Analysis
-
max time kernel
151s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 16:12
Behavioral task
behavioral1
Sample
2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe
-
Size
1.2MB
-
MD5
0d3e8cf0bad5e129a3b6cf0e86331718
-
SHA1
cc2ad637e6c1803c37eb63591cae7b4b109c3d9a
-
SHA256
2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf
-
SHA512
2ef80f566bbf634353251f47f1d758c7b241ae040a3269163e14f048e7d5c948a37ca61493b71f290a7acfce9cf82ba0311d5baf7cb9f3fe93ed34b4a358a439
-
SSDEEP
6144:uYZTNk3D6LyUXwLLk+cR3qh0GQ43VJRD0ew+/UOf7Kh:uSNC80I+cR3R03VseuOfw
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe gphone.exe" 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Disables Task Manager via registry modification
-
resource yara_rule behavioral1/memory/584-61-0x0000000000400000-0x000000000049E000-memory.dmp upx behavioral1/memory/584-64-0x0000000000400000-0x000000000049E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\gphone.exe" 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\m: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\o: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\p: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\w: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\x: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\h: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\i: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\j: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\v: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\b: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\e: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\f: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\n: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\t: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\u: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\y: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\z: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\a: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\k: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\l: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\q: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\r: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened (read-only) \??\s: 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/584-61-0x0000000000400000-0x000000000049E000-memory.dmp autoit_exe behavioral1/memory/584-64-0x0000000000400000-0x000000000049E000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\autorun.ini 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File created C:\Windows\SysWOW64\gphone.exe 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened for modification C:\Windows\SysWOW64\gphone.exe 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\gphone.exe 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe File opened for modification C:\Windows\gphone.exe 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://rnd009.googlepages.com/google.html" 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://rnd009.googlepages.com/google.html" 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://rnd009.googlepages.com/google.html" 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://rnd009.googlepages.com/google.html" 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://rnd009.googlepages.com/google.html" 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 584 wrote to memory of 1724 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 28 PID 584 wrote to memory of 1724 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 28 PID 584 wrote to memory of 1724 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 28 PID 584 wrote to memory of 1724 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 28 PID 1724 wrote to memory of 784 1724 cmd.exe 30 PID 1724 wrote to memory of 784 1724 cmd.exe 30 PID 1724 wrote to memory of 784 1724 cmd.exe 30 PID 1724 wrote to memory of 784 1724 cmd.exe 30 PID 584 wrote to memory of 1784 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 31 PID 584 wrote to memory of 1784 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 31 PID 584 wrote to memory of 1784 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 31 PID 584 wrote to memory of 1784 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 31 PID 1784 wrote to memory of 1452 1784 cmd.exe 33 PID 1784 wrote to memory of 1452 1784 cmd.exe 33 PID 1784 wrote to memory of 1452 1784 cmd.exe 33 PID 1784 wrote to memory of 1452 1784 cmd.exe 33 PID 584 wrote to memory of 1028 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 36 PID 584 wrote to memory of 1028 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 36 PID 584 wrote to memory of 1028 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 36 PID 584 wrote to memory of 1028 584 2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe 36 PID 1028 wrote to memory of 1608 1028 cmd.exe 38 PID 1028 wrote to memory of 1608 1028 cmd.exe 38 PID 1028 wrote to memory of 1608 1028 cmd.exe 38 PID 1028 wrote to memory of 1608 1028 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe"C:\Users\Admin\AppData\Local\Temp\2963f19bb5696354f942c9b3367c079ee0718aa1d01d408470273b523755beaf.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:784
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\gphone.exe3⤵PID:1452
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:1608
-
-