Analysis
-
max time kernel
153s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 20:33
Behavioral task
behavioral1
Sample
fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe
Resource
win7-20221111-en
General
-
Target
fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe
-
Size
1.6MB
-
MD5
8d87773653078f0f2f76098d6dbfc7b4
-
SHA1
75882468717ad00c64c8cb4e8f5fc42c28f75398
-
SHA256
fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2
-
SHA512
f3460120aca562a9912b23df322b49d8aac6281f6e25fa6a8b2bb65ca339a96d90e47d0d7270931fe492131bc7ba29f585ce8fce5a3dae43079f44b9f7912bc1
-
SSDEEP
24576:tslaQq5j9rfrZgFjiCfGuQ/nnxtkGP25R5ThsRKLSXQJ3TZnT+c1kF0NtrqKax:tszqfZaNQvky2sKLSXQrT+ukF0PrqN
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/1128-136-0x0000000002630000-0x00000000026A2000-memory.dmp upx behavioral2/memory/1128-137-0x0000000002630000-0x00000000026A2000-memory.dmp upx behavioral2/memory/1128-138-0x0000000002630000-0x00000000026A2000-memory.dmp upx -
Processes:
resource yara_rule behavioral2/memory/1128-132-0x0000000000400000-0x00000000007E3000-memory.dmp vmprotect behavioral2/memory/1128-133-0x0000000000400000-0x00000000007E3000-memory.dmp vmprotect behavioral2/memory/1128-135-0x0000000000400000-0x00000000007E3000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\IESettingSync fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exepid process 1128 fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe 1128 fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exepid process 1128 fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe 1128 fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe 1128 fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe 1128 fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe"C:\Users\Admin\AppData\Local\Temp\fbef0573e48b4fb3cff6e568663a99f7ee236cf8e2f554473f09e2fa8472e7b2.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-132-0x0000000000400000-0x00000000007E3000-memory.dmpFilesize
3.9MB
-
memory/1128-133-0x0000000000400000-0x00000000007E3000-memory.dmpFilesize
3.9MB
-
memory/1128-135-0x0000000000400000-0x00000000007E3000-memory.dmpFilesize
3.9MB
-
memory/1128-136-0x0000000002630000-0x00000000026A2000-memory.dmpFilesize
456KB
-
memory/1128-137-0x0000000002630000-0x00000000026A2000-memory.dmpFilesize
456KB
-
memory/1128-138-0x0000000002630000-0x00000000026A2000-memory.dmpFilesize
456KB