Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2022 05:00

General

  • Target

    06f5a82e39012ff2b5862fb7037df8178b734c462d74e036ed1beb3951ea780c.exe

  • Size

    1.1MB

  • MD5

    732642d91b8fcb116b053152accadf6f

  • SHA1

    17871feee8f967a7d1d9a43dea3bec8f83f38de3

  • SHA256

    06f5a82e39012ff2b5862fb7037df8178b734c462d74e036ed1beb3951ea780c

  • SHA512

    d3bb7a3f23663fa2065bd79b31af946966aa2559691099fe5383232f0a5857a1625df2f0ad876a86048f6e1c407ca5f715229e96029858ce9487c6474ed69832

  • SSDEEP

    24576:LiM5uIshBc6ReEJwdQx5L9MFy75C7HMIPga:xuj06wdU9MZMQ

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06f5a82e39012ff2b5862fb7037df8178b734c462d74e036ed1beb3951ea780c.exe
    "C:\Users\Admin\AppData\Local\Temp\06f5a82e39012ff2b5862fb7037df8178b734c462d74e036ed1beb3951ea780c.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Users\Admin\AppData\Local\Temp\06f5a82e39012ff2b5862fb7037df8178b734c462d74e036ed1beb3951ea780cmgr.exe
      C:\Users\Admin\AppData\Local\Temp\06f5a82e39012ff2b5862fb7037df8178b734c462d74e036ed1beb3951ea780cmgr.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Program Files (x86)\Microsoft\WaterMark.exe
        "C:\Program Files (x86)\Microsoft\WaterMark.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:4820
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          4⤵
            PID:3276
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 204
              5⤵
              • Program crash
              PID:1940
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4424
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4424 CREDAT:17410 /prefetch:2
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3768
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1824
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1824 CREDAT:17410 /prefetch:2
              5⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:5056
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3276 -ip 3276
      1⤵
        PID:4248

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        119KB

        MD5

        9d5d609dc8e2554054733d19eed45c5c

        SHA1

        ce72453fca9f477940a9def32bd8463549c6e1e4

        SHA256

        7a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1

        SHA512

        012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b

      • C:\Program Files (x86)\Microsoft\WaterMark.exe

        Filesize

        119KB

        MD5

        9d5d609dc8e2554054733d19eed45c5c

        SHA1

        ce72453fca9f477940a9def32bd8463549c6e1e4

        SHA256

        7a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1

        SHA512

        012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        471B

        MD5

        f525b778e6901e8c416e2920e4e3dc0b

        SHA1

        917ce8ae6d64bdd4dd438488176253022c57a083

        SHA256

        c9eee793aa4aa79f35d393f9f1d863483aaf4004dea6ac19bda868e92a71f8bd

        SHA512

        f6f47a4935c09769b8df316e1b459c7b153ed26ac409d4bf2ce62a1635dba4eaf7ce77de5ce83100d6f3ce7aadffed7591fb7cee7ac10a0c081a2d3c613f1ad8

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        471B

        MD5

        f525b778e6901e8c416e2920e4e3dc0b

        SHA1

        917ce8ae6d64bdd4dd438488176253022c57a083

        SHA256

        c9eee793aa4aa79f35d393f9f1d863483aaf4004dea6ac19bda868e92a71f8bd

        SHA512

        f6f47a4935c09769b8df316e1b459c7b153ed26ac409d4bf2ce62a1635dba4eaf7ce77de5ce83100d6f3ce7aadffed7591fb7cee7ac10a0c081a2d3c613f1ad8

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        00cd4d888cba0a5d8c7902c61c92f4ab

        SHA1

        bb0d6c3d5af64e19a7f364ef67dc6d78ca4cdc6a

        SHA256

        74d8cb40f63bd74efa03a25fe1d1ea5d859e234213b7979f0b4db80fd4e664b0

        SHA512

        6911d14e41606e009de0ec1383a1b46bd580e0a8234a640dd0c21905f8116435fe7a07fe746b7b6a592be496cc83c2e4a193c155f664f7155985f2f5f636c4d1

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        d212e087686ba5284c910eb652e44379

