Analysis
-
max time kernel
171s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 18:12
Behavioral task
behavioral1
Sample
Monkey Island Crypter/Island.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Monkey Island Crypter/Island.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Monkey Island Crypter/Merged.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Monkey Island Crypter/Merged.exe
Resource
win10v2004-20221111-en
General
-
Target
Monkey Island Crypter/Island.exe
-
Size
88KB
-
MD5
d9a9ea1c848793138f91e029122a3c64
-
SHA1
95b4c2d7c98948ce1773e90ec4740fe132e34350
-
SHA256
da2aacbd755c284e1122aac8fd3ca5772cce04a13c5c62119770aa1cf3687d87
-
SHA512
73f290a45cfe68aba845297222ada09160fc607f0d1d6dfb0bebae9918295df4127a425a7ff70fa9c4c4ea49a4e430788f436cf7c234ea65bf828d2bb422f6cb
-
SSDEEP
768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ1zOXhN2Mnsk2yg3fZ9+Rj3qDHLxdc0:JxqjQ+P04wsmJCmzOm9+Z3qDFS
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
Island.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Island.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
Processes:
Island.exepid process 300 Island.exe -
Loads dropped DLL 3 IoCs
Processes:
Island.exepid process 1812 Island.exe 1812 Island.exe 1812 Island.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
Island.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OIS.EXE Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE Island.exe File opened for modification C:\PROGRA~2\WINDOW~4\ImagingDevices.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\misc.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE Island.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe Island.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe Island.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE Island.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Island.exe File opened for modification C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe Island.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE Island.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE Island.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe Island.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE Island.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE Island.exe File opened for modification C:\PROGRA~2\WI54FB~1\WMPDMC.exe Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE Island.exe -
Drops file in Windows directory 1 IoCs
Processes:
Island.exedescription ioc process File opened for modification C:\Windows\svchost.com Island.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Island.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Island.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Island.exepid process 300 Island.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Island.exedescription pid process target process PID 1812 wrote to memory of 300 1812 Island.exe Island.exe PID 1812 wrote to memory of 300 1812 Island.exe Island.exe PID 1812 wrote to memory of 300 1812 Island.exe Island.exe PID 1812 wrote to memory of 300 1812 Island.exe Island.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Monkey Island Crypter\Island.exe"C:\Users\Admin\AppData\Local\Temp\Monkey Island Crypter\Island.exe"1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Island.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Island.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Island.eXeFilesize
48KB
MD53fb99bcb5b10ce65e610e31d65e9a1f0
SHA18de8b2df22b0960188fe40500b639dd4a1783ea2
SHA2567a88f2aad67a720229dcc368bbf2ef3851380741b17602d4855af2d383ed4234
SHA5123f798bddb7ac08dcec8d3984ab7eaf5b4cfe452e51e53153a1f8d26daa02193c5e5432fe5b7080ab1547597d2d50002688abce85c6a207afea47942e4a0dc2a7
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Island.exeFilesize
48KB
MD53fb99bcb5b10ce65e610e31d65e9a1f0
SHA18de8b2df22b0960188fe40500b639dd4a1783ea2
SHA2567a88f2aad67a720229dcc368bbf2ef3851380741b17602d4855af2d383ed4234
SHA5123f798bddb7ac08dcec8d3984ab7eaf5b4cfe452e51e53153a1f8d26daa02193c5e5432fe5b7080ab1547597d2d50002688abce85c6a207afea47942e4a0dc2a7
-
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXEFilesize
252KB
MD59e2b9928c89a9d0da1d3e8f4bd96afa7
SHA1ec66cda99f44b62470c6930e5afda061579cde35
SHA2568899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043
SHA5122ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156
-
\Users\Admin\AppData\Local\Temp\3582-490\Island.exeFilesize
48KB
MD53fb99bcb5b10ce65e610e31d65e9a1f0
SHA18de8b2df22b0960188fe40500b639dd4a1783ea2
SHA2567a88f2aad67a720229dcc368bbf2ef3851380741b17602d4855af2d383ed4234
SHA5123f798bddb7ac08dcec8d3984ab7eaf5b4cfe452e51e53153a1f8d26daa02193c5e5432fe5b7080ab1547597d2d50002688abce85c6a207afea47942e4a0dc2a7
-
\Users\Admin\AppData\Local\Temp\3582-490\Island.exeFilesize
48KB
MD53fb99bcb5b10ce65e610e31d65e9a1f0
SHA18de8b2df22b0960188fe40500b639dd4a1783ea2
SHA2567a88f2aad67a720229dcc368bbf2ef3851380741b17602d4855af2d383ed4234
SHA5123f798bddb7ac08dcec8d3984ab7eaf5b4cfe452e51e53153a1f8d26daa02193c5e5432fe5b7080ab1547597d2d50002688abce85c6a207afea47942e4a0dc2a7
-
memory/300-57-0x0000000000000000-mapping.dmp
-
memory/1812-54-0x00000000753F1000-0x00000000753F3000-memory.dmpFilesize
8KB