Analysis
-
max time kernel
189s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 18:12
Behavioral task
behavioral1
Sample
Monkey Island Crypter/Island.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Monkey Island Crypter/Island.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Monkey Island Crypter/Merged.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Monkey Island Crypter/Merged.exe
Resource
win10v2004-20221111-en
General
-
Target
Monkey Island Crypter/Island.exe
-
Size
88KB
-
MD5
d9a9ea1c848793138f91e029122a3c64
-
SHA1
95b4c2d7c98948ce1773e90ec4740fe132e34350
-
SHA256
da2aacbd755c284e1122aac8fd3ca5772cce04a13c5c62119770aa1cf3687d87
-
SHA512
73f290a45cfe68aba845297222ada09160fc607f0d1d6dfb0bebae9918295df4127a425a7ff70fa9c4c4ea49a4e430788f436cf7c234ea65bf828d2bb422f6cb
-
SSDEEP
768:eyxqjQl/EMQt4Oei7RwsHxyP7nbxzOQdJ1zOXhN2Mnsk2yg3fZ9+Rj3qDHLxdc0:JxqjQ+P04wsmJCmzOm9+Z3qDFS
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
Island.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Island.exe -
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Executes dropped EXE 1 IoCs
Processes:
Island.exepid process 3804 Island.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Island.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation Island.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Program Files directory 64 IoCs
Processes:
Island.exedescription ioc process File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe Island.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe Island.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe Island.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE Island.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MICROS~2.EXE Island.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE Island.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe Island.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE Island.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE Island.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe Island.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE Island.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe Island.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe Island.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE Island.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE Island.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE Island.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13169~1.31\MIA062~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE Island.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe Island.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13169~1.31\MICROS~1.EXE Island.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe Island.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe Island.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE Island.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE Island.exe -
Drops file in Windows directory 1 IoCs
Processes:
Island.exedescription ioc process File opened for modification C:\Windows\svchost.com Island.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Island.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" Island.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Island.exepid process 3804 Island.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Island.exedescription pid process target process PID 3704 wrote to memory of 3804 3704 Island.exe Island.exe PID 3704 wrote to memory of 3804 3704 Island.exe Island.exe PID 3704 wrote to memory of 3804 3704 Island.exe Island.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Monkey Island Crypter\Island.exe"C:\Users\Admin\AppData\Local\Temp\Monkey Island Crypter\Island.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\3582-490\Island.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Island.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Island.exeFilesize
48KB
MD53fb99bcb5b10ce65e610e31d65e9a1f0
SHA18de8b2df22b0960188fe40500b639dd4a1783ea2
SHA2567a88f2aad67a720229dcc368bbf2ef3851380741b17602d4855af2d383ed4234
SHA5123f798bddb7ac08dcec8d3984ab7eaf5b4cfe452e51e53153a1f8d26daa02193c5e5432fe5b7080ab1547597d2d50002688abce85c6a207afea47942e4a0dc2a7
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Island.exeFilesize
48KB
MD53fb99bcb5b10ce65e610e31d65e9a1f0
SHA18de8b2df22b0960188fe40500b639dd4a1783ea2
SHA2567a88f2aad67a720229dcc368bbf2ef3851380741b17602d4855af2d383ed4234
SHA5123f798bddb7ac08dcec8d3984ab7eaf5b4cfe452e51e53153a1f8d26daa02193c5e5432fe5b7080ab1547597d2d50002688abce85c6a207afea47942e4a0dc2a7
-
memory/3804-132-0x0000000000000000-mapping.dmp