        SHA1

        a984cca1a5c2e9e639043449a3efcec3760e57c9

        SHA256

        7264610138b8cdd7d1758dd9adfb68adbf85efe8c8674b4ead562f4f119b918f

        SHA512

        6a22a4f6987c89bbb47e44f8de976373d90ff838cc0d7b5b7b7f4db2eb26dd8333386d349bf97b9e61aaa420cdbf9863f599681e025f36bad262d3639ff29b71

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        d212e087686ba5284c910eb652e44379

        SHA1

        a984cca1a5c2e9e639043449a3efcec3760e57c9

        SHA256

        7264610138b8cdd7d1758dd9adfb68adbf85efe8c8674b4ead562f4f119b918f

        SHA512

        6a22a4f6987c89bbb47e44f8de976373d90ff838cc0d7b5b7b7f4db2eb26dd8333386d349bf97b9e61aaa420cdbf9863f599681e025f36bad262d3639ff29b71

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

        Filesize

        404B

        MD5

        d212e087686ba5284c910eb652e44379

        SHA1

        a984cca1a5c2e9e639043449a3efcec3760e57c9

        SHA256

        7264610138b8cdd7d1758dd9adfb68adbf85efe8c8674b4ead562f4f119b918f

        SHA512

        6a22a4f6987c89bbb47e44f8de976373d90ff838cc0d7b5b7b7f4db2eb26dd8333386d349bf97b9e61aaa420cdbf9863f599681e025f36bad262d3639ff29b71

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3A34145C-4228-11ED-AECB-C264E7FE3618}.dat

        Filesize

        5KB

        MD5

        f4a2fadee1c5ecc3726ff72c185e01e0

        SHA1

        f3729b7b458590dc57f1db27991cb84e9a80300d

        SHA256

        b5df13c9391428984ee7f152da0d34a3112d621699bdb8fcee7ef3bbb58a4f20

        SHA512

        89f2f76007e933ba772c89ef32432f02f2b600292af27f12ce0a37c6803bbe236297740598ae01a98aec544970e08fa8c6bd3c41010f74e2432b8a86be41127a

      • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3A38D981-4228-11ED-AECB-C264E7FE3618}.dat

        Filesize

        3KB

        MD5

        183ad15467594f27b5d349e382c48d8f

        SHA1

        a930fe566f91ae3b7469e91d9babe7e134031374

        SHA256

        5bb0e842aa74081eeea95eb2cd31f8a5d099f0cbff81be94a2b39b2768f7db2b

        SHA512

        64736b897cd9f449253fe4a22d6d0d1d7f1f752955fe3f2a3c48b7220cd9bbd08dd58e3b3bdf95f65da766cadf43bc637d6407e8a8b93d02f75ade88c885a63f

      • C:\Users\Admin\AppData\Local\Temp\06f5a82e39012ff2b5862fb7037df8178b734c462d74e036ed1beb3951ea780cmgr.exe

        Filesize

        119KB

        MD5

        9d5d609dc8e2554054733d19eed45c5c

        SHA1

        ce72453fca9f477940a9def32bd8463549c6e1e4

        SHA256

        7a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1

        SHA512

        012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b

      • C:\Users\Admin\AppData\Local\Temp\06f5a82e39012ff2b5862fb7037df8178b734c462d74e036ed1beb3951ea780cmgr.exe

        Filesize

        119KB

        MD5

        9d5d609dc8e2554054733d19eed45c5c

        SHA1

        ce72453fca9f477940a9def32bd8463549c6e1e4

        SHA256

        7a85b3db04beb0c4b6a8929fdf79726bcf1084efab0a9f04a8ebaa0a2bc9e0b1

        SHA512

        012cabde17ed1c1d1a48b5bc136591ff9c8e261e5da8bc7f67d0bd235a32150f63274362cdeef2376d2d5a38dfb0c9acc7cd3aa5244c1858b88b183f8cbe550b

      • memory/4820-153-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4820-154-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4820-155-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4820-162-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4820-161-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4820-145-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4820-159-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4820-160-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4856-150-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4856-144-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4856-143-0x0000000000400000-0x0000000000429000-memory.dmp

        Filesize

        164KB

      • memory/4856-139-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4856-138-0x0000000000400000-0x0000000000421000-memory.dmp

        Filesize

        132KB

      • memory/4960-156-0x0000000001000000-0x0000000001116000-memory.dmp

        Filesize

        1.1MB

      • memory/4960-132-0x0000000001000000-0x0000000001116000-memory.dmp

        Filesize

        1.1MB