Analysis
-
max time kernel
28s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 07:49
Static task
static1
Behavioral task
behavioral1
Sample
60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe
Resource
win10v2004-20221111-en
General
-
Target
60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe
-
Size
80KB
-
MD5
5036136e716dca1240229eb7cd7a34a4
-
SHA1
a13301388da33b4b4bcb10e490482b1db020e8a5
-
SHA256
60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85
-
SHA512
1833e18587f3f0435930e7c4de440c5bf52ebe0abcb9f80f417914eea4a63f2ffbe0ecd03ba476c51231a816a334f52b40a77b348099a45b596f4785f5181418
-
SSDEEP
1536:uy0JHefrMd0r592sT4kDVH/8b26XXu5C84W9jcgduZD5dKo:uy0ndM5nM8NiDX+3/9jcKuZDH
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1312 cmd.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Desktop\General 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exepid process 1976 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exedescription pid process target process PID 1980 wrote to memory of 1976 1980 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe PID 1980 wrote to memory of 1976 1980 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe PID 1980 wrote to memory of 1976 1980 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe PID 1980 wrote to memory of 1976 1980 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe PID 1976 wrote to memory of 1312 1976 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe cmd.exe PID 1976 wrote to memory of 1312 1976 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe cmd.exe PID 1976 wrote to memory of 1312 1976 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe cmd.exe PID 1976 wrote to memory of 1312 1976 60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe"C:\Users\Admin\AppData\Local\Temp\60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe"1⤵
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe"C:\Users\Admin\AppData\Local\Temp\60300b15aa495881616397018ecb5e91d384053b15c2c2d8f7eac4b891f5dd85.exe" del2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\cmd.exe/c del C:\Users\Admin\AppData\Local\Temp\60300B~1.EXE.tmp >> NUL3⤵
- Deletes itself
PID:1312