Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6.exe
Resource
win7-20220812-en
General
-
Target
9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6.exe
-
Size
888KB
-
MD5
82e29f4581342f7d18464fe7935bb600
-
SHA1
e0220e5ba3023f2fb42c2f9d379b809c3f2f7aca
-
SHA256
9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6
-
SHA512
2ad530c75edc9c62b15ae1384b4c7f1a7b83d7407bab08ba580d540e1f09c423beda98006b1b3931447c82d78b783860e43541e545f2a206f70d78a153a1134e
-
SSDEEP
12288:VHATf2ycdFG9+krC8MIvumXdw9eDuUltBeDuUlVEtEvVxpbN:Va2ycPU+krC8tWAw+yxpbN
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 1712 dcyegitogmrnjybv.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 1120 2040 WerFault.exe 77 4204 4728 WerFault.exe 90 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{125A6872-5903-11ED-AECB-E62BBF623C53} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366490502" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3792 IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe Token: SeDebugPrivilege 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe Token: SeSecurityPrivilege 1712 dcyegitogmrnjybv.exe Token: SeLoadDriverPrivilege 1712 dcyegitogmrnjybv.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3792 IEXPLORE.EXE 3792 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 5040 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6.exe 3792 IEXPLORE.EXE 3792 IEXPLORE.EXE 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE 3792 IEXPLORE.EXE 3792 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE 1688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 5040 wrote to memory of 4956 5040 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6.exe 76 PID 5040 wrote to memory of 4956 5040 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6.exe 76 PID 5040 wrote to memory of 4956 5040 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6.exe 76 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 2040 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 77 PID 4956 wrote to memory of 888 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 82 PID 4956 wrote to memory of 888 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 82 PID 4956 wrote to memory of 888 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 82 PID 888 wrote to memory of 3792 888 iexplore.exe 83 PID 888 wrote to memory of 3792 888 iexplore.exe 83 PID 3792 wrote to memory of 2220 3792 IEXPLORE.EXE 84 PID 3792 wrote to memory of 2220 3792 IEXPLORE.EXE 84 PID 3792 wrote to memory of 2220 3792 IEXPLORE.EXE 84 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 4728 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 90 PID 4956 wrote to memory of 3452 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 97 PID 4956 wrote to memory of 3452 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 97 PID 4956 wrote to memory of 3452 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 97 PID 3452 wrote to memory of 4340 3452 iexplore.exe 98 PID 3452 wrote to memory of 4340 3452 iexplore.exe 98 PID 3792 wrote to memory of 1688 3792 IEXPLORE.EXE 99 PID 3792 wrote to memory of 1688 3792 IEXPLORE.EXE 99 PID 3792 wrote to memory of 1688 3792 IEXPLORE.EXE 99 PID 4956 wrote to memory of 1712 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 100 PID 4956 wrote to memory of 1712 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 100 PID 4956 wrote to memory of 1712 4956 9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6.exe"C:\Users\Admin\AppData\Local\Temp\9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exeC:\Users\Admin\AppData\Local\Temp\9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:2040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 844⤵
- Program crash
PID:1120
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3792 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2220
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3792 CREDAT:82948 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1688
-
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵PID:4728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2044⤵
- Program crash
PID:4204
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
PID:4340
-
-
-
C:\Users\Admin\AppData\Local\Temp\dcyegitogmrnjybv.exe"C:\Users\Admin\AppData\Local\Temp\dcyegitogmrnjybv.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2040 -ip 20401⤵PID:4560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4728 -ip 47281⤵PID:4508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe
Filesize111KB
MD501d78731e0877a900ba8777f796b1e70
SHA1fcb262d14c928c5b23aa377222bcba6ed0f8fa4a
SHA2561b834256d4ed7160962cbd6b87ccdb1833853f69aaf271ac74af6dcd013d029b
SHA512ee177f1536d2dcacee156b3367e9bec01760a214bb61538041ebd4d178c13a3b8f829e2826c8d2339ba8041eaf53929cebc86bf3e7b22dbeb9b314e30fe5143a
-
C:\Users\Admin\AppData\Local\Temp\9af414175d1a699f426f5c071c691a560633db47b8d59c9f53298a6eebb206a6mgr.exe
Filesize111KB
MD501d78731e0877a900ba8777f796b1e70
SHA1fcb262d14c928c5b23aa377222bcba6ed0f8fa4a
SHA2561b834256d4ed7160962cbd6b87ccdb1833853f69aaf271ac74af6dcd013d029b
SHA512ee177f1536d2dcacee156b3367e9bec01760a214bb61538041ebd4d178c13a3b8f829e2826c8d2339ba8041eaf53929cebc86bf3e7b22dbeb9b314e30fe5143a
-
Filesize
111KB
MD501d78731e0877a900ba8777f796b1e70
SHA1fcb262d14c928c5b23aa377222bcba6ed0f8fa4a
SHA2561b834256d4ed7160962cbd6b87ccdb1833853f69aaf271ac74af6dcd013d029b
SHA512ee177f1536d2dcacee156b3367e9bec01760a214bb61538041ebd4d178c13a3b8f829e2826c8d2339ba8041eaf53929cebc86bf3e7b22dbeb9b314e30fe5143a
-
Filesize
111KB
MD501d78731e0877a900ba8777f796b1e70
SHA1fcb262d14c928c5b23aa377222bcba6ed0f8fa4a
SHA2561b834256d4ed7160962cbd6b87ccdb1833853f69aaf271ac74af6dcd013d029b
SHA512ee177f1536d2dcacee156b3367e9bec01760a214bb61538041ebd4d178c13a3b8f829e2826c8d2339ba8041eaf53929cebc86bf3e7b22dbeb9b314e30fe5143a