Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 06:57
Static task
static1
Behavioral task
behavioral1
Sample
3628c057a4cc96c7415df4dd6cb31b59.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3628c057a4cc96c7415df4dd6cb31b59.exe
Resource
win10v2004-20221111-en
General
-
Target
3628c057a4cc96c7415df4dd6cb31b59.exe
-
Size
403KB
-
MD5
3628c057a4cc96c7415df4dd6cb31b59
-
SHA1
cca8659c2f66df451aaf300035d3c67f425fdaea
-
SHA256
e3ed9ecec6769ab3d69b37f8b7f95e0ae67c02d8fb97ca041423023fd0fb4add
-
SHA512
111fcf349d9ee22f2d77b48182964cb8c0615f0ab00d17addefc84a7caeb2569168b22b6dbebf12dcf503c8a9b7bec7ef4decc3d4fae7317448cb5f0f00b4b5f
-
SSDEEP
6144:lw0pDStj6LZ+HHHhnnKsqNySq73cvXOwDEvmQnUO6M0KyfIzopVWCp4QJeARuddo:l7Voj8vqzbvqKnc8se2kBPW
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
1.exeexplorer.exe38E1BLMM2J4E94L.exepid process 1152 1.exe 796 explorer.exe 1328 38E1BLMM2J4E94L.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\explorer\explorer.exe vmprotect C:\Users\Admin\AppData\Roaming\explorer\explorer.exe vmprotect C:\Users\Admin\AppData\Roaming\explorer\explorer.exe vmprotect behavioral1/memory/796-66-0x000000013FB30000-0x00000001403C5000-memory.dmp vmprotect behavioral1/memory/796-68-0x000000013FB30000-0x00000001403C5000-memory.dmp vmprotect \Users\Admin\AppData\Roaming\explorer\explorer.exe vmprotect \Users\Admin\AppData\Roaming\explorer\explorer.exe vmprotect \Users\Admin\AppData\Roaming\explorer\explorer.exe vmprotect -
Loads dropped DLL 7 IoCs
Processes:
3628c057a4cc96c7415df4dd6cb31b59.execmd.exeWerFault.exe1.exepid process 1756 3628c057a4cc96c7415df4dd6cb31b59.exe 1756 3628c057a4cc96c7415df4dd6cb31b59.exe 916 cmd.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 1152 1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\explorer\\explorer.exe" 1.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run 1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1624 796 WerFault.exe explorer.exe -
Processes:
38E1BLMM2J4E94L.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main 38E1BLMM2J4E94L.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
explorer.exepid process 796 explorer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3628c057a4cc96c7415df4dd6cb31b59.exedescription pid process Token: SeDebugPrivilege 1756 3628c057a4cc96c7415df4dd6cb31b59.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
38E1BLMM2J4E94L.exepid process 1328 38E1BLMM2J4E94L.exe 1328 38E1BLMM2J4E94L.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
3628c057a4cc96c7415df4dd6cb31b59.exe1.execmd.exeexplorer.exedescription pid process target process PID 1756 wrote to memory of 1152 1756 3628c057a4cc96c7415df4dd6cb31b59.exe 1.exe PID 1756 wrote to memory of 1152 1756 3628c057a4cc96c7415df4dd6cb31b59.exe 1.exe PID 1756 wrote to memory of 1152 1756 3628c057a4cc96c7415df4dd6cb31b59.exe 1.exe PID 1756 wrote to memory of 1152 1756 3628c057a4cc96c7415df4dd6cb31b59.exe 1.exe PID 1152 wrote to memory of 916 1152 1.exe cmd.exe PID 1152 wrote to memory of 916 1152 1.exe cmd.exe PID 1152 wrote