e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da

Analysis

max time kernel
152s
max time network
92s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe
Size

1022KB
MD5

10dc5b3f67ea189863de2b1566dd9d83
SHA1

c2e82f21f35ff6a7b234e20bf5b5ffbd128cd30b
SHA256

e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da
SHA512

df9d9144404d5df5d70032b16bad6375d75e1d9d04b45e452a43080f5ee621ec463eed11dfc69a772171fc44e62e62a90d4d05690ee9913adeb5d428261236d4
SSDEEP

24576:eE7TlRvcQy0bWV0KdgaaUjYAlVW6eYX3zVTD3cJ:eATlKwb3KdgahjYAlVW6HhD3cJ

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe chrome.exe"	01CE60

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	01CE60

Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
1932	019D60.exe
1448	01CE60

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00090000000122dd-66.dat	upx
behavioral1/files/0x00090000000122dd-68.dat	upx
behavioral1/memory/1448-72-0x0000000000400000-0x00000000004B0000-memory.dmp	upx
behavioral1/files/0x00090000000122dd-73.dat	upx
behavioral1/memory/1448-81-0x0000000000400000-0x00000000004B0000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe
1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe
1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run	01CE60
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\chrome.exe"	01CE60

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	01CE60
File opened (read-only)	\??\m:	01CE60
File opened (read-only)	\??\f:	01CE60
File opened (read-only)	\??\h:	01CE60
File opened (read-only)	\??\k:	01CE60
File opened (read-only)	\??\t:	01CE60
File opened (read-only)	\??\w:	01CE60
File opened (read-only)	\??\x:	01CE60
File opened (read-only)	\??\e:	01CE60
File opened (read-only)	\??\g:	01CE60
File opened (read-only)	\??\l:	01CE60
File opened (read-only)	\??\n:	01CE60
File opened (read-only)	\??\o:	01CE60
File opened (read-only)	\??\q:	01CE60
File opened (read-only)	\??\s:	01CE60
File opened (read-only)	\??\u:	01CE60
File opened (read-only)	\??\v:	01CE60
File opened (read-only)	\??\y:	01CE60
File opened (read-only)	\??\z:	01CE60
File opened (read-only)	\??\a:	01CE60
File opened (read-only)	\??\b:	01CE60
File opened (read-only)	\??\j:	01CE60
File opened (read-only)	\??\p:	01CE60
File opened (read-only)	\??\r:	01CE60

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1448-81-0x0000000000400000-0x00000000004B0000-memory.dmp	autoit_exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\d:\autorun.inf	01CE60

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\chrome.exe	01CE60
File opened for modification	C:\Windows\SysWOW64\autorun.ini	01CE60
File created	C:\Windows\SysWOW64\chrome.exe	01CE60

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\chrome.exe	01CE60
File opened for modification	C:\Windows\chrome.exe	01CE60

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main	01CE60
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://h1.ripway.com/poojasharma/index.html"	01CE60
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://h1.ripway.com/poojasharma/index.html"	01CE60
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://h1.ripway.com/poojasharma/index.html"	01CE60
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	01CE60

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://h1.ripway.com/poojasharma/index.html"	01CE60
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://h1.ripway.com/poojasharma/index.html"	01CE60

