Analysis
-
max time kernel
191s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 11:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe
Resource
win7-20221111-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe
-
Size
987KB
-
MD5
10404519899160e813d3b453372a4901
-
SHA1
034c89effe2144beac5170948516d508d554b778
-
SHA256
1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10
-
SHA512
98414b5ada492bcf62ba0e16109324ad580f3a6cde07a23a9635db9d8d3b59ca891a04beb2f8f3ad47f005da87a4619af6388464488b27fc30f9d07e89320572
-
SSDEEP
24576:14lavt0LkLL9IMixoEgeaG5eQYExX9q9MmCS:Mkwkn9IMHeaGM2faPCS
Score
8/10
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iflmnkfrd.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iflmnkfrd.exe\DisableExceptionChainValidation explorer.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe" 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\defenders = "\"C:\\ProgramData\\mysteppo\\iflmnkfrd.exe\"" 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe -
Checks for any installed AV software in registry 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus explorer.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\ProgramData\mysteppo\desktop.ini explorer.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1992 set thread context of 1624 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 628 schtasks.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40}\64E207E2\CG1 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40}\64E207E2\CG1\HAL = 05ee0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40}\64E207E2\ê '—t3\BID = 2000080018000b00e607000014000000180010000e0021000000000069987f63 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40}\64E207E2\CW1 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40}\64E207E2 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40}\64E207E2\ê '—t3 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40}\64E207E2\CS1 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{005224A0-E343-C045-8A64-AFF2D0B0ED40}\64E207E2\CW1\1992 = 88000000280500008df19c0350010600 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe:Zone.Identifier:$DATA 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1624 explorer.exe 1624 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 1624 explorer.exe Token: SeBackupPrivilege 1624 explorer.exe Token: SeDebugPrivilege 1624 explorer.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1624 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 28 PID 1992 wrote to memory of 1624 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 28 PID 1992 wrote to memory of 1624 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 28 PID 1992 wrote to memory of 1624 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 28 PID 1992 wrote to memory of 1624 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 28 PID 1992 wrote to memory of 1624 1992 1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe 28 PID 1624 wrote to memory of 628 1624 explorer.exe 29 PID 1624 wrote to memory of 628 1624 explorer.exe 29 PID 1624 wrote to memory of 628 1624 explorer.exe 29 PID 1624 wrote to memory of 628 1624 explorer.exe 29 PID 1624 wrote to memory of 1608 1624 explorer.exe 31 PID 1624 wrote to memory of 1608 1624 explorer.exe 31 PID 1624 wrote to memory of 1608 1624 explorer.exe 31 PID 1624 wrote to memory of 1608 1624 explorer.exe 31 PID 1624 wrote to memory of 1608 1624 explorer.exe 31 PID 1624 wrote to memory of 1608 1624 explorer.exe 31 PID 1624 wrote to memory of 1608 1624 explorer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe"C:\Users\Admin\AppData\Local\Temp\1cce551a876cf09086411743ace27f61c88da62eb89f898e1648818cf39f0e10.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Sets file execution options in registry
- Checks for any installed AV software in registry
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x64E207E2" /TR "C:\ProgramData\mysteppo\iflmnkfrd.exe" /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:628
-
-
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\SysWOW64\WerFault.exe"3⤵PID:1608
-
-