Overview
overview
9Static
static
9Plugins/Pl...mo.dll
windows7-x64
1Plugins/Pl...mo.dll
windows10-2004-x64
8Plugins/Pl...VC.dll
windows7-x64
8Plugins/Pl...VC.dll
windows10-2004-x64
8Plugin_Demo_VC.html
windows7-x64
1Plugin_Demo_VC.html
windows10-2004-x64
1Plugin_dem...emo.js
windows7-x64
1Plugin_dem...emo.js
windows10-2004-x64
1Plugin_dem...emo.js
windows7-x64
1Plugin_dem...emo.js
windows10-2004-x64
1Plugins/SE_API.dll
windows7-x64
1Plugins/SE_API.dll
windows10-2004-x64
1Plugins/SE_API.vbs
windows7-x64
1Plugins/SE_API.vbs
windows10-2004-x64
1Plugins/SE_File.dll
windows7-x64
1Plugins/SE_File.dll
windows10-2004-x64
1Plugins/SE_File.js
windows7-x64
1Plugins/SE_File.js
windows10-2004-x64
1Plugins/SE_OCR.dll
windows7-x64
1Plugins/SE_OCR.dll
windows10-2004-x64
1Plugins/SE_OCR.vbs
windows7-x64
1Plugins/SE_OCR.vbs
windows10-2004-x64
1Plugins/SE_Std.dll
windows7-x64
1Plugins/SE_Std.dll
windows10-2004-x64
1Plugins/SE_Std.vbs
windows7-x64
1Plugins/SE_Std.vbs
windows10-2004-x64
1Plugins/SE_Web.dll
windows7-x64
1Plugins/SE_Web.dll
windows10-2004-x64
1Plugins/SE_Web.vbs
windows7-x64
1Plugins/SE_Web.vbs
windows10-2004-x64
1SERunner.exe
windows7-x64
8SERunner.exe
windows10-2004-x64
8Analysis
-
max time kernel
101s -
max time network
188s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 21:09
Behavioral task
behavioral1
Sample
Plugins/Plugin_Demo.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Plugins/Plugin_Demo.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Plugins/Plugin_Demo_VC.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Plugins/Plugin_Demo_VC.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
Plugin_Demo_VC.html
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
Plugin_Demo_VC.html
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
Plugin_demo/Plugin_Demo.js
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
Plugin_demo/Plugin_Demo.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Plugin_demo/Plugin_Demo.js
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Plugin_demo/Plugin_Demo.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Plugins/SE_API.dll
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Plugins/SE_API.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Plugins/SE_API.vbs
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Plugins/SE_API.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Plugins/SE_File.dll
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Plugins/SE_File.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
Plugins/SE_File.js
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
Plugins/SE_File.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Plugins/SE_OCR.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Plugins/SE_OCR.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Plugins/SE_OCR.vbs
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
Plugins/SE_OCR.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
Plugins/SE_Std.dll
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Plugins/SE_Std.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
Plugins/SE_Std.vbs
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
Plugins/SE_Std.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
Plugins/SE_Web.dll
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
Plugins/SE_Web.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
Plugins/SE_Web.vbs
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
Plugins/SE_Web.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
SERunner.exe
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
SERunner.exe
Resource
win10v2004-20220812-en
General
-
Target
SERunner.exe
-
Size
475KB
-
MD5
91ceea673a6037e6cb0567d1d12d79c8
-
SHA1
0097db117324c541a9a1b7ffd351ba88c1b8f355
-
SHA256
8f84a94c16f7420ef8347b734614e0d8320f66551e3e9864aa5e56eaf870ac31
-
SHA512
543b820610882d2195c851bee2f75b6dac123a782b885284ddf171dcbaab6ff9f426079a1cfd2a3b53e7912a83815ed4d9f315af053d4e309dffb9b5df7eab29
-
SSDEEP
6144:/koRd4UG9sUrh8SyWeQxfgBRlfVDUAg8cXRsRJE15i6cgsXK7b016i8heZi7PI7:/kC4UG9s6CxMoBBPgLXCRJEbgandg7
Malware Config
Signatures
-
resource yara_rule behavioral31/memory/1744-55-0x0000000000400000-0x000000000054B000-memory.dmp upx behavioral31/memory/1744-56-0x00000000003A0000-0x00000000003B9000-memory.dmp upx behavioral31/memory/1744-58-0x0000000000400000-0x000000000054B000-memory.dmp upx behavioral31/memory/1744-59-0x00000000003A0000-0x00000000003B9000-memory.dmp upx behavioral31/memory/1744-67-0x0000000000400000-0x000000000054B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main SERunner.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch SERunner.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" SERunner.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 464 Process not Found -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1744 SERunner.exe 1744 SERunner.exe 1744 SERunner.exe