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60
1448	01CE60

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1932	1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe	27
PID 1644 wrote to memory of 1932	1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe	27
PID 1644 wrote to memory of 1932	1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe	27
PID 1644 wrote to memory of 1932	1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe	27
PID 1644 wrote to memory of 1448	1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe	28
PID 1644 wrote to memory of 1448	1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe	28
PID 1644 wrote to memory of 1448	1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe	28
PID 1644 wrote to memory of 1448	1644	e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe	28
PID 1448 wrote to memory of 1748	1448	01CE60	29
PID 1448 wrote to memory of 1748	1448	01CE60	29
PID 1448 wrote to memory of 1748	1448	01CE60	29
PID 1448 wrote to memory of 1748	1448	01CE60	29
PID 1748 wrote to memory of 1068	1748	cmd.exe	31
PID 1748 wrote to memory of 1068	1748	cmd.exe	31
PID 1748 wrote to memory of 1068	1748	cmd.exe	31
PID 1748 wrote to memory of 1068	1748	cmd.exe	31
PID 1448 wrote to memory of 1692	1448	01CE60	32
PID 1448 wrote to memory of 1692	1448	01CE60	32
PID 1448 wrote to memory of 1692	1448	01CE60	32
PID 1448 wrote to memory of 1692	1448	01CE60	32
PID 1692 wrote to memory of 1048	1692	cmd.exe	34
PID 1692 wrote to memory of 1048	1692	cmd.exe	34
PID 1692 wrote to memory of 1048	1692	cmd.exe	34
PID 1692 wrote to memory of 1048	1692	cmd.exe	34
PID 1448 wrote to memory of 976	1448	01CE60	37
PID 1448 wrote to memory of 976	1448	01CE60	37
PID 1448 wrote to memory of 976	1448	01CE60	37
PID 1448 wrote to memory of 976	1448	01CE60	37
PID 976 wrote to memory of 1268	976	cmd.exe	39
PID 976 wrote to memory of 1268	976	cmd.exe	39
PID 976 wrote to memory of 1268	976	cmd.exe	39
PID 976 wrote to memory of 1268	976	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe
"C:\Users\Admin\AppData\Local\Temp\e3e7fb24bde111a5d15aa0afa089011e75873a2be33cd57353368a43925214da.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Roaming\00CD98\019D60.exe
  "C:\Users\Admin\AppData\Roaming\00CD98\019D60.exe" -launcher
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Users\Admin\AppData\Local\Temp\01CE60
  "C:\Users\Admin\AppData\Local\Temp\01CE60"
  2⤵
  - Modifies WinLogon for persistence
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT /delete /yes
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Windows\SysWOW64\at.exe
      AT /delete /yes
      4⤵
      PID:1068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\chrome.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\at.exe
      AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\chrome.exe
      4⤵
      PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\SysWOW64\cacls.exe
      cacls "C:\system volume information" /e /g "Admin":f
      4⤵
      PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\01CE60

Filesize
664KB

MD5
394c51f7d8dd30a6b0fb6c7e712d0f5e

SHA1
6ff3bc4961f2c5b74476a7c46e39ec0447eabb19

SHA256
d98e4890a6fb9b1df7afdc41e4d77b5d6c2a9016f87eb33b32d8721304c8df1c

SHA512
fcdca5bb9560f68ca21c55f0a8e329b76a0c8677293034d02267c83fd897eb823bac9776eb345e532be501abeba073436be5ecf47555fadff37bd9384ebc4019

Download Submit
C:\Users\Admin\AppData\Local\Temp\01CE60

Filesize
664KB

MD5
394c51f7d8dd30a6b0fb6c7e712d0f5e

SHA1
6ff3bc4961f2c5b74476a7c46e39ec0447eabb19

SHA256
d98e4890a6fb9b1df7afdc41e4d77b5d6c2a9016f87eb33b32d8721304c8df1c

SHA512
fcdca5bb9560f68ca21c55f0a8e329b76a0c8677293034d02267c83fd897eb823bac9776eb345e532be501abeba073436be5ecf47555fadff37bd9384ebc4019

Download Submit
C:\Users\Admin\AppData\Roaming\00CD98\019D60.exe

Filesize
401KB

MD5
8dafa329c8bb22ffbccdc0540fa38275

SHA1
6e319c82e6dec2511bc22cee091f6650683535e2

SHA256
5cdd13aa5fd23228cfb4ffdb1c61baa53fb248db99a97b465b6efe1e2c7c189e

SHA512
753db854fe728a21635586e40619d69ea3b1c5b39bddd0231e3cbf31d8326756cf478600398510dc5504b0c8266516e1e5e97030d85e958ce5cfd0adc47e98e3

