Rt753T1sBi4.exe
1068	KB28Rt753T1sBi4.exe
612	KB28Rt753T1sBi4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit\command	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\__aHTML	KB28Rt753T1sBi4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\__aHTML\shell\Edit\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\QSMFQD.tmp\\KB28Rt753T1sBi4.exe\" target \".\\\" bits downExt"	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\SystemFileAssociations\.aHTML\shell	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit	KB28Rt753T1sBi4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit\command\ = "Notepad.exe"	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\__aHTML\shell\Edit\command	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.aHTML\OpenWithProgids	KB28Rt753T1sBi4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.aHTML\OpenWithProgids\__aHTML	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.aHTML	KB28Rt753T1sBi4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\.aHTML\ = "__aHTML"	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit\ddeexec	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\__aHTML\shell	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\__aHTML\shell\Edit	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\__aHTML\shell\Edit\ddeexec	KB28Rt753T1sBi4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\__aHTML\shell\Edit\command\ = "Notepad.exe"	KB28Rt753T1sBi4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\SystemFileAssociations\.aHTML\shell\Edit\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\QSMFQD.tmp\\KB28Rt753T1sBi4.exe\" target \".\\\" bits downExt"	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\SystemFileAssociations	KB28Rt753T1sBi4.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\SystemFileAssociations\.aHTML	KB28Rt753T1sBi4.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
612	KB28Rt753T1sBi4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	KB28Rt753T1sBi4.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1456 wrote to memory of 1068	1456	24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd.exe	27
PID 1456 wrote to memory of 1068	1456	24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd.exe	27
PID 1456 wrote to memory of 1068	1456	24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd.exe	27
PID 1456 wrote to memory of 1068	1456	24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd.exe	27
PID 1068 wrote to memory of 612	1068	KB28Rt753T1sBi4.exe	28
PID 1068 wrote to memory of 612	1068	KB28Rt753T1sBi4.exe	28
PID 1068 wrote to memory of 612	1068	KB28Rt753T1sBi4.exe	28
PID 1068 wrote to memory of 612	1068	KB28Rt753T1sBi4.exe	28
PID 612 wrote to memory of 368	612	KB28Rt753T1sBi4.exe	29
PID 612 wrote to memory of 368	612	KB28Rt753T1sBi4.exe	29
PID 612 wrote to memory of 368	612	KB28Rt753T1sBi4.exe	29
PID 612 wrote to memory of 368	612	KB28Rt753T1sBi4.exe	29
PID 612 wrote to memory of 368	612	KB28Rt753T1sBi4.exe	29
PID 612 wrote to memory of 368	612	KB28Rt753T1sBi4.exe	29
PID 612 wrote to memory of 368	612	KB28Rt753T1sBi4.exe	29

C:\Users\Admin\AppData\Local\Temp\24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd.exe
"C:\Users\Admin\AppData\Local\Temp\24f65dcf55e17887490473b14edbb9d779dbce37434ed21c212fe16c1c4b65bd.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456
- C:\Users\Admin\AppData\Local\Temp\7zS171A.tmp\KB28Rt753T1sBi4.exe
  .\KB28Rt753T1sBi4.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\KB28Rt753T1sBi4.exe
    "C:\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\KB28Rt753T1sBi4.exe" target ".\" bits downExt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /u /s ".\\cm9fbqoZ3bDwLq.x64.dll"
      4⤵
      PID:368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS171A.tmp\KB28Rt753T1sBi4.dat

Filesize
15KB

MD5
ea4c905bf476b828730911ec85e6d397

SHA1
9d03d3ac8d93fd673c55bbeea3487d8a4568eb71

SHA256
f6e0162f83dc148f13bc39092d25ff3ad92a0782743caaa91ca4d1e3a2e3c171

SHA512
da2a2f98004b36cc04a1b2377d11f7c94197eddd37cac841756d18cc150fb2ec5d8fe065e5553edf2045080f15c34de5bf7ebea8664d2ebe07ec465dc19e92dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS171A.tmp\KB28Rt753T1sBi4.exe

Filesize
218KB

MD5
9f6c52eec607111136cd222b02bf0530

SHA1
57f3815d0942e3b0a9bef621a7b4971f55fc74d7

SHA256
7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

SHA512
6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS171A.tmp\KB28Rt753T1sBi4.exe

Filesize
218KB

MD5
9f6c52eec607111136cd222b02bf0530

SHA1
57f3815d0942e3b0a9bef621a7b4971f55fc74d7

SHA256
7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

SHA512
6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS171A.tmp\cm9fbqoZ3bDwLq.dll

Filesize
863KB

MD5
b92f742401098c60807ff0066f0d6c08

SHA1
99421317bc1900af0864a63e7f3b37f8b95a6a4b

SHA256
0e4702414207b31a2d09e42f376c0b70bafb080a04c029b514c0e8b78d4e892b

SHA512
abc6a9adc06b442ba802895bbef86f1bca7e89bc585daa71171d686944b6fdd422c7074043e3a76d0bfe00f2c587771f70a58bd6461b62de685cc41d85fb9b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS171A.tmp\cm9fbqoZ3bDwLq.tlb

Filesize
5KB

MD5
1ca45b386c7b01e1bd45ef4e291d3f70

SHA1
dcabb955bc45b182231459d7e64cba59592c907e

SHA256
495c35bf29cd1c6e4a736db79e87203b6fd0c1345343dab958e5d9a4b087754c

SHA512
87dc04954e21af239f1cd8a300d7ea34c0de9580598080df8e2e75d347ad0232770b37d648db772f5d854a553f395a1fe9c010071ee76024f64ed819371fe752

