Analysis

  • max time kernel
    100s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    20-10-2022 06:43

General

  • Target

    4ed281c1a1ea5ffc5f4710a871b3174d9fa562b05fac6e7f327efd278c044c94.exe

  • Size

    581KB

  • MD5

    5be7341ff2b3e50ef1f22128dd6f53c7

  • SHA1

    49be21605a09950d1290dc62a0fcf47e064e9d53

  • SHA256

    4ed281c1a1ea5ffc5f4710a871b3174d9fa562b05fac6e7f327efd278c044c94

  • SHA512

    6960bb3306a22c8c31eb4e8ab72a31c6328888798d9405cc267d54d48c4da4c8cbfddeae415228242bf797829e082c3ce857074a4c3e9cc0cc3a65a93dedc805

  • SSDEEP

    12288:uoMDtCi7NFlZnNqZ9xGrLpZ0ZHEqtgb0UO:ufplNFgxG5eZngb0F

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 7 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ed281c1a1ea5ffc5f4710a871b3174d9fa562b05fac6e7f327efd278c044c94.exe
    "C:\Users\Admin\AppData\Local\Temp\4ed281c1a1ea5ffc5f4710a871b3174d9fa562b05fac6e7f327efd278c044c94.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
      C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.97199.com/install2/?sl3
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1036
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1036 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:572
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\nbfile0.exe
        3⤵
          PID:632
      • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe
        C:\Users\Admin\AppData\Local\Temp\nbfile1.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1256
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"
          3⤵
            PID:772
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\1.vbs"
            3⤵
              PID:640

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nbfile0.exe

          Filesize

          467KB

          MD5

          74869a0346ab36bbba85022612505121

          SHA1

          2cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a

          SHA256

          6de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a

          SHA512

          723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5

        • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • C:\Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\SU8I7CN5.txt

          Filesize

          608B

          MD5

          851e674c6e6b171a8bef974d2f19e3f4

          SHA1

          5f5cc36f85af912ba2fd30dca91aba25c9bc7c71

          SHA256

          b0a5d8e25030b682567f22fb33787b28512ee3a3662f5ff793cb4f36f69c7964

          SHA512

          20af409b69b793ee5e549b680e653991c8ddb7d7284f2870c1f4edb40aca2a9b9780f91f799bd76ecdbb98bfed37b55a6ef7b87a0ce78ac35112f15a03e0aaf5

        • C:\newsetup.vbs

          Filesize

          651B

          MD5

          4736e7158c27f244482f5a614b9dbdae

          SHA1

          d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9

          SHA256

          b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc

          SHA512

          cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824

        • \Users\Admin\AppData\Local\Temp\nbfile0.exe

          Filesize

          467KB

          MD5

          74869a0346ab36bbba85022612505121

          SHA1

          2cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a

          SHA256

          6de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a

          SHA512

          723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5

        • \Users\Admin\AppData\Local\Temp\nbfile0.exe

          Filesize

          467KB

          MD5

          74869a0346ab36bbba85022612505121

          SHA1

          2cd02f46f2f9f46eaf15fce40a3bf4781f80cf8a

          SHA256

          6de866b5c8abb1db9b2be231b365c1aa029118fbc58823f443f00e3a33dff18a

          SHA512

          723812083113cff82aa5e2243759c572518865e351cc81b7c2b85a05557862dbbd7a98b964ff6f3aa3802bb5d4dab01a14147211495fc5803d9ddb7b715f4de5

        • \Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • \Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • \Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • \Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • \Users\Admin\AppData\Local\Temp\nbfile1.exe

          Filesize

          52KB

          MD5

          c4ddf11ebdbf9d8397d710d2cb4e2fab

          SHA1

          8008c97e7d6ff92deb3e1755a614f4afedca92b9

          SHA256

          67a632049e45c25de35b533659624ca24f8e70447abca015bf5776ce6cb3ded6

          SHA512

          3c9be7b92208e8c0f57ab8048108714e06b2aa896a479f61637a93a9eacb4818fcb25ce3d4e1a24086558daeae65d4b482b2c1cfba3df202c396e2bc218362e9

        • memory/632-63-0x0000000000000000-mapping.dmp

        • memory/640-76-0x0000000000000000-mapping.dmp

        • memory/772-74-0x0000000000000000-mapping.dmp

        • memory/1204-61-0x0000000001CE0000-0x0000000001D6A000-memory.dmp

          Filesize

          552KB

        • memory/1204-60-0x0000000001CE0000-0x0000000001D6A000-memory.dmp

          Filesize

          552KB

        • memory/1256-69-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

          Filesize

          8KB

        • memory/1256-67-0x0000000000000000-mapping.dmp

        • memory/1344-64-0x0000000000400000-0x000000000048A000-memory.dmp

          Filesize

          552KB

        • memory/1344-62-0x0000000000400000-0x000000000048A000-memory.dmp

          Filesize

          552KB

        • memory/1344-56-0x0000000000000000-mapping.dmp