Analysis

  • max time kernel
    126s
  • max time network
    186s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 17:11

General

  • Target

    6bdb6b299e1440358bf1dad040040933547ee27445b0210b4dbe5e4b66ce723b.exe

  • Size

    142KB

  • MD5

    51ad325722e1b68fb842fba828c666bf

  • SHA1

    01724ecfbceabad3428fe43519d4548247f39019

  • SHA256

    6bdb6b299e1440358bf1dad040040933547ee27445b0210b4dbe5e4b66ce723b

  • SHA512

    fff16683abfc25ca6b7779bd454b1218a458325a5abd43ddaaf10c55619887c957cdcaa29630c346d5657f9661bfc3cdffa44662329612dd5d524a4c999ff9c3

  • SSDEEP

    3072:M30yg0ZP1KXVkdCUOomLEU3zCjRNO9LjEF1tuu1fRV0izcI7ck:a912VQWL3C+9LQLku1fRV7cx

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bdb6b299e1440358bf1dad040040933547ee27445b0210b4dbe5e4b66ce723b.exe
    "C:\Users\Admin\AppData\Local\Temp\6bdb6b299e1440358bf1dad040040933547ee27445b0210b4dbe5e4b66ce723b.exe"
    1⤵
    • Adds Run key to start application
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/watch?v=vsd3g0h_vs0
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1496 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1712

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    340B

    MD5

    7bc376100bc823ab95b95d2f5e8b0ca8

    SHA1

    d9aa284581a8b05ecb88a6725fb921b2d9d77dcb

    SHA256

    3783576bb0ba10697d4b1f307bbcb9f8c579fea8fd5497a063bcaa5705409bb8

    SHA512

    e3965cbeeaa1580503e50ae698a6bdc703c9c812d0799db29151611f51dc24e4386b9deccdb8cc9ce75a4fd0418ada2d75d9c28ebd89980b3d3ed022314c46e5

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

    Filesize

    5KB

    MD5

    7d292f97a22b98b1f8ff91e8959c3c78

    SHA1

    e45c1d91d76b53c1ffe8a4fdfbec82da4ff4cd0d

    SHA256

    75f7dd2e119722e3dd0070057a05cbd93e51499c23ddfdd3b66bacca4b278912

    SHA512

    fe5514cc772eedc5c588fb0e9567e0f4adb70d169ca5a5057c2e6c4f967b2d47e739c946582a08e621c49c78230e2202b9297a5ab871bb035a57d770df52e80d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EF0I677Z.txt

    Filesize

    603B

    MD5

    df53668992730b099cec79dea66040d7

    SHA1

    f4635b4c66e27255812ee556a59f1b12dfd0437f

    SHA256

    3c52a5ef0311648f771baab922ba13e6055a76b0130186a4e1b663185b748fc2

    SHA512

    ac17d5d5eb904144b7b7aefa184c7311c0368faaccc0a9855b7c4365129886551cc841c48db8437a49e23aaee31faad82fbb8576c78f7ee52f90b23f97482a9e

  • memory/2040-54-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2040-55-0x0000000000270000-0x00000000002B6000-memory.dmp

    Filesize

    280KB

  • memory/2040-58-0x00000000762F1000-0x00000000762F3000-memory.dmp

    Filesize

    8KB

  • memory/2040-60-0x0000000000270000-0x00000000002B6000-memory.dmp

    Filesize

    280KB

  • memory/2040-61-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB