Analysis
-
max time kernel
169s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 21:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe
-
Size
747KB
-
MD5
0dc609e6156e018c3622756da40dd058
-
SHA1
dcbd22be25a317e7004b83cb34d5f55cb2bbc9c8
-
SHA256
df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a
-
SHA512
bc1cd270317bdaa2e4854dcec19e3653b5741c0bf48b20911197fd48aff7b2077e1951d6f5dad2e8bbc844569497e3f7f11f8b184581c67100bcc0b98951a7d5
-
SSDEEP
6144:Epqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcXYnCH:EpqiC/2OGAtkCP4cejGSOpRKACnIi
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\v: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\w: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\y: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\b: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\k: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\o: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\j: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\q: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\s: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\z: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\a: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\e: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\h: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\x: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\g: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\p: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\u: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\m: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\n: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\t: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\f: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\i: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe File opened (read-only) \??\l: df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1164-61-0x0000000000400000-0x00000000004D8000-memory.dmp autoit_exe behavioral1/memory/1164-64-0x0000000000400000-0x00000000004D8000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Search_URL = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Search Page = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1516 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 28 PID 1164 wrote to memory of 1516 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 28 PID 1164 wrote to memory of 1516 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 28 PID 1164 wrote to memory of 1516 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 28 PID 1516 wrote to memory of 1424 1516 cmd.exe 30 PID 1516 wrote to memory of 1424 1516 cmd.exe 30 PID 1516 wrote to memory of 1424 1516 cmd.exe 30 PID 1516 wrote to memory of 1424 1516 cmd.exe 30 PID 1164 wrote to memory of 1136 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 31 PID 1164 wrote to memory of 1136 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 31 PID 1164 wrote to memory of 1136 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 31 PID 1164 wrote to memory of 1136 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 31 PID 1136 wrote to memory of 1400 1136 cmd.exe 33 PID 1136 wrote to memory of 1400 1136 cmd.exe 33 PID 1136 wrote to memory of 1400 1136 cmd.exe 33 PID 1136 wrote to memory of 1400 1136 cmd.exe 33 PID 1164 wrote to memory of 1108 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 37 PID 1164 wrote to memory of 1108 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 37 PID 1164 wrote to memory of 1108 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 37 PID 1164 wrote to memory of 1108 1164 df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe 37 PID 1108 wrote to memory of 1588 1108 cmd.exe 39 PID 1108 wrote to memory of 1588 1108 cmd.exe 39 PID 1108 wrote to memory of 1588 1108 cmd.exe 39 PID 1108 wrote to memory of 1588 1108 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe"C:\Users\Admin\AppData\Local\Temp\df798b806ee39d39a6360e286a5feef9491d2e49b7de193e3890b966f9bb744a.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:1424
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵PID:1400
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:1588
-
-