Analysis
-
max time kernel
169s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 21:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe
-
Size
728KB
-
MD5
0fca26c5f674fe71e1ca22bc9b13b388
-
SHA1
f3b3dddf61e9d68223a08878acfe0fcacdc8da75
-
SHA256
f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d
-
SHA512
021336a181429bd96bb304861d92a588035a6029cc18315599db5e431ea6e9690e2106d3a23e55bedd98aa967bea94c5ed4187de6645e218f073be6876de2dda
-
SSDEEP
6144:wpqoa8aLyC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCa:wpqyC/2OGAtkCP4cejGSOpRK3CnIi6
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\a: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\g: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\h: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\i: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\n: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\b: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\l: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\t: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\w: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\y: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\x: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\f: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\k: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\m: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\o: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\p: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\v: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\z: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\e: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\j: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\q: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\r: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe File opened (read-only) \??\u: f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/484-132-0x0000000000400000-0x00000000004D3000-memory.dmp autoit_exe behavioral2/memory/484-139-0x0000000000400000-0x00000000004D3000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com" f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com" f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com" f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 484 wrote to memory of 2740 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 81 PID 484 wrote to memory of 2740 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 81 PID 484 wrote to memory of 2740 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 81 PID 2740 wrote to memory of 4912 2740 cmd.exe 83 PID 2740 wrote to memory of 4912 2740 cmd.exe 83 PID 2740 wrote to memory of 4912 2740 cmd.exe 83 PID 484 wrote to memory of 4848 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 84 PID 484 wrote to memory of 4848 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 84 PID 484 wrote to memory of 4848 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 84 PID 4848 wrote to memory of 2288 4848 cmd.exe 86 PID 4848 wrote to memory of 2288 4848 cmd.exe 86 PID 4848 wrote to memory of 2288 4848 cmd.exe 86 PID 484 wrote to memory of 4704 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 89 PID 484 wrote to memory of 4704 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 89 PID 484 wrote to memory of 4704 484 f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe 89 PID 4704 wrote to memory of 228 4704 cmd.exe 91 PID 4704 wrote to memory of 228 4704 cmd.exe 91 PID 4704 wrote to memory of 228 4704 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe"C:\Users\Admin\AppData\Local\Temp\f20292438bcd78712d9bbce09866b484250640f50893991ad199796cfe28e50d.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:4912
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵PID:2288
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:228
-
-