Analysis
-
max time kernel
154s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:12
Static task
static1
Behavioral task
behavioral1
Sample
ffc961c73149fae4c1abc94f066190b77f8c20f5c5c21bbcc0ae0da0d11c9406.dll
Resource
win7-20220812-en
General
-
Target
ffc961c73149fae4c1abc94f066190b77f8c20f5c5c21bbcc0ae0da0d11c9406.dll
-
Size
163KB
-
MD5
2ad25d81e8d455471a4f9f803acd02ce
-
SHA1
0580f084f662cf2b79896eceec2cc57e44e95507
-
SHA256
ffc961c73149fae4c1abc94f066190b77f8c20f5c5c21bbcc0ae0da0d11c9406
-
SHA512
56a5d0e48c49918130b173291d75f41c73f85e63615d11ad64bf25ee5fcb97404e8521253a097f7cffa8432693abb8b1394c04d1601f6e69066985cdb7709a77
-
SSDEEP
3072:nv4tCk6tj9tnCRLMGbwQG52xKUgfyFRsxxulukd0pF:vMAtCRYGbG52gUHRU
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
qnOwJ23dmcmnsbgfflfgjrw.exepid process 2056 qnOwJ23 4152 dmcmnsbgfflfgjrw.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
qnOwJ23description ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation qnOwJ23 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3596 648 WerFault.exe svchost.exe 3228 4728 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375998874" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0F4947AE-6B6A-11ED-B696-E64E24383C5C} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
qnOwJ23dmcmnsbgfflfgjrw.exedescription pid process Token: SeSecurityPrivilege 2056 qnOwJ23 Token: SeDebugPrivilege 2056 qnOwJ23 Token: SeSecurityPrivilege 4152 dmcmnsbgfflfgjrw.exe Token: SeLoadDriverPrivilege 4152 dmcmnsbgfflfgjrw.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 2008 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 2008 IEXPLORE.EXE 2008 IEXPLORE.EXE 3264 IEXPLORE.EXE 3264 IEXPLORE.EXE 3264 IEXPLORE.EXE 3264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
rundll32.exerundll32.exeqnOwJ23iexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 3612 wrote to memory of 4940 3612 rundll32.exe rundll32.exe PID 3612 wrote to memory of 4940 3612 rundll32.exe rundll32.exe PID 3612 wrote to memory of 4940 3612 rundll32.exe rundll32.exe PID 4940 wrote to memory of 2056 4940 rundll32.exe qnOwJ23 PID 4940 wrote to memory of 2056 4940 rundll32.exe qnOwJ23 PID 4940 wrote to memory of 2056 4940 rundll32.exe qnOwJ23 PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 648 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 3784 2056 qnOwJ23 iexplore.exe PID 2056 wrote to memory of 3784 2056 qnOwJ23 iexplore.exe PID 2056 wrote to memory of 3784 2056 qnOwJ23 iexplore.exe PID 3784 wrote to memory of 2008 3784 iexplore.exe IEXPLORE.EXE PID 3784 wrote to memory of 2008 3784 iexplore.exe IEXPLORE.EXE PID 2008 wrote to memory of 3264 2008 IEXPLORE.EXE IEXPLORE.EXE PID 2008 wrote to memory of 3264 2008 IEXPLORE.EXE IEXPLORE.EXE PID 2008 wrote to memory of 3264 2008 IEXPLORE.EXE IEXPLORE.EXE PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 4728 2056 qnOwJ23 svchost.exe PID 2056 wrote to memory of 2636 2056 qnOwJ23 iexplore.exe PID 2056 wrote to memory of 2636 2056 qnOwJ23 iexplore.exe PID 2056 wrote to memory of 2636 2056 qnOwJ23 iexplore.exe PID 2636 wrote to memory of 4400 2636 iexplore.exe IEXPLORE.EXE PID 2636 wrote to memory of 4400 2636 iexplore.exe IEXPLORE.EXE PID 2056 wrote to memory of 4152 2056 qnOwJ23 dmcmnsbgfflfgjrw.exe PID 2056 wrote to memory of 4152 2056 qnOwJ23 dmcmnsbgfflfgjrw.exe PID 2056 wrote to memory of 4152 2056 qnOwJ23 dmcmnsbgfflfgjrw.