96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf

Analysis

max time kernel
127s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe
Size

388KB
MD5

8b67b642bc9c46f1d5741828fdf9c259
SHA1

2828e4665be46f15a9227e73bafab21d87c66659
SHA256

96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf
SHA512

2893be57b895cd2f4bc4784ee1bab11ca12edf2ee2954bf03466c7e0e51c2646c2e963f9e6a39f33bb1de1c003a6e6017740daf5554145164157630f98a7e4a1
SSDEEP

12288:BqYXje0DF9k64/QSywqP0T8oIN1AHDFhY25fC2WF9sZ204:BqYDF9k64/Q9j28okAHDHY25fC2WF9s

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
616	StikyNote.exe

Loads dropped DLL 1 IoCs

pid	Process
1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\RESTART_STICKY_NOTESS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\StikyNote.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 616 set thread context of 820	616	StikyNote.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29DFE781-4F5A-11ED-9166-DA7E66F9F45D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372913400"	iexplore.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1304	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe
616	StikyNote.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
820	iexplore.exe
820	iexplore.exe
740	IEXPLORE.EXE
740	IEXPLORE.EXE
740	IEXPLORE.EXE
740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 1988	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	28
PID 1680 wrote to memory of 888	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	29
PID 1680 wrote to memory of 888	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	29
PID 1680 wrote to memory of 888	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	29
PID 1680 wrote to memory of 888	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	29
PID 1680 wrote to memory of 616	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	31
PID 1680 wrote to memory of 616	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	31
PID 1680 wrote to memory of 616	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	31
PID 1680 wrote to memory of 616	1680	96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe	31
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 616 wrote to memory of 820	616	StikyNote.exe	32
PID 820 wrote to memory of 740	820	iexplore.exe	34
PID 820 wrote to memory of 740	820	iexplore.exe	34
PID 820 wrote to memory of 740	820	iexplore.exe	34
PID 820 wrote to memory of 740	820	iexplore.exe	34
PID 1988 wrote to memory of 772	1988	rundll32.exe	35
PID 1988 wrote to memory of 772	1988	rundll32.exe	35
PID 1988 wrote to memory of 772	1988	rundll32.exe	35
PID 1988 wrote to memory of 772	1988	rundll32.exe	35
PID 772 wrote to memory of 1304	772	cmd.exe	37
PID 772 wrote to memory of 1304	772	cmd.exe	37
PID 772 wrote to memory of 1304	772	cmd.exe	37
PID 772 wrote to memory of 1304	772	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe
"C:\Users\Admin\AppData\Local\Temp\96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\StikyNote.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v RESTART_STICKY_NOTESS /f /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\StikyNote.exe"
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c copy "C:\Users\Admin\AppData\Local\Temp\96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf.exe" "C:\Users\Admin\AppData\Local\Temp\StikyNote.exe"
  2⤵
  PID:888
- C:\Users\Admin\AppData\Local\Temp\StikyNote.exe
  "C:\Users\Admin\AppData\Local\Temp\StikyNote.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:820 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\StikyNote.exe

Filesize
388KB

MD5
e4c82048fd33dee4f54422864ba0f445

SHA1
28c92f61bcbe8eade92d0a901fa78d61af06618c

SHA256
bff7706a36637cb446c709583c8d808b5454beabfe492f18d5c830ccb81cd9c3

SHA512
25929270b2d03216650dbe458d0b1815b564529e1c441baa3ac788d44372e856818932103b9c0fd4f5a95209a76a1568685b7df67ea5e5a6786ba6243f71cdec

Download Submit
C:\Users\Admin\AppData\Local\Temp\StikyNote.exe

Filesize
388KB

MD5
8b67b642bc9c46f1d5741828fdf9c259

SHA1
2828e4665be46f15a9227e73bafab21d87c66659

SHA256
96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf

SHA512
2893be57b895cd2f4bc4784ee1bab11ca12edf2ee2954bf03466c7e0e51c2646c2e963f9e6a39f33bb1de1c003a6e6017740daf5554145164157630f98a7e4a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\StikyNote.exe

Filesize
388KB

MD5
8b67b642bc9c46f1d5741828fdf9c259

SHA1
2828e4665be46f15a9227e73bafab21d87c66659

SHA256
96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf

SHA512
2893be57b895cd2f4bc4784ee1bab11ca12edf2ee2954bf03466c7e0e51c2646c2e963f9e6a39f33bb1de1c003a6e6017740daf5554145164157630f98a7e4a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TAKNV9N8.txt

Filesize
603B

MD5
053b3720486f5c858149f5cc73ff985c

SHA1
5d8df01578cedc99c235b5daa135889e9d197714

SHA256
dae3ffcf46e3fefa00c445703cde1b02f784191bacbdd230ae6bf2c556a4cbb8

SHA512
0b21e30e5c2987eb0b18a325d0920ac5d3a8db436d4a42c40105824aafb71eeb803057ccc50ed1e5f2bb3e8b9f8c0b24bc1465f4b813dd5cfe188e1684e7467e

Download Submit
\Users\Admin\AppData\Local\Temp\StikyNote.exe

Filesize
388KB

MD5
8b67b642bc9c46f1d5741828fdf9c259

SHA1
2828e4665be46f15a9227e73bafab21d87c66659

SHA256
96f2d2e7910bed7ee0ecc3a1e0a531a2231a935b12c9731e69d4514398f0a4cf

SHA512
2893be57b895cd2f4bc4784ee1bab11ca12edf2ee2954bf03466c7e0e51c2646c2e963f9e6a39f33bb1de1c003a6e6017740daf5554145164157630f98a7e4a1

Download Submit
memory/616-69-0x00000000764A0000-0x00000000765B0000-memory.dmp

Filesize
1.1MB

Download
memory/1680-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1988-67-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/1988-57-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download
memory/1988-55-0x00000000000D0000-0x00000000000D3000-memory.dmp

Filesize
12KB

Download