Analysis
-
max time kernel
142s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2022, 02:23
Behavioral task
behavioral1
Sample
6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe
-
Size
541KB
-
MD5
2e16b595c485a97b2532b1c48417f367
-
SHA1
090fddd8b2915936c934a9fd2407feac78d2962a
-
SHA256
6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554
-
SHA512
933356cd137bc4345eac1af4251affb823468ff3f2fdb250d7ce25170092af5ec44ab244cd19e4f94b5c11405bedb9c119d4237a6707cd9e090daa1820a05a34
-
SSDEEP
12288:EDaq927uCSbyjNfh4NC/E5l2F+7p64ozoCeaUUo2VWh:EDz2yyjT4N+R+7IjeaUUo28h
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1188-132-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/memory/1188-142-0x0000000000400000-0x00000000004E7000-memory.dmp upx behavioral2/files/0x000400000001da55-145.dat upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\TaoBao\ÌÔ±¦.ico 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe File created C:\Program Files (x86)\Common Files\TaoBao\СÓÎÏ·.ico 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\RtkSYUdp.exe 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\internet explorer\version Vector 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe -
Modifies registry class 46 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\ShellFolder\Attributes = "0" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\PersistentHandler\ = "{5e941d80-bf96-11cd-b579-08002b30bfeb}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214F9-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214F9-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellNew regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\Open\Command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{00021500-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{FBF23B80-E3F0-101B-8488-00AA003E56F8}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ = "lnkfile" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214F9-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellNew\Command = "rundll32.exe appwiz.cpl,NewLinkHere %1" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\ShellFolder\ regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ = "InternetShortcut" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214EE-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{000214EE-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\LocalizedString = "@shdoclc.dll,-880" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\Open\ = "´ò¿ªÖ÷Ò³(&H)" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ÊôÐÔ\Command regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214EE-0000-0000-C000-000000000046} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{CABB0DA0-DA57-11CF-9974-0020AFD79762}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\DefaultIcon regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\DefaultIcon\ = "shdoclc.dll,-190" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ÊôÐÔ regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ÊôÐÔ\ = "ÊôÐÔ(&R)" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\ÊôÐÔ\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\PersistentHandler regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214F9-0000-0000-C000-000000000046} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{FBF23B80-E3F0-101B-8488-00AA003E56F8} regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\Open regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\ShellFolder regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ur1\ShellEx\{000214EE-0000-0000-C000-000000000046}\ = "{FBF23B40-E3F0-101B-8488-00AA003E56F8}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{00021500-0000-0000-C000-000000000046} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.1nk\ShellEx\{00021500-0000-0000-C000-000000000046}\ = "{00021401-0000-0000-C000-000000000046}" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86} regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\InfoTip = "@shdoclc.dll,-881" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27AEF9E8-663F-0757-829C-A93675896E86}\Shell\Open\Command\ = "IEXPLORE.EXE %w%w%w.93%119%15.%c%o%m" regedit.exe -
Runs regedit.exe 3 IoCs
pid Process 4936 regedit.exe 4904 regedit.exe 4872 regedit.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1188 wrote to memory of 4872 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 82 PID 1188 wrote to memory of 4872 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 82 PID 1188 wrote to memory of 4872 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 82 PID 1188 wrote to memory of 4936 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 83 PID 1188 wrote to memory of 4936 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 83 PID 1188 wrote to memory of 4936 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 83 PID 1188 wrote to memory of 4884 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 84 PID 1188 wrote to memory of 4884 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 84 PID 1188 wrote to memory of 4884 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 84 PID 1188 wrote to memory of 4904 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 86 PID 1188 wrote to memory of 4904 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 86 PID 1188 wrote to memory of 4904 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 86 PID 1188 wrote to memory of 2156 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 89 PID 1188 wrote to memory of 2156 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 89 PID 1188 wrote to memory of 2156 1188 6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe 89 PID 2156 wrote to memory of 1808 2156 cmd.exe 91 PID 2156 wrote to memory of 1808 2156 cmd.exe 91 PID 2156 wrote to memory of 1808 2156 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe"C:\Users\Admin\AppData\Local\Temp\6b255a1604756b2b862ed301a5341b12900f9405a378be6e6f49197c810c8554.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\$rar10656.tmp2⤵
- Modifies registry class
- Runs regedit.exe
PID:4872
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\$10943.tmp2⤵
- Runs regedit.exe
PID:4936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$edbs.bat2⤵PID:4884
-
-
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /s C:\Users\Admin\AppData\Local\Temp\okhhhik.tmp2⤵
- Modifies registry class
- Runs regedit.exe
PID:4904
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$dmsf.bat2⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f3⤵PID:1808
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
665B
MD5d856f1fe03701148c3e9189c6210a00d
SHA195c0cc3185d0876e2ddcaead82393395f7fb0c13
SHA2560fc53d795c1ce09989b29b8c9cf77367396890db047e1c2dff362962f98af5f3
SHA512d42c3c1b8d7734e4ebca3513ddf9728e89be1dfb4c2b5591c9f7d0c9c9556bf2b0595e1797b3a51f205a151a20bbdd9a4365abb9f8aab87a7541da312fb03635
-
Filesize
59B
MD50cf180f20e716094bef34db0f1a39a04
SHA1f8e9da5d8eaf347b240a77c6a9c4f494d4fc351b
SHA2562a72298ec1d957d1d225aec50a4e6e32c5dec2f2645f25e580304e5c7ae5bb26
SHA512a471fee35dfc685effb46fcc37d47d7210fad3fdba7cb5342b13e11f95ae7690e4053b3399bca6da7546015a479ce55a301c6934be8bab7ec9eae5aece8bdb3b
-
Filesize
1KB
MD5f9ce5c8a3059991babf4084151caa492
SHA126567f89a885b0e69f24309c3e5c58e8e938f841
SHA256e82c214f33cad1b25146758e22fd887b15f63b1a7a8d716b358c50dc5c3d4e96
SHA512cce48827588aa5968453a8a69baeab8435083dca1d625d079b01d4f9292c7bcb85ab1217f1cf96ea301eef49b7a96a76b58413d4496f1c35e234df7c7e5c9750
-
Filesize
142B
MD51722b85f05faa97e09cc1d98002d0711
SHA10a2ec5d60f6c8af838fc004e8fbb0b436437887f
SHA2562c428a167d8dabe9b4e4e821f5d56333962208ef44bc0becbf9c968f1e583e21
SHA51240393e3b6f958a2b0303810ba3653f55b18ff22439df78487752c92cbe0a510120b2a078b31805980ae2ceaa4465674bfc2ce03803988481fd633e2b9c3ca3b8
-
Filesize
4KB
MD5e65d0630e7c3363eff81fd64109c3dac
SHA1062d18f42ff35760bed198d51c1056a42c22bfba
SHA256286db12cc30d8834f18cbc2d72aab3cbc8ab4c515dc8f4e124c82eaa61e4061d
SHA512d4921c73729c5a00f9f2348d93cd0db827ea17cb45295f0f0b05d99597a241dab7703b674dd107e7a9d15854765b279af7d4f6b7ab8c44a1e658e361c63c0559
-
Filesize
30KB
MD5d0cd586c5c857850a188e778b971f25a
SHA13f584fd89e41151c389b4701d876d2bdd2885fc2
SHA2562f6cd2ed9806a09fecce1f96cd5b3f77fc0339ddbbb4c31aab25e85fd3f268eb
SHA512995f539c7163e0e49c7cc4687dd29dac4ac88501410d8c9935f99d993b14bf5fe349cdcdc9f61d4f308c280536b54f54ae7d041565c73a2340881f68e7b2c41c