Analysis
-
max time kernel
191s -
max time network
90s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 10:50
Behavioral task
behavioral1
Sample
8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe
-
Size
384KB
-
MD5
960b864dcd781ac0fef287e49c35d7c0
-
SHA1
5e070164ee030cb4539664bc10eefc97b78a08b8
-
SHA256
8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78
-
SHA512
29c8118c853a64ff7c95c96ef55e46598209a81ce94422c7ad139b77fbd1053c7c3e78cb2e93d4b273600565f957d1332eae3f5f8bbb5eb9aa8988fc417e6710
-
SSDEEP
6144:fYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UO85aXO:fSNC80I+cR3R03VseuO85aXO
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe gphone.exe" 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral1/memory/1676-54-0x0000000000400000-0x00000000004C4000-memory.dmp upx behavioral1/memory/1676-62-0x0000000000400000-0x00000000004C4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\gphone.exe" 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\r: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\e: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\f: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\l: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\q: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\t: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\v: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\x: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\h: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\k: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\i: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\j: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\n: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\p: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\s: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\w: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\a: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\b: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\y: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\z: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\u: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\m: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened (read-only) \??\o: 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1676-62-0x0000000000400000-0x00000000004C4000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\gphone.exe 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened for modification C:\Windows\SysWOW64\gphone.exe 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened for modification C:\Windows\SysWOW64\autorun.ini 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\gphone.exe 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe File opened for modification C:\Windows\gphone.exe 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://rnd009.googlepages.com/google.html" 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://rnd009.googlepages.com/google.html" 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://rnd009.googlepages.com/google.html" 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://rnd009.googlepages.com/google.html" 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://rnd009.googlepages.com/google.html" 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1516 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 27 PID 1676 wrote to memory of 1516 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 27 PID 1676 wrote to memory of 1516 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 27 PID 1676 wrote to memory of 1516 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 27 PID 1516 wrote to memory of 1348 1516 cmd.exe 29 PID 1516 wrote to memory of 1348 1516 cmd.exe 29 PID 1516 wrote to memory of 1348 1516 cmd.exe 29 PID 1516 wrote to memory of 1348 1516 cmd.exe 29 PID 1676 wrote to memory of 944 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 30 PID 1676 wrote to memory of 944 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 30 PID 1676 wrote to memory of 944 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 30 PID 1676 wrote to memory of 944 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 30 PID 944 wrote to memory of 1900 944 cmd.exe 32 PID 944 wrote to memory of 1900 944 cmd.exe 32 PID 944 wrote to memory of 1900 944 cmd.exe 32 PID 944 wrote to memory of 1900 944 cmd.exe 32 PID 1676 wrote to memory of 1620 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 35 PID 1676 wrote to memory of 1620 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 35 PID 1676 wrote to memory of 1620 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 35 PID 1676 wrote to memory of 1620 1676 8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe 35 PID 1620 wrote to memory of 1240 1620 cmd.exe 37 PID 1620 wrote to memory of 1240 1620 cmd.exe 37 PID 1620 wrote to memory of 1240 1620 cmd.exe 37 PID 1620 wrote to memory of 1240 1620 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe"C:\Users\Admin\AppData\Local\Temp\8203803de8a705ab5cc0687d8420382b62cc5f5dbf44c8e116cea7810a111f78.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:1348
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe2⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe3⤵PID:1900
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:1240
-
-