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS171A.tmp\cm9fbqoZ3bDwLq.x64.dll

Filesize
945KB

MD5
5c5e896a5cf021963feb788efef24f10

SHA1
4b1bd0ff46ce3e9aebae5c434f32042a84367e68

SHA256
6711b09f9f7ba41e733d635f9df51055c50c2447e20145739dba0acb7c1e8269

SHA512
e5f4eb44629e655e1cff507a670360ae7b77b6b5bfb5b4a3a01318da2b9bbfc16e85422a69680f6088ad1c0cd696856c7f5010b70960e0a351df0be3cbce9365

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\KB28Rt753T1sBi4.dat

Filesize
15KB

MD5
ea4c905bf476b828730911ec85e6d397

SHA1
9d03d3ac8d93fd673c55bbeea3487d8a4568eb71

SHA256
f6e0162f83dc148f13bc39092d25ff3ad92a0782743caaa91ca4d1e3a2e3c171

SHA512
da2a2f98004b36cc04a1b2377d11f7c94197eddd37cac841756d18cc150fb2ec5d8fe065e5553edf2045080f15c34de5bf7ebea8664d2ebe07ec465dc19e92dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\KB28Rt753T1sBi4.exe

Filesize
218KB

MD5
9f6c52eec607111136cd222b02bf0530

SHA1
57f3815d0942e3b0a9bef621a7b4971f55fc74d7

SHA256
7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

SHA512
6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\KB28Rt753T1sBi4.exe

Filesize
218KB

MD5
9f6c52eec607111136cd222b02bf0530

SHA1
57f3815d0942e3b0a9bef621a7b4971f55fc74d7

SHA256
7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

SHA512
6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\cm9fbqoZ3bDwLq.dll

Filesize
863KB

MD5
b92f742401098c60807ff0066f0d6c08

SHA1
99421317bc1900af0864a63e7f3b37f8b95a6a4b

SHA256
0e4702414207b31a2d09e42f376c0b70bafb080a04c029b514c0e8b78d4e892b

SHA512
abc6a9adc06b442ba802895bbef86f1bca7e89bc585daa71171d686944b6fdd422c7074043e3a76d0bfe00f2c587771f70a58bd6461b62de685cc41d85fb9b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\cm9fbqoZ3bDwLq.tlb

Filesize
5KB

MD5
1ca45b386c7b01e1bd45ef4e291d3f70

SHA1
dcabb955bc45b182231459d7e64cba59592c907e

SHA256
495c35bf29cd1c6e4a736db79e87203b6fd0c1345343dab958e5d9a4b087754c

SHA512
87dc04954e21af239f1cd8a300d7ea34c0de9580598080df8e2e75d347ad0232770b37d648db772f5d854a553f395a1fe9c010071ee76024f64ed819371fe752

Download Submit
C:\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\cm9fbqoZ3bDwLq.x64.dll

Filesize
945KB

MD5
5c5e896a5cf021963feb788efef24f10

SHA1
4b1bd0ff46ce3e9aebae5c434f32042a84367e68

SHA256
6711b09f9f7ba41e733d635f9df51055c50c2447e20145739dba0acb7c1e8269

SHA512
e5f4eb44629e655e1cff507a670360ae7b77b6b5bfb5b4a3a01318da2b9bbfc16e85422a69680f6088ad1c0cd696856c7f5010b70960e0a351df0be3cbce9365

Download Submit
\Users\Admin\AppData\Local\Temp\7zS171A.tmp\KB28Rt753T1sBi4.exe

Filesize
218KB

MD5
9f6c52eec607111136cd222b02bf0530

SHA1
57f3815d0942e3b0a9bef621a7b4971f55fc74d7

SHA256
7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

SHA512
6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

Download Submit
\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\KB28Rt753T1sBi4.exe

Filesize
218KB

MD5
9f6c52eec607111136cd222b02bf0530

SHA1
57f3815d0942e3b0a9bef621a7b4971f55fc74d7

SHA256
7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

SHA512
6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

Download Submit
\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\KB28Rt753T1sBi4.exe

Filesize
218KB

MD5
9f6c52eec607111136cd222b02bf0530

SHA1
57f3815d0942e3b0a9bef621a7b4971f55fc74d7

SHA256
7314c47aa633946386d6d3cd7ac292974b5d457e14b053fa0ebc218d555c34f4

SHA512
6760f5f8b580f50e95a92d6baa096f8fee378047bc5833430503869db22e369ebbedad43c864ef1058a477cf4d1034c88f1f464cde467ccc904192718951ce54

Download Submit
\Users\Admin\AppData\Local\Temp\QSMFQD.tmp\cm9fbqoZ3bDwLq.dll

Filesize
863KB

MD5
b92f742401098c60807ff0066f0d6c08

SHA1
99421317bc1900af0864a63e7f3b37f8b95a6a4b

SHA256
0e4702414207b31a2d09e42f376c0b70bafb080a04c029b514c0e8b78d4e892b

SHA512
abc6a9adc06b442ba802895bbef86f1bca7e89bc585daa71171d686944b6fdd422c7074043e3a76d0bfe00f2c587771f70a58bd6461b62de685cc41d85fb9b48

Download Submit
memory/1456-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download