Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 08:53
Static task
static1
Behavioral task
behavioral1
Sample
55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe
Resource
win7-20220901-en
General
-
Target
55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe
-
Size
207KB
-
MD5
4a9eab928b94427188ef30782f14d181
-
SHA1
08554b3ab7044a918e782f12a09b83970fe3d47e
-
SHA256
55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b
-
SHA512
24e2aa30dacf9b5b07a9381cbaa79c35e8a0af15b380588ac073d5679b54a8b0d2b3a95949fcc2ecbe045e530cde846da88b600ba790dccb7aa6faaf2177f67b
-
SSDEEP
3072:vtK8sN3+yM6f0tH5KWR8iIKyVppK3kQIzl6r0WZH0ZxiCcWMKj1NPjet:vo5MyStjRDybMkQTv0Zx+bG1Nw
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
sourcemouse.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat sourcemouse.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
sourcemouse.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections sourcemouse.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings sourcemouse.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad sourcemouse.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-94-7c-09-5d-71\WpadDecision = "0" sourcemouse.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-94-7c-09-5d-71\WpadDecisionTime = b07f12b9dd00d901 sourcemouse.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" sourcemouse.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" sourcemouse.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sourcemouse.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sourcemouse.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9531C690-CC1D-456E-A30E-4B0C7D16DD58}\WpadNetworkName = "Network 2" sourcemouse.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-94-7c-09-5d-71 sourcemouse.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings sourcemouse.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 sourcemouse.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" sourcemouse.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9531C690-CC1D-456E-A30E-4B0C7D16DD58}\WpadDecision = "0" sourcemouse.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-94-7c-09-5d-71\WpadDecisionReason = "1" sourcemouse.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix sourcemouse.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9531C690-CC1D-456E-A30E-4B0C7D16DD58} sourcemouse.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9531C690-CC1D-456E-A30E-4B0C7D16DD58}\WpadDecisionReason = "1" sourcemouse.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9531C690-CC1D-456E-A30E-4B0C7D16DD58}\WpadDecisionTime = b07f12b9dd00d901 sourcemouse.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9531C690-CC1D-456E-A30E-4B0C7D16DD58}\62-94-7c-09-5d-71 sourcemouse.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
sourcemouse.exepid process 1380 sourcemouse.exe 1380 sourcemouse.exe 1380 sourcemouse.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exepid process 1696 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exesourcemouse.exesourcemouse.exepid process 1352 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe 1696 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe 2024 sourcemouse.exe 1380 sourcemouse.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exesourcemouse.exedescription pid process target process PID 1352 wrote to memory of 1696 1352 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe PID 1352 wrote to memory of 1696 1352 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe PID 1352 wrote to memory of 1696 1352 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe PID 1352 wrote to memory of 1696 1352 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe 55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe PID 2024 wrote to memory of 1380 2024 sourcemouse.exe sourcemouse.exe PID 2024 wrote to memory of 1380 2024 sourcemouse.exe sourcemouse.exe PID 2024 wrote to memory of 1380 2024 sourcemouse.exe sourcemouse.exe PID 2024 wrote to memory of 1380 2024 sourcemouse.exe sourcemouse.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe"C:\Users\Admin\AppData\Local\Temp\55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\55646d034c47ddec8b91c0e0fc20d8a84e179f322ddcc947efd9d843700ae28b.exe--bef9fffa2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\sourcemouse.exe"C:\Windows\SysWOW64\sourcemouse.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sourcemouse.exe--cbff9d202⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1352-54-0x0000000075B51000-0x0000000075B53000-memory.dmpFilesize
8KB
-
memory/1352-56-0x0000000000220000-0x000000000023B000-memory.dmpFilesize
108KB
-
memory/1352-58-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1380-62-0x0000000000000000-mapping.dmp
-
memory/1380-65-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1380-66-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1696-55-0x0000000000000000-mapping.dmp
-
memory/1696-59-0x0000000000250000-0x000000000026B000-memory.dmpFilesize
108KB
-
memory/1696-60-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1696-63-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB