140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f

Analysis

max time kernel
144s
max time network
160s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
Size

200KB
MD5

4d3cd27b04757cbee353f2d695aaadd6
SHA1

a60669e7cf30bd313af33f2c835851d37f5ba43d
SHA256

140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f
SHA512

52744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d
SSDEEP

3072:DyzGoDoxz/ch6pSPKAtArmLuAl5aFmCUlK3eDjyF/kPbV1P1oX1l:DySGwz0TBtArmlFhKuDOFcjCl

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2008	¯«²§±©¾¦¾.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe

Loads dropped DLL 2 IoCs

pid	Process
576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373023246"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000c5e5563057a80859a4d2588d03df9e6b764e12874956129970e523280bee39f3000000000e8000000002000020000000b6369c273315be34e38a32dfb87ffc2bf9ea318539edcdf8370c3f5c9693cee990000000d749d1883e58731bf968d22cca00ce2cb073c6daa3431845cd32a862d6ccb52f9bc9b8fd04e86a136f6312e1ee6c2e7a155e14ee589544462f796e1be9d9534be902eb17c93e101b9f166c0c5ae57bb2845a9adbdf51802f304f37fb3747f8b0a82427eac1b22fdb7fe8754a3eb26ff50616bf6f92860be5a60700f9614758465e63348d04dccb47177feb4604e2623a40000000f7473e3ea51ad1f611b6bc1f2f759b355688b65831510158dd55667d0a38afc86d6b22f680b5c030ef881732cfc76734def272842d205572bb19241415e322ad	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409dced366e4d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E96A2340-5059-11ED-977F-FAF5FAF3A79A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000c8c3772a370cc51dc2c28ae9ff027cadb10151ebffdf5d71edc3c85c28b5f28e000000000e8000000002000020000000f4f64df78a5eed385ab8b17943689da356d0fb9c6110d695c6219baa759398af20000000c06e4063c8059ed1d00d4d589b689128d801de7deff1563d4c4e5e29a0e029f84000000021a4f61c14b22bd655097918060d99fb08a57344036c1248da6d3d3990cdc77dd00704adadc85ca3b5370feb6181081eba8ec415f4c1b5696cc3c3f1875e3464	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2028	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
2008	¯«²§±©¾¦¾.exe
2028	iexplore.exe
2028	iexplore.exe
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE
1468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2028	576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe	26
PID 576 wrote to memory of 2028	576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe	26
PID 576 wrote to memory of 2028	576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe	26
PID 576 wrote to memory of 2028	576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe	26
PID 576 wrote to memory of 2008	576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe	27
PID 576 wrote to memory of 2008	576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe	27
PID 576 wrote to memory of 2008	576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe	27
PID 576 wrote to memory of 2008	576	140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe	27
PID 2028 wrote to memory of 1468	2028	iexplore.exe	29
PID 2028 wrote to memory of 1468	2028	iexplore.exe	29
PID 2028 wrote to memory of 1468	2028	iexplore.exe	29
PID 2028 wrote to memory of 1468	2028	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe
"C:\Users\Admin\AppData\Local\Temp\140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:576
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://goo.gl/5UGSXR
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1468
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
d15aaa7c9be910a9898260767e2490e1

SHA1
2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

SHA256
f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

SHA512
7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
069d8d30a5d6cab9dee2f9dbb45bd334

SHA1
f3f318e636c030ad4e2f8d12b2a61345d1191da2

SHA256
90079043ffa0782e1ee9acb1cae90d1f2c8c7300c9a02aff301900b58bffafbb

SHA512
6839231f6fb47b8de8ae7d3dc9878787c14fb8c595e2cafb00a716c0dc973960669d06a3f315f534e5fd1d94e49a5aa4d50859d42b453e7145666f4c77896603

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4EJVTURD.txt

Filesize
606B

MD5
4f65e3f108526e7bf96eed7c2a76f777

SHA1
8ad6aabb74abdc3deddd79684586ee9ae22056d2

SHA256
7e2c3cdc7dfb9569615e13828492e8b8b367e93e8bbc38de54d132c384f0e5d7

SHA512
b5608f6c653c69351707c4b084eca2447f9f3ee89dd8bf640b61ad17ea7d8f00c2c2d80c9f4e48d70a360ad3f1fe81685ee2d83ac3c4f4163afa45fb4966934f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe

Filesize
200KB

MD5
4d3cd27b04757cbee353f2d695aaadd6

SHA1
a60669e7cf30bd313af33f2c835851d37f5ba43d

SHA256
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f

SHA512
52744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe

Filesize
200KB

MD5
4d3cd27b04757cbee353f2d695aaadd6

SHA1
a60669e7cf30bd313af33f2c835851d37f5ba43d

SHA256
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f

SHA512
52744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\¯«²§±©¾¦¾.exe

Filesize
200KB

MD5
4d3cd27b04757cbee353f2d695aaadd6

SHA1
a60669e7cf30bd313af33f2c835851d37f5ba43d

SHA256
140c5c5f5c18de9627b0c5de6773be896375979c14d8eeb5f214d7cd7c46905f

SHA512
52744da35e6e6cc42a85fb80bd21b6601ab63bebcea322f6a9132f29a74b194f2f73448ff2abf15c67d180cc093d12f707f77e953aed7f5d357189cc5fe9c16d

Download Submit
memory/576-56-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download