to memory of 916 1152 1.exe cmd.exe PID 1152 wrote to memory of 916 1152 1.exe cmd.exe PID 916 wrote to memory of 796 916 cmd.exe explorer.exe PID 916 wrote to memory of 796 916 cmd.exe explorer.exe PID 916 wrote to memory of 796 916 cmd.exe explorer.exe PID 916 wrote to memory of 796 916 cmd.exe explorer.exe PID 796 wrote to memory of 1624 796 explorer.exe WerFault.exe PID 796 wrote to memory of 1624 796 explorer.exe WerFault.exe PID 796 wrote to memory of 1624 796 explorer.exe WerFault.exe PID 1152 wrote to memory of 1328 1152 1.exe 38E1BLMM2J4E94L.exe PID 1152 wrote to memory of 1328 1152 1.exe 38E1BLMM2J4E94L.exe PID 1152 wrote to memory of 1328 1152 1.exe 38E1BLMM2J4E94L.exe PID 1152 wrote to memory of 1328 1152 1.exe 38E1BLMM2J4E94L.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3628c057a4cc96c7415df4dd6cb31b59.exe"C:\Users\Admin\AppData\Local\Temp\3628c057a4cc96c7415df4dd6cb31b59.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\explorer\explorer.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeC:\Users\Admin\AppData\Roaming\explorer\explorer.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 796 -s 565⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\38E1BLMM2J4E94L.exe<!DOCTYPE html> <html style="height:100%"> <head> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /> <title> 404 Not Found </title></head> <body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"> <div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1> <h2 style="margin-top:20px;font-size: 30px;">Not Found </h2> <p>The resource requested could not be found on this server!</p> </div></div></body></html>3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\38E1BLMM2J4E94L.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
C:\Users\Admin\AppData\Local\Temp\38E1BLMM2J4E94L.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeFilesize
5.2MB
MD5dee1568dc4d523e4aff5c7563b26887c
SHA1565a8f3d02746fb203c5a7e2777211bf33cf656b
SHA256f7cbf79fce9ca7d06745604a44c6b2541af476cdd8f5853bf1dbf23213eb3d2b
SHA5120e593e23f5cfbf3bf0cc07373bb013911e9c2068cfad8e666c69173afbe29d06a0635dc32dfa6baca153db2e1de25772cccbc5f63d49d19bc4d18b93f7c97ab2
-
C:\Users\Admin\AppData\Roaming\explorer\explorer.exeFilesize
5.2MB
MD5dee1568dc4d523e4aff5c7563b26887c
SHA1565a8f3d02746fb203c5a7e2777211bf33cf656b
SHA256f7cbf79fce9ca7d06745604a44c6b2541af476cdd8f5853bf1dbf23213eb3d2b
SHA5120e593e23f5cfbf3bf0cc07373bb013911e9c2068cfad8e666c69173afbe29d06a0635dc32dfa6baca153db2e1de25772cccbc5f63d49d19bc4d18b93f7c97ab2
-
C:\Windows\Temp\1.exeFilesize
115KB
MD506eca982ae495dafc793309a7abb18fe
SHA1a53e5c5579f6f2fc69e726567fca4299baeb18f7
SHA256984b2b5f986a23a40b17f6336d44e194d9c55a5cee69c49a9d18c0c117421dff
SHA51228bbd604e9f2ab3ac8fc2848a1b288a155c43f4d697d773c666341eca94897771f9d8cd3459e218028acacb23f5e1d0cf6a7392a8d98ac0e5e01019ce800683f
-
\Users\Admin\AppData\Local\Temp\38E1BLMM2J4E94L.exeFilesize
8KB
MD58719ce641e7c777ac1b0eaec7b5fa7c7
SHA1c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA2566283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
