Analysis
-
max time kernel
128s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 14:40
Static task
static1
Behavioral task
behavioral1
Sample
c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe
-
Size
14KB
-
MD5
14a62a10a2eae315538aca25464604f0
-
SHA1
ff8954b1b6a6cf8f74ef71625054d0193bd7a99e
-
SHA256
c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3
-
SHA512
3ab4245b9c7b9f6e5d0f693ed443cbe9246ae3e223db0ee602001b92238e18dddc4783388f70174ebdff7fddd85c1c13dfa4e882039deec2643f39034cc61756
-
SSDEEP
384:hYkmLYKAsJ/bLr4VmGlxlTHHglbAcRGPA7y6E:sYc/bv4xlxlTngmkGPAu9
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d02cb571ceddd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000001d33a084d30591658df2093946e3390f0de2643796d93ed6a76a24cfd68de712000000000e80000000020000200000007e16820fb349f8b34b34a70bf5e581aa91336b6afb55cb8154a2b9f71af2c04c900000006eb0127b00902319b9d1150c55a128c9ee90ca08301dabb952c1e157437fd29171b21e4cdeae31d15887b8dcbb5a7f2f6604b3ec832eec11150a915935b6e7c60eee326cf9fe44674158631333eabffc6b6841e3ec11820d42a09690b9b7c63da242f4bfddeb2fde6c549ef02aa9f17e4e82dcde94e5aab154ac72e4588256b6af8f2e00adf1e8899ac086c5582ad8b140000000c69ae19fbb38ec3f957331c63b88e162832d31d3a961b4107837747e87c1bc108e42e820ad3cb971a34505e7a854379dd1af6c49b587ba51bd226bb3af9201b9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96DFB341-49C1-11ED-9AAE-C6457FCBF3CF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372298121" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000d008c68922ca829f6342d6f3f50602ae55928d65d010629bfabfa3b6548a610d000000000e800000000200002000000045d78eefbbdfbabc1986cf22699fceb75ca3863d69572c371f61c39eb1a1a9e320000000b7d2aaf880369b983a5ac23a5cce0040c5c26899bbd1f9ee49030a578103b93c40000000350abed929ff327458b64f58e63f72777761f788c62814e4f77a932590457c31f157911860d38f164e364f057131aa5aaa545405876cd3f80eeb8c4ea0f4f4c8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1356 c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe 1356 c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 948 iexplore.exe 948 iexplore.exe 1416 IEXPLORE.EXE 1416 IEXPLORE.EXE 1416 IEXPLORE.EXE 1416 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1356 wrote to memory of 948 1356 c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe 28 PID 1356 wrote to memory of 948 1356 c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe 28 PID 1356 wrote to memory of 948 1356 c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe 28 PID 1356 wrote to memory of 948 1356 c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe 28 PID 948 wrote to memory of 1416 948 iexplore.exe 30 PID 948 wrote to memory of 1416 948 iexplore.exe 30 PID 948 wrote to memory of 1416 948 iexplore.exe 30 PID 948 wrote to memory of 1416 948 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe"C:\Users\Admin\AppData\Local\Temp\c6e69a0a119f22c1a9dd7ecdf5f2885a921cc6c379fb6260b391869f66eea7f3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://a.doginhispen.com/153/in/htmlg857833877.html?cid=51455171&aid=10383&time=857833877&fw=64&v=153&m=02⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:948 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1416
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD507446357804a2f5a0565f5ef2ea57f77
SHA1f6cec3ab387fba71d7beb0ac3aaa2bc647da0920
SHA256f4b3320193c14a1e6d8ee65336934d6c5913c302449afb4a74c253a296a31f2c
SHA512ab76c3b195d937ffb1b2157743f4fcb354e9706a97d90c25154c18c755750f53fe5cc4fcdd25c3df5173348e61bf55c01fd7262830f28272bec52ab61efe86a7