Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe
-
Size
343KB
-
MD5
dc39889a0659805faf28470cd07f8f48
-
SHA1
4c2f3676a22a721fea5b6c756859ecede63a2502
-
SHA256
c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365
-
SHA512
64a179ef913ded991ed71ccab95f68265e77349ff98d641ad1b5cece01c47c68e220963d6c8b37b97dbc1e0404fbac83b73acba40d1d8fe5f0aa0076a6a2d8b4
-
SSDEEP
6144:tYdtMxEN0DQN1C+nBs83aHSfuFcyfiP/Y5ndjTmuyWbCm0/cynTH2Eld0me:tYdt/NX1dzaHAuO/eKubCm0/cWTH2Ei
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3840-132-0x0000000000400000-0x00000000004D6000-memory.dmp upx behavioral2/memory/4960-135-0x0000000000400000-0x00000000004D6000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\SqggdQRRHN3mm SqggdQRRHN3mm.exe File opened for modification C:\PROGRA~3\SqggdQRRHN3mm SqggdQRRHN3mm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main SqggdQRRHN3mm.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" SqggdQRRHN3mm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3840 c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4960 SqggdQRRHN3mm.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 3840 c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe 4960 SqggdQRRHN3mm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3840 wrote to memory of 4960 3840 c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe 85 PID 3840 wrote to memory of 4960 3840 c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe 85 PID 3840 wrote to memory of 4960 3840 c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe"C:\Users\Admin\AppData\Local\Temp\c9b3a918112b9fd23d1fa6acacc5841ac4036e36d7cf1dc9e56533452126d365.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\PROGRA~3\SqggdQRRHN3mm.exeC:\PROGRA~3\SqggdQRRHN3mm.exe2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4960
-