Analysis
-
max time kernel
138s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 12:39
Behavioral task
behavioral1
Sample
8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe
Resource
win10v2004-20220812-en
General
-
Target
8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe
-
Size
1.2MB
-
MD5
fba9a81512ad0deb9dfa5c5b3c7c7cf2
-
SHA1
9d7fc9d653106f0567a2df5c0a15e31b10b4bf74
-
SHA256
8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89
-
SHA512
dcf3c26ede0ba2a209e6c68beba433f76caee5c50c716aa08c15931e72908295b9fa6d637c7a55a695b7e7e1f89ceca035514e379263df47a3c07cb0f0822a36
-
SSDEEP
24576:GRjn23Psy6/nKJmgKtR1HpvmucMNLygGDm5dk2ZlZ:GREPs7nUmnJ4aLTkmZ
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\SkinH_EL.dll acprotect -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\SkinH_EL.dll upx behavioral1/memory/1792-60-0x0000000010000000-0x000000001003D000-memory.dmp upx behavioral1/memory/1792-61-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/1792-55-0x0000000000400000-0x00000000006B7000-memory.dmp vmprotect behavioral1/memory/1792-58-0x0000000000400000-0x00000000006B7000-memory.dmp vmprotect -
Loads dropped DLL 1 IoCs
Processes:
8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exepid process 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXE8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0FF5341-6D00-11ED-95AE-5A5CFA1077B6} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000e84448c6d6f5083ed9607cebb1de82a1323f6f56d78583892e0390b3a22b82a5000000000e8000000002000020000000e4d2a3f32bf06fbaa6b5cda8859e39f81f2a4b3b697412d6f20909cae8941d4020000000d71caa7cb5104fe6818461b4db1f397b74b85427012f2a64f82c9d20ec51a392400000009e41ba82cbf7699495e4b123e7855bdee8577aa421d9b2f9e48184d0179af1c9abb32afe9a3c1dd3232cb3e267791e70ffb27f8420575fe43f14b8270b3f87fa iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4023aa860d01d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000076cdef7d8d1f8c2faf27fad27228c65cee1e90c12f7408c587a2377d8c0f6c7b000000000e80000000020000200000007be94c955ef2f9b30de934378a68be2ae51612c32b5a6a47076c0f302dca36aa90000000cc9c14d6f470ffc9a3c66dc33334820a493177e4fefe5e2b6fb56dec31dc5f6fe9674198e242af1053bac43c1c49497a672c5ca6434d9b23d443f4349d542af21733b62f8a49200ceae07fa41938bf6c16a5aa68c38bb462c6c5704224c61bcad88e7166a02e2a5d8711081f817ae2416ea5221f9a3acd51153841f19d9ed9ed1f25228181b78b22056622d18a56284340000000afd81eb24a496eda627ba74ac2445232b0ce1aa374f07e715c1049fbf8807a9c26a9977f92c2f3407fb9f5d50ed3d4f440228c50bb477d399b0a7367f67e0a08 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376173531" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Processes:
8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 2020 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2020 AUDIODG.EXE Token: 33 2020 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2020 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 112 iexplore.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exeiexplore.exeIEXPLORE.EXEpid process 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe 112 iexplore.exe 112 iexplore.exe 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE 2012 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exeiexplore.exedescription pid process target process PID 1792 wrote to memory of 112 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe iexplore.exe PID 1792 wrote to memory of 112 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe iexplore.exe PID 1792 wrote to memory of 112 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe iexplore.exe PID 1792 wrote to memory of 112 1792 8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe iexplore.exe PID 112 wrote to memory of 2012 112 iexplore.exe IEXPLORE.EXE PID 112 wrote to memory of 2012 112 iexplore.exe IEXPLORE.EXE PID 112 wrote to memory of 2012 112 iexplore.exe IEXPLORE.EXE PID 112 wrote to memory of 2012 112 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe"C:\Users\Admin\AppData\Local\Temp\8676dea78ac84ac9268d12a023a7b09a79b56dffc661a0002b9e08f7418f9e89.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://qqtz.com/read-htm-tid-4245053.html2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:112 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2012
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54c9bf16c1b58179eee1e02958d68d083
SHA166927a218bbb9f5c9f33c69099f281839138f285
SHA2569d1a456f0518bd8277acf8c312422900b1fa38092523158cb48333693b1ad83e
SHA512c68ed3349e4f1d116a68b058cfd7052bd981efc0834803e90b5151a82b1926c3f06076a7c7f62b9cb10ce23141193a8a2ed405e2ea91ee91650b72539862409f
-
Filesize
2KB
MD5d2a1a5a05af76e8c6c60dd5d3e9cba52
SHA18396110222819236572927b30756d14f0d504b96
SHA256980685cb5c6085e6f22aa8f6e1f2023725957d8e5e1cb6e1f080e9fa79b47ecf
SHA512b003690df8a22867ca889ae2ffb0847164c7484870ee655f16f373fb05a0c0c42c19f5dd83c2b8d8db61e4a4bd8ad4bbfe6389c9ea9437bb6938a416491140b9
-
Filesize
608B
MD54ee588b861a2397db2fd0bf4f5ec6c90
SHA122958aa310fe50751981933c18b97c06d68089f4
SHA256ee1281888178608a2a55aff4fe85939d24f3714eaf141940e67e117427e2c159
SHA51252da015c823e16c07d37104f4287f4a47646af8b53c48e6dfa776b035deb9e43f7058a523005e6b5d2914c756743e9c1f3560a6ce4c2ec07c6006358ed39ca53
-
Filesize
86KB
MD5147127382e001f495d1842ee7a9e7912
SHA192d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
SHA256edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
SHA51297f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d