Analysis
-
max time kernel
113s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 23:21
Behavioral task
behavioral1
Sample
d339f5f6b725c52346dd855f747f7d3bbf1d94e1336a993b7e374afae1fe5969.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d339f5f6b725c52346dd855f747f7d3bbf1d94e1336a993b7e374afae1fe5969.dll
Resource
win10v2004-20220812-en
General
-
Target
d339f5f6b725c52346dd855f747f7d3bbf1d94e1336a993b7e374afae1fe5969.dll
-
Size
500KB
-
MD5
0c260a6c3bc4c5e3d898df01285f02d0
-
SHA1
8061ea2c1189b6116a195d89ae88ab8442c74b97
-
SHA256
d339f5f6b725c52346dd855f747f7d3bbf1d94e1336a993b7e374afae1fe5969
-
SHA512
4feb9474303af281b3f4786fadef9f5e6ca1bd66f84369aff5c73687e39c97c6c23c6ab63d602fa3b6301900e5df1153318f1f49bb307691dabcc640ff815ef5
-
SSDEEP
6144:Ot5xiJjUNb8L4K91KFqPzb//EJcq5nDcaeo6WfmymREmCMeBZA52ijMQiEU5/YBy:u6gF7KGYaiaB65y5TMl2TPWyZBrzqU
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1208-56-0x0000000001E90000-0x0000000001F9C000-memory.dmp vmprotect behavioral1/memory/1208-57-0x0000000001E90000-0x0000000001F9C000-memory.dmp vmprotect -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\rundll32.exe rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E0B7DC1-6D7C-11ED-B68C-6A6CB2F85B9F} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d105b890c9f351429583aa19de63b6b00000000002000000000010660000000100002000000061d5628d67c6e367d3b0d8ba113b4988955994f9795a589da6bd1ed4a704fa2f000000000e80000000020000200000003329107d40b65d95ad60c15fa4eb4d04e87c5d7f77b23d4a06a41c541d991b0820000000dae2cec5be316f0a9274f34d7f27304bb906810dd74119efff9d30a2b8569bd2400000006407a1237645c2a9ec99ebc8ac6ce761a5a24644a6c56c3064743ed9df51fb8013ceb92bd5b8f5a9ce5409c7277a2b061dc413d45273a17f3c5070ce9ab4ef62 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fb13608901d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376226673" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d105b890c9f351429583aa19de63b6b000000000020000000000106600000001000020000000cae43ecd5a0c54ab0a1ea8f69baf2cae7e62f2c3ebd44d1b4e00c94b6f63cf99000000000e80000000020000200000007c8494b9af5db4701884d0e32efdec9d292b1284e46bff7eeb2a56a92f573e959000000063c63cfe33863887bb855e2492f5d99ec5608fde87b4ad36189702d8147b971076c736a12cbf243f9a784f0b6ff3d21c97d8813899335812690a5564ff3894d126814de561a9c0e291548dc15ebeb1794fad0b5a0263fd2636e615de1dab94b883ecccafbec3113e40b6dd7c18ee1e23e936e25ffe126be3d251c113caa7ea9a518b184e6ce5ad47610e71c2d77625a540000000c8e8dacd920ecbb542befa71356080e4e8aec3e27d9a376db8938a7a536753784f9c1ef298e0cb8881975acfa077ad6ae133df2eb7a5e10280988ecb04b77d97 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
rundll32.exepid process 1208 rundll32.exe 1208 rundll32.exe 1208 rundll32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1712 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1712 iexplore.exe 1712 iexplore.exe 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE 1524 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.exeiexplore.exedescription pid process target process PID 1752 wrote to memory of 1208 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1208 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1208 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1208 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1208 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1208 1752 rundll32.exe rundll32.exe PID 1752 wrote to memory of 1208 1752 rundll32.exe rundll32.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe iexplore.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe iexplore.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe iexplore.exe PID 1208 wrote to memory of 1712 1208 rundll32.exe iexplore.exe PID 1712 wrote to memory of 1524 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1524 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1524 1712 iexplore.exe IEXPLORE.EXE PID 1712 wrote to memory of 1524 1712 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d339f5f6b725c52346dd855f747f7d3bbf1d94e1336a993b7e374afae1fe5969.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d339f5f6b725c52346dd855f747f7d3bbf1d94e1336a993b7e374afae1fe5969.dll,#12⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://contando2015.com/ANP/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1524
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FQ7F6HNK.txtFilesize
608B
MD5583e272b84bdc288ba94db56a06e6156
SHA14b8210a4bbff5e7f71eb1348d44ffcde320a3449
SHA2562a6ff7a8d70284d7cc7b025f753249943760e8250f156174d69f6eae863b9a04
SHA5125ad57419f3e2914cebc2ddb7dfcf1d043e4a7fc305562a0a652b36c3c43a17a7648894e5c7b1c3326a45217d3b5ff5817992b247b03a0bc069a222480540b549
-
memory/1208-54-0x0000000000000000-mapping.dmp
-
memory/1208-55-0x0000000076261000-0x0000000076263000-memory.dmpFilesize
8KB
-
memory/1208-56-0x0000000001E90000-0x0000000001F9C000-memory.dmpFilesize
1.0MB
-
memory/1208-57-0x0000000001E90000-0x0000000001F9C000-memory.dmpFilesize
1.0MB