SHA5127be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
-
\Users\Admin\AppData\Roaming\explorer\explorer.exeFilesize
5.2MB
MD5dee1568dc4d523e4aff5c7563b26887c
SHA1565a8f3d02746fb203c5a7e2777211bf33cf656b
SHA256f7cbf79fce9ca7d06745604a44c6b2541af476cdd8f5853bf1dbf23213eb3d2b
SHA5120e593e23f5cfbf3bf0cc07373bb013911e9c2068cfad8e666c69173afbe29d06a0635dc32dfa6baca153db2e1de25772cccbc5f63d49d19bc4d18b93f7c97ab2
-
\Users\Admin\AppData\Roaming\explorer\explorer.exeFilesize
5.2MB
MD5dee1568dc4d523e4aff5c7563b26887c
SHA1565a8f3d02746fb203c5a7e2777211bf33cf656b
SHA256f7cbf79fce9ca7d06745604a44c6b2541af476cdd8f5853bf1dbf23213eb3d2b
SHA5120e593e23f5cfbf3bf0cc07373bb013911e9c2068cfad8e666c69173afbe29d06a0635dc32dfa6baca153db2e1de25772cccbc5f63d49d19bc4d18b93f7c97ab2
-
\Users\Admin\AppData\Roaming\explorer\explorer.exeFilesize
5.2MB
MD5dee1568dc4d523e4aff5c7563b26887c
SHA1565a8f3d02746fb203c5a7e2777211bf33cf656b
SHA256f7cbf79fce9ca7d06745604a44c6b2541af476cdd8f5853bf1dbf23213eb3d2b
SHA5120e593e23f5cfbf3bf0cc07373bb013911e9c2068cfad8e666c69173afbe29d06a0635dc32dfa6baca153db2e1de25772cccbc5f63d49d19bc4d18b93f7c97ab2
-
\Users\Admin\AppData\Roaming\explorer\explorer.exeFilesize
5.2MB
MD5dee1568dc4d523e4aff5c7563b26887c
SHA1565a8f3d02746fb203c5a7e2777211bf33cf656b
SHA256f7cbf79fce9ca7d06745604a44c6b2541af476cdd8f5853bf1dbf23213eb3d2b
SHA5120e593e23f5cfbf3bf0cc07373bb013911e9c2068cfad8e666c69173afbe29d06a0635dc32dfa6baca153db2e1de25772cccbc5f63d49d19bc4d18b93f7c97ab2
-
\Windows\Temp\1.exeFilesize
115KB
MD506eca982ae495dafc793309a7abb18fe
SHA1a53e5c5579f6f2fc69e726567fca4299baeb18f7
SHA256984b2b5f986a23a40b17f6336d44e194d9c55a5cee69c49a9d18c0c117421dff
SHA51228bbd604e9f2ab3ac8fc2848a1b288a155c43f4d697d773c666341eca94897771f9d8cd3459e218028acacb23f5e1d0cf6a7392a8d98ac0e5e01019ce800683f
-
\Windows\Temp\1.exeFilesize
115KB
MD506eca982ae495dafc793309a7abb18fe
SHA1a53e5c5579f6f2fc69e726567fca4299baeb18f7
SHA256984b2b5f986a23a40b17f6336d44e194d9c55a5cee69c49a9d18c0c117421dff
SHA51228bbd604e9f2ab3ac8fc2848a1b288a155c43f4d697d773c666341eca94897771f9d8cd3459e218028acacb23f5e1d0cf6a7392a8d98ac0e5e01019ce800683f
-
memory/796-68-0x000000013FB30000-0x00000001403C5000-memory.dmpFilesize
8.6MB
-
memory/796-66-0x000000013FB30000-0x00000001403C5000-memory.dmpFilesize
8.6MB
-
memory/796-63-0x0000000000000000-mapping.dmp
-
memory/916-61-0x0000000000000000-mapping.dmp
-
memory/1152-59-0x0000000000000000-mapping.dmp
-
memory/1328-73-0x0000000000000000-mapping.dmp
-
memory/1328-76-0x000000013F410000-0x000000013F416000-memory.dmpFilesize
24KB
-
memory/1328-77-0x000007FEFB8E1000-0x000007FEFB8E3000-memory.dmpFilesize
8KB
-
memory/1328-78-0x0000000000939000-0x0000000000958000-memory.dmpFilesize
124KB
-
memory/1624-67-0x0000000000000000-mapping.dmp
-
memory/1756-54-0x00000000001B0000-0x000000000021A000-memory.dmpFilesize
424KB
-
memory/1756-56-0x00000000003F0000-0x0000000000414000-memory.dmpFilesize
144KB
-
memory/1756-55-0x0000000075291000-0x0000000075293000-memory.dmpFilesize
8KB