Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 01:13
Behavioral task
behavioral1
Sample
cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe
-
Size
322KB
-
MD5
6f1056f8be28beee7af723c11c3ddf40
-
SHA1
1a5063c23f5f3df7523a664b0b3aa5b73f0c0a7b
-
SHA256
cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94
-
SHA512
762ac26fd81afdb6840851202c9daa66256fb65bc738db15acad78a96ffe7c2e30f1ce809db4399f12afd187890eec4f6e3fbf134abd2bc2b9a08ad156bbb9a4
-
SSDEEP
6144:lYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO7B:lSNC80I+cR3R03VseuOt
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe chrome.exe" cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral1/memory/1148-55-0x0000000000400000-0x00000000004B1000-memory.dmp upx behavioral1/memory/1148-62-0x0000000000400000-0x00000000004B1000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\chrome.exe" cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\s: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\t: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\u: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\w: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\h: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\o: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\i: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\k: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\p: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\x: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\y: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\a: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\e: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\n: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\b: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\f: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\l: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\m: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\r: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\v: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\z: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\g: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened (read-only) \??\j: cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1148-55-0x0000000000400000-0x00000000004B1000-memory.dmp autoit_exe behavioral1/memory/1148-62-0x0000000000400000-0x00000000004B1000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\chrome.exe cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened for modification C:\Windows\SysWOW64\chrome.exe cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened for modification C:\Windows\SysWOW64\autorun.ini cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\chrome.exe cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe File opened for modification C:\Windows\chrome.exe cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://h1.ripway.com/poojasharma/index.html" cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://h1.ripway.com/poojasharma/index.html" cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://h1.ripway.com/poojasharma/index.html" cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://h1.ripway.com/poojasharma/index.html" cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://h1.ripway.com/poojasharma/index.html" cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1148 wrote to memory of 1080 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 27 PID 1148 wrote to memory of 1080 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 27 PID 1148 wrote to memory of 1080 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 27 PID 1148 wrote to memory of 1080 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 27 PID 1080 wrote to memory of 1196 1080 cmd.exe 29 PID 1080 wrote to memory of 1196 1080 cmd.exe 29 PID 1080 wrote to memory of 1196 1080 cmd.exe 29 PID 1080 wrote to memory of 1196 1080 cmd.exe 29 PID 1148 wrote to memory of 1108 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 30 PID 1148 wrote to memory of 1108 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 30 PID 1148 wrote to memory of 1108 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 30 PID 1148 wrote to memory of 1108 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 30 PID 1108 wrote to memory of 984 1108 cmd.exe 32 PID 1108 wrote to memory of 984 1108 cmd.exe 32 PID 1108 wrote to memory of 984 1108 cmd.exe 32 PID 1108 wrote to memory of 984 1108 cmd.exe 32 PID 1148 wrote to memory of 848 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 35 PID 1148 wrote to memory of 848 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 35 PID 1148 wrote to memory of 848 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 35 PID 1148 wrote to memory of 848 1148 cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe 35 PID 848 wrote to memory of 2004 848 cmd.exe 37 PID 848 wrote to memory of 2004 848 cmd.exe 37 PID 848 wrote to memory of 2004 848 cmd.exe 37 PID 848 wrote to memory of 2004 848 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe"C:\Users\Admin\AppData\Local\Temp\cdbd64f9c715b1cff6169e8d61485f96cb74c2e442bbbb9098d77217bac0ee94.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:1196
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\chrome.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\chrome.exe3⤵PID:984
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:2004
-
-