df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074 | Triage

Analysis

max time kernel
187s
max time network
197s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 18:48

Sharing

Report Analysis Logs

General

Target

df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Size

615KB
MD5

58a8c9cab7dfd97d746853a7b60ebee8
SHA1

37f83d221e621ba73fc0632096bddc3ab4fe64b8
SHA256

df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074
SHA512

9e63af44227dc10695c5220c34e8c34b685d2c9a37f46fb2b591022a4802a38cf7fde5b63cb3aa90fb38b2964b1df91e2ef82a0481c41d65b7a318009acbaa14
SSDEEP

12288:STwZvV6LwQ3ZSqBMN0ekTPG6uupM4qdKeISonPgmVdJxlKUq:S8ZQp3ZSaM2ekT+6uupMFKpSoosdB

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1044-55-0x0000000000400000-0x00000000005E4000-memory.dmp	upx
behavioral1/memory/1044-59-0x0000000000400000-0x00000000005E4000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

Modify Registry

Processes:

df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

Modifies registry class 20 IoCs

Processes:

df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewVersion = "0"	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_Classes\Local Settings	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

pid	process
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

pid	process
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

pid	process
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
1044	df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe

C:\Users\Admin\AppData\Local\Temp\df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe
"C:\Users\Admin\AppData\Local\Temp\df8f8772ff574cbb2027849e18efb0df5ee1fc18448f823e4bfad73a252ae074.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1044-55-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/1044-56-0x0000000003DA0000-0x0000000003DB0000-memory.dmp

Filesize
64KB

Download
memory/1044-57-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

Filesize
64KB

Download
memory/1044-58-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

Filesize
64KB

Download
memory/1044-59-0x0000000000400000-0x00000000005E4000-memory.dmp

Filesize
1.9MB

Download
memory/1044-60-0x0000000003DA0000-0x0000000003DB0000-memory.dmp

Filesize
64KB

Download
memory/1044-61-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

Filesize
64KB

Download
memory/1044-62-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

Filesize
64KB

Download