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ffc961c73149fae4c1abc94f066190b77f8c20f5c5c21bbcc0ae0da0d11c9406.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ffc961c73149fae4c1abc94f066190b77f8c20f5c5c21bbcc0ae0da0d11c9406.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qnOwJ23"qnOwJ23"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 648 -s 2085⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 2045⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"5⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\dmcmnsbgfflfgjrw.exe"C:\Users\Admin\AppData\Local\Temp\dmcmnsbgfflfgjrw.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 648 -ip 6481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4728 -ip 47281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dmcmnsbgfflfgjrw.exeFilesize
95KB
MD55b1a0c379ccc8cab0d06cbeb1338451b
SHA1ae615e94824e0547027768d74d03af8b23fefd4d
SHA2562dccbfc709478a47a8c039619c5aecc11731f3fe8e3a70c26b4e6f668f190d29
SHA512a4433852b9c404df4b8e2d68cabe0df3ff02a2c9ebda7ecc468e73d1651119bd1dc878474f3c508b8d42b8bb78c1c08d1fe5c93175f8e2b15a9765019179c581
-
C:\Users\Admin\AppData\Local\Temp\dmcmnsbgfflfgjrw.exeFilesize
95KB
MD55b1a0c379ccc8cab0d06cbeb1338451b
SHA1ae615e94824e0547027768d74d03af8b23fefd4d
SHA2562dccbfc709478a47a8c039619c5aecc11731f3fe8e3a70c26b4e6f668f190d29
SHA512a4433852b9c404df4b8e2d68cabe0df3ff02a2c9ebda7ecc468e73d1651119bd1dc878474f3c508b8d42b8bb78c1c08d1fe5c93175f8e2b15a9765019179c581
-
C:\Users\Admin\AppData\Local\Temp\qnOwJ23Filesize
95KB
MD55b1a0c379ccc8cab0d06cbeb1338451b
SHA1ae615e94824e0547027768d74d03af8b23fefd4d
SHA2562dccbfc709478a47a8c039619c5aecc11731f3fe8e3a70c26b4e6f668f190d29
SHA512a4433852b9c404df4b8e2d68cabe0df3ff02a2c9ebda7ecc468e73d1651119bd1dc878474f3c508b8d42b8bb78c1c08d1fe5c93175f8e2b15a9765019179c581
-
C:\Users\Admin\AppData\Local\Temp\qnOwJ23Filesize
95KB
MD55b1a0c379ccc8cab0d06cbeb1338451b
SHA1ae615e94824e0547027768d74d03af8b23fefd4d
SHA2562dccbfc709478a47a8c039619c5aecc11731f3fe8e3a70c26b4e6f668f190d29
SHA512a4433852b9c404df4b8e2d68cabe0df3ff02a2c9ebda7ecc468e73d1651119bd1dc878474f3c508b8d42b8bb78c1c08d1fe5c93175f8e2b15a9765019179c581
-
memory/648-137-0x0000000000000000-mapping.dmp
-
memory/2056-139-0x0000000000400000-0x000000000043A0CC-memory.dmpFilesize
232KB
-
memory/2056-133-0x0000000000000000-mapping.dmp
-
memory/2056-144-0x0000000000400000-0x000000000043A0CC-memory.dmpFilesize
232KB
-
memory/4152-142-0x0000000000000000-mapping.dmp
-
memory/4152-146-0x0000000000400000-0x000000000043A0CC-memory.dmpFilesize
232KB
-
memory/4728-141-0x0000000000000000-mapping.dmp
-
memory/4940-138-0x0000000050590000-0x00000000505BB000-memory.dmpFilesize
172KB
-
memory/4940-132-0x0000000000000000-mapping.dmp