Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:49
Static task
static1
Behavioral task
behavioral1
Sample
c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe
Resource
win10v2004-20220812-en
General
-
Target
c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe
-
Size
28KB
-
MD5
e175f67434cd197a20050e38fce71736
-
SHA1
bd6939de1dda4cf658403c6c057024e5dd7746a9
-
SHA256
c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54
-
SHA512
134bf5a6bd66cb190624b747d390b03ecde5aa03dce4a580b3b961857af4a0f3c8d3a8a9d5f1d8d57806273e600fb4a12c21420db9ebcd2b7d483a2aae8efc4a
-
SSDEEP
384:2UonGN8G07mxtT4GIBfTTzzYJxru+j1/yzqUbIXi7jm4vG1+:xon+8G07mxqNTTzzYD96H7/o+
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Aiigsmg.exeAiigsmg.exepid process 1908 Aiigsmg.exe 880 Aiigsmg.exe -
Loads dropped DLL 2 IoCs
Processes:
c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exepid process 536 c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe 536 c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe -
Drops file in System32 directory 2 IoCs
Processes:
Aiigsmg.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NetSyst72[1].htm Aiigsmg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Aiigsmg.exe -
Drops file in Program Files directory 4 IoCs
Processes:
c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exeAiigsmg.exedescription ioc process File created C:\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exe c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe File opened for modification C:\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exe c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe File created C:\Program Files\AppPatch\NetSyst72.dll Aiigsmg.exe File opened for modification C:\Program Files\AppPatch\NetSyst72.dll Aiigsmg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 24 IoCs
Processes:
Aiigsmg.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-c1-a4-c1-69-03 Aiigsmg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Aiigsmg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Aiigsmg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Aiigsmg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-c1-a4-c1-69-03\WpadDecision = "0" Aiigsmg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Aiigsmg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Aiigsmg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Aiigsmg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Aiigsmg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Aiigsmg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-c1-a4-c1-69-03\WpadDecisionTime = 60f94e2f35ffd801 Aiigsmg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\WpadDecisionReason = "1" Aiigsmg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\WpadDecisionTime = 60f94e2f35ffd801 Aiigsmg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\1e-c1-a4-c1-69-03 Aiigsmg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-c1-a4-c1-69-03\WpadDecisionReason = "1" Aiigsmg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Aiigsmg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Aiigsmg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0017000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Aiigsmg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D} Aiigsmg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\WpadDecision = "0" Aiigsmg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F37AE381-0E2F-44C2-8317-96EE207D823D}\WpadNetworkName = "Network 2" Aiigsmg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Aiigsmg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Aiigsmg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Aiigsmg.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exedescription pid process target process PID 536 wrote to memory of 1908 536 c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe Aiigsmg.exe PID 536 wrote to memory of 1908 536 c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe Aiigsmg.exe PID 536 wrote to memory of 1908 536 c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe Aiigsmg.exe PID 536 wrote to memory of 1908 536 c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe Aiigsmg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe"C:\Users\Admin\AppData\Local\Temp\c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exe"C:\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exe"C:\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exeFilesize
28KB
MD5e175f67434cd197a20050e38fce71736
SHA1bd6939de1dda4cf658403c6c057024e5dd7746a9
SHA256c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54
SHA512134bf5a6bd66cb190624b747d390b03ecde5aa03dce4a580b3b961857af4a0f3c8d3a8a9d5f1d8d57806273e600fb4a12c21420db9ebcd2b7d483a2aae8efc4a
-
C:\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exeFilesize
28KB
MD5e175f67434cd197a20050e38fce71736
SHA1bd6939de1dda4cf658403c6c057024e5dd7746a9
SHA256c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54
SHA512134bf5a6bd66cb190624b747d390b03ecde5aa03dce4a580b3b961857af4a0f3c8d3a8a9d5f1d8d57806273e600fb4a12c21420db9ebcd2b7d483a2aae8efc4a
-
\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exeFilesize
28KB
MD5e175f67434cd197a20050e38fce71736
SHA1bd6939de1dda4cf658403c6c057024e5dd7746a9
SHA256c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54
SHA512134bf5a6bd66cb190624b747d390b03ecde5aa03dce4a580b3b961857af4a0f3c8d3a8a9d5f1d8d57806273e600fb4a12c21420db9ebcd2b7d483a2aae8efc4a
-
\Program Files (x86)\Microsoft Ehivmp\Aiigsmg.exeFilesize
28KB
MD5e175f67434cd197a20050e38fce71736
SHA1bd6939de1dda4cf658403c6c057024e5dd7746a9
SHA256c5fac06dc5490d853ef24b050d1d738a4d2aeffe123bb4e4ca858a47d4792b54
SHA512134bf5a6bd66cb190624b747d390b03ecde5aa03dce4a580b3b961857af4a0f3c8d3a8a9d5f1d8d57806273e600fb4a12c21420db9ebcd2b7d483a2aae8efc4a
-
memory/536-54-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1908-57-0x0000000000000000-mapping.dmp