Analysis
-
max time kernel
143s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-10-2022 18:40
Static task
static1
Behavioral task
behavioral1
Sample
1.eml
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
1.eml
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
email-plain-1.txt
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
email-plain-1.txt
Resource
win10v2004-20220901-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
xn27aqd2j7h2zeej8otsy9.html
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
xn27aqd2j7h2zeej8otsy9.html
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
1.eml
-
Size
12KB
-
MD5
729bdebd96d2b6915eb8a5dc0d8e0504
-
SHA1
3d02af96da5e2e7d7a1f5d086b2085f0e9363a2d
-
SHA256
6f6422ab048a17d5d65c369a72b5de0838c5f8eec9564aff68ae1963ac219b50
-
SHA512
eda319162b12d3fd7ad058b763299d3e201ddf31a0b613da56116e412061db0b792bf7041c70443373c234e4ed02c50b3ca0ec330d71a5f6c7035272275212b7
-
SSDEEP
384:3prgcEikNTK7aH6OUdp3WwXJXALleUD1ctr:UiaxH6OUddWISeUCl
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988538" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3971255276" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988538" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90aa88edfad8d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c37cedfad8d801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000001c4b00e09524b641168f3c00b206f5497a89730615eca318fd114c25f87d56da000000000e800000000200002000000049e57c4ddd1b26cb32c25cf579fa49d4f7acf433a7a65201f2391ca6d44bca1b200000005541fe47f195693a0fe88ae0fb87c6a1aec50421dd6bbc503d44a6431af202c440000000905caf7770b2726246dac717adc7275233406951bc3eb9e275904a7387028069799ce32ed72c60d4006d6425de007b9bd7c2b6d31827f4c41cc27d7a72dd9fe6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371767466" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b14216000000000200000000001066000000010000200000007a36a57b38533026cc40c1ab2cfc34388239c1266ce40afd327af86220e8869e000000000e8000000002000020000000c570dc169bc6f0b9c69eddaa4cf4b2a4b51d6a18e35389c8972320b47120f4742000000086a655cfb5892c9c798cae8f27dbf6fa713803ecf1eb33d6a4b31f6400f4ce8d400000009849d3dcebfcfb2c0695d8bc30febcfdbd8ff1264c59ab31deb812fa794598edaa4e7925583b20c1294fb41b920248c789830d8073c8ad84fa7b7b44249efc38 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3971255276" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3979535102" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{180F333E-44EE-11ED-B696-72E07057041D} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988538" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\1.eml:OECustomProperty cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3908 OpenWith.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 iexplore.exe -
Suspicious use of SetWindowsHookEx 23 IoCs
pid Process 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 3908 OpenWith.exe 2096 iexplore.exe 2096 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3908 wrote to memory of 2096 3908 OpenWith.exe 90 PID 3908 wrote to memory of 2096 3908 OpenWith.exe 90 PID 2096 wrote to memory of 2736 2096 iexplore.exe 92 PID 2096 wrote to memory of 2736 2096 iexplore.exe 92 PID 2096 wrote to memory of 2736 2096 iexplore.exe 92
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\1.eml1⤵
- Modifies registry class
- NTFS ADS
PID:1936
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1.eml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD581c96dfdc78955baf5c089e53bc0c46a
SHA1f648c51cd0d2d784d0e8d73c30d6474487162127
SHA256397b12f65672c174b45d98e34e35a655b2ad506e7e180c7714abfac8acb30549
SHA5121991d628ef5e1a0a457cea5ef46a29043ed08ae60727d340fe1a6a759bd09693a3b48b78c9c396afd336b2f7b115ee93c5f0dd1dfabcadb111d2928781e6c51d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD55cd09087a164c72a51c8f77c98536280
SHA102b68867207fbddc036b45df0bb2542b7267ca0a
SHA256dd308caa2e64fd4996755ff2cafe0861a2ae566d4af24da8cc46c4a6b70b3698
SHA512f3fc27222e1483874ff175c9f72d27eceb71ce558e9f9077dedfd61929fe51b7e104dc7997c4c913dff185b22b82b5d634930c0d7df5f76f6778a5a46c5d4a3f
-
Filesize
12KB
MD5729bdebd96d2b6915eb8a5dc0d8e0504
SHA13d02af96da5e2e7d7a1f5d086b2085f0e9363a2d
SHA2566f6422ab048a17d5d65c369a72b5de0838c5f8eec9564aff68ae1963ac219b50
SHA512eda319162b12d3fd7ad058b763299d3e201ddf31a0b613da56116e412061db0b792bf7041c70443373c234e4ed02c50b3ca0ec330d71a5f6c7035272275212b7