Analysis
-
max time kernel
175s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 10:51
Static task
static1
Behavioral task
behavioral1
Sample
9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe
-
Size
216KB
-
MD5
13dde0f9ec77fb74c17be791f3a4c909
-
SHA1
fc7daf80fa740122571cce040cb66e1ac65bbcfc
-
SHA256
9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d
-
SHA512
94745a733b05e56acb09819c9b94dd61be89160fbbfd57f90ff5cc230affeb6b21261016f26f5d5bec0e94988f7e8d912914c1ce983adec145445b9b78a2ddbf
-
SSDEEP
6144:pF83J74px47zj6AHTBj82Uz8MtSGRxwyE:n83p6UTx86MDRxk
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4760 svcr.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515} svcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2bf41070-b2b1-21d1-b5c1-0305f4055515}\StubPath = "C:\\windows\\svcr.exe" svcr.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe" 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Windows\\svcr.exe" 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\svcr.exe 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe File created C:\Windows\svcr.exe 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3734612695" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374509335" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30994922" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30994922" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3734612695" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{FDBA14E7-5DDD-11ED-89AC-5ECC372795C7} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4384 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe 4384 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe 4760 svcr.exe 4760 svcr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4760 svcr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1124 IEXPLORE.EXE 1124 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1124 IEXPLORE.EXE 1124 IEXPLORE.EXE 3980 IEXPLORE.EXE 3980 IEXPLORE.EXE 1124 IEXPLORE.EXE 1124 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE 2536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4384 wrote to memory of 5080 4384 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe 80 PID 4384 wrote to memory of 5080 4384 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe 80 PID 4384 wrote to memory of 5080 4384 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe 80 PID 5080 wrote to memory of 1124 5080 IEXPLORE.EXE 81 PID 5080 wrote to memory of 1124 5080 IEXPLORE.EXE 81 PID 1124 wrote to memory of 3980 1124 IEXPLORE.EXE 82 PID 1124 wrote to memory of 3980 1124 IEXPLORE.EXE 82 PID 1124 wrote to memory of 3980 1124 IEXPLORE.EXE 82 PID 4384 wrote to memory of 4760 4384 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe 83 PID 4384 wrote to memory of 4760 4384 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe 83 PID 4384 wrote to memory of 4760 4384 9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe 83 PID 4760 wrote to memory of 884 4760 svcr.exe 84 PID 4760 wrote to memory of 884 4760 svcr.exe 84 PID 4760 wrote to memory of 884 4760 svcr.exe 84 PID 884 wrote to memory of 1632 884 IEXPLORE.EXE 85 PID 884 wrote to memory of 1632 884 IEXPLORE.EXE 85 PID 1124 wrote to memory of 2536 1124 IEXPLORE.EXE 86 PID 1124 wrote to memory of 2536 1124 IEXPLORE.EXE 86 PID 1124 wrote to memory of 2536 1124 IEXPLORE.EXE 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86 PID 4760 wrote to memory of 2536 4760 svcr.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe"C:\Users\Admin\AppData\Local\Temp\9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"2⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3980
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:82948 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2536
-
-
-
-
C:\Windows\svcr.exe"C:\Windows\svcr.exe" "C:\Users\Admin\AppData\Local\Temp\9e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d.exe"2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"3⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
PID:1632
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD513dde0f9ec77fb74c17be791f3a4c909
SHA1fc7daf80fa740122571cce040cb66e1ac65bbcfc
SHA2569e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d
SHA51294745a733b05e56acb09819c9b94dd61be89160fbbfd57f90ff5cc230affeb6b21261016f26f5d5bec0e94988f7e8d912914c1ce983adec145445b9b78a2ddbf
-
Filesize
216KB
MD513dde0f9ec77fb74c17be791f3a4c909
SHA1fc7daf80fa740122571cce040cb66e1ac65bbcfc
SHA2569e8c9596bea2c560264b69f33e625630b4e7b1657cc79c58b89a83f81fc8529d
SHA51294745a733b05e56acb09819c9b94dd61be89160fbbfd57f90ff5cc230affeb6b21261016f26f5d5bec0e94988f7e8d912914c1ce983adec145445b9b78a2ddbf