d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974

Analysis

max time kernel
135s
max time network
188s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe
Size

143KB
MD5

c348ad12b81d8243808a66d09a9bd466
SHA1

40dcbb53423b72ce6de3f26ebcac6c714791cd1a
SHA256

d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974
SHA512

996921fa83ad612615afb92894a0eeb385be0f0d9a8e1175517d6fffc526ecd7c682e17893a2a89b0e33657b5ff4b5807cf8f90e2384dab3ef419bf8a55c54e7
SSDEEP

3072:iN6ZekwVJIlgps5q9Eb648qwlS/+TfQO45DQ:pe9IB83ID58

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da000000000200000000001066000000010000200000002b5730ff1af42e1f4f38309b4f376c7bf2de8f1860cd8da2002aa8e3df10528a000000000e8000000002000020000000fb2fc6d90b2bc324ece64561c9bb281c68b710579c53d45f99f9579abb97f7119000000054d153efd35eecad0c31bf4c5488dfd738d0147a332e567a6ce49e3eada79058d56dc5215839b5d9b58c9b865b33dced406b4bb6671000b8db3210474e08561a78c8e5117368aea9cb9043be85ffd7a178d2ca09084d35e74