Analysis
-
max time kernel
186s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 23:25
Static task
static1
Behavioral task
behavioral1
Sample
25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe
Resource
win10v2004-20220812-en
General
-
Target
25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe
-
Size
574KB
-
MD5
6eff221e20283b648d9d137689afa654
-
SHA1
cdcf71e283efa9252a3ed4d72f204412ae6f36d6
-
SHA256
25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc
-
SHA512
e6f87081330b729cbcaf2ea3801749b5dec83ed685128b6a4215d2d0c62c7fecc7eb5144282e13bf913c9ca23088364d63d6b899a071533e6f0fde7f4f3b91c9
-
SSDEEP
12288:hQpZZI8T70/Vkkf/CDT8olHgUpvvRfbitUtasiT8Yky0RxPe/:SEk8VkyqsgHgUpvtOhkyWde/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
caidaotx.exepid process 692 caidaotx.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\caidaotx.exe upx \Users\Admin\AppData\Local\Temp\caidaotx.exe upx C:\Users\Admin\AppData\Local\Temp\caidaotx.exe upx behavioral1/memory/692-62-0x0000000000400000-0x00000000004B3000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\caidaotx.exe upx behavioral1/memory/692-66-0x0000000000400000-0x00000000004B3000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exepid process 1168 25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe 1168 25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.execaidaotx.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TypedURLs caidaotx.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{86E43181-6E7B-11ED-8E3C-5E5304B417C2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
caidaotx.exeiexplore.exepid process 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 1636 iexplore.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
caidaotx.exepid process 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.execaidaotx.exeiexplore.exeIEXPLORE.EXEpid process 1168 25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe 1168 25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 692 caidaotx.exe 1636 iexplore.exe 1636 iexplore.exe 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE 1612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.execaidaotx.exeiexplore.exedescription pid process target process PID 1168 wrote to memory of 692 1168 25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe caidaotx.exe PID 1168 wrote to memory of 692 1168 25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe caidaotx.exe PID 1168 wrote to memory of 692 1168 25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe caidaotx.exe PID 1168 wrote to memory of 692 1168 25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe caidaotx.exe PID 692 wrote to memory of 1636 692 caidaotx.exe iexplore.exe PID 692 wrote to memory of 1636 692 caidaotx.exe iexplore.exe PID 692 wrote to memory of 1636 692 caidaotx.exe iexplore.exe PID 692 wrote to memory of 1636 692 caidaotx.exe iexplore.exe PID 1636 wrote to memory of 1612 1636 iexplore.exe IEXPLORE.EXE PID 1636 wrote to memory of 1612 1636 iexplore.exe IEXPLORE.EXE PID 1636 wrote to memory of 1612 1636 iexplore.exe IEXPLORE.EXE PID 1636 wrote to memory of 1612 1636 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe"C:\Users\Admin\AppData\Local\Temp\25b78515feb91d63f06604d098df3b099c6a3a20c470549730f662b8025de7cc.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\caidaotx.exeC:\Users\Admin\AppData\Local\Temp/caidaotx.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.maicaidao.com/?md5=4b4a956b9c7dc734f339fa05e4c2a9903⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1612
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\caidaotx.exeFilesize
215KB
MD54b4a956b9c7dc734f339fa05e4c2a990
SHA14a058f0fb95f497f36000eb2c7d697a1aa2c81d5
SHA256a13971cb63bb5d1fa65224587579a16f47dd89b1f6b02e1ac58d0233e4179802
SHA512395f234d99cad4b1890625ac6d38350a86673fede1d9c9408e5808f3ef0138a166c2bc08a5868c4f060139340fe25e6d2b51a28336608df5173d0f9473fea514
-
C:\Users\Admin\AppData\Local\Temp\caidaotx.exeFilesize
215KB
MD54b4a956b9c7dc734f339fa05e4c2a990
SHA14a058f0fb95f497f36000eb2c7d697a1aa2c81d5
SHA256a13971cb63bb5d1fa65224587579a16f47dd89b1f6b02e1ac58d0233e4179802
SHA512395f234d99cad4b1890625ac6d38350a86673fede1d9c9408e5808f3ef0138a166c2bc08a5868c4f060139340fe25e6d2b51a28336608df5173d0f9473fea514
-
\Users\Admin\AppData\Local\Temp\caidaotx.exeFilesize
215KB
MD54b4a956b9c7dc734f339fa05e4c2a990
SHA14a058f0fb95f497f36000eb2c7d697a1aa2c81d5
SHA256a13971cb63bb5d1fa65224587579a16f47dd89b1f6b02e1ac58d0233e4179802
SHA512395f234d99cad4b1890625ac6d38350a86673fede1d9c9408e5808f3ef0138a166c2bc08a5868c4f060139340fe25e6d2b51a28336608df5173d0f9473fea514
-
\Users\Admin\AppData\Local\Temp\caidaotx.exeFilesize
215KB
MD54b4a956b9c7dc734f339fa05e4c2a990
SHA14a058f0fb95f497f36000eb2c7d697a1aa2c81d5
SHA256a13971cb63bb5d1fa65224587579a16f47dd89b1f6b02e1ac58d0233e4179802
SHA512395f234d99cad4b1890625ac6d38350a86673fede1d9c9408e5808f3ef0138a166c2bc08a5868c4f060139340fe25e6d2b51a28336608df5173d0f9473fea514
-
memory/692-59-0x0000000000000000-mapping.dmp
-
memory/692-62-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/692-66-0x0000000000400000-0x00000000004B3000-memory.dmpFilesize
716KB
-
memory/1168-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1168-60-0x00000000034F0000-0x00000000035A3000-memory.dmpFilesize
716KB
-
memory/1168-56-0x0000000000400000-0x0000000000515200-memory.dmpFilesize
1.1MB
-
memory/1168-55-0x0000000000400000-0x0000000000515200-memory.dmpFilesize
1.1MB
-
memory/1168-65-0x00000000034F0000-0x00000000035A3000-memory.dmpFilesize
716KB
-
memory/1168-67-0x00000000034F0000-0x00000000035A3000-memory.dmpFilesize
716KB