Download Submit
C:\Users\Admin\AppData\Roaming\00CD98\019D60.exe

Filesize
401KB

MD5
8dafa329c8bb22ffbccdc0540fa38275

SHA1
6e319c82e6dec2511bc22cee091f6650683535e2

SHA256
5cdd13aa5fd23228cfb4ffdb1c61baa53fb248db99a97b465b6efe1e2c7c189e

SHA512
753db854fe728a21635586e40619d69ea3b1c5b39bddd0231e3cbf31d8326756cf478600398510dc5504b0c8266516e1e5e97030d85e958ce5cfd0adc47e98e3

Download Submit
\Users\Admin\AppData\Local\Temp\01CE60

Filesize
664KB

MD5
394c51f7d8dd30a6b0fb6c7e712d0f5e

SHA1
6ff3bc4961f2c5b74476a7c46e39ec0447eabb19

SHA256
d98e4890a6fb9b1df7afdc41e4d77b5d6c2a9016f87eb33b32d8721304c8df1c

SHA512
fcdca5bb9560f68ca21c55f0a8e329b76a0c8677293034d02267c83fd897eb823bac9776eb345e532be501abeba073436be5ecf47555fadff37bd9384ebc4019

Download Submit
\Users\Admin\AppData\Roaming\00CD98\019D60.exe

Filesize
401KB

MD5
8dafa329c8bb22ffbccdc0540fa38275

SHA1
6e319c82e6dec2511bc22cee091f6650683535e2

SHA256
5cdd13aa5fd23228cfb4ffdb1c61baa53fb248db99a97b465b6efe1e2c7c189e

SHA512
753db854fe728a21635586e40619d69ea3b1c5b39bddd0231e3cbf31d8326756cf478600398510dc5504b0c8266516e1e5e97030d85e958ce5cfd0adc47e98e3

Download Submit
\Users\Admin\AppData\Roaming\00CD98\019D60.exe

Filesize
401KB

MD5
8dafa329c8bb22ffbccdc0540fa38275

SHA1
6e319c82e6dec2511bc22cee091f6650683535e2

SHA256
5cdd13aa5fd23228cfb4ffdb1c61baa53fb248db99a97b465b6efe1e2c7c189e

SHA512
753db854fe728a21635586e40619d69ea3b1c5b39bddd0231e3cbf31d8326756cf478600398510dc5504b0c8266516e1e5e97030d85e958ce5cfd0adc47e98e3

Download Submit
memory/976-82-0x0000000000000000-mapping.dmp

Download
memory/1048-78-0x0000000000000000-mapping.dmp

Download
memory/1068-75-0x0000000000000000-mapping.dmp

Download
memory/1268-83-0x0000000000000000-mapping.dmp

Download
memory/1448-72-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1448-81-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1448-67-0x0000000000000000-mapping.dmp

Download
memory/1644-71-0x0000000004AA0000-0x0000000004B50000-memory.dmp

Filesize
704KB

Download
memory/1644-56-0x00000000002D0000-0x00000000002F7000-memory.dmp

Filesize
156KB

Download
memory/1644-57-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1644-54-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1644-55-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1644-84-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1644-59-0x0000000002190000-0x00000000021A0000-memory.dmp

Filesize
64KB

Download
memory/1644-70-0x00000000048F0000-0x000000000495B000-memory.dmp

Filesize
428KB

Download
memory/1644-80-0x0000000004AA0000-0x0000000004B50000-memory.dmp

Filesize
704KB

Download
memory/1692-77-0x0000000000000000-mapping.dmp

Download
memory/1748-74-0x0000000000000000-mapping.dmp

Download
memory/1932-64-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1932-65-0x00000000003B0000-0x00000000003D7000-memory.dmp

Filesize
156KB

Download
memory/1932-61-0x0000000000000000-mapping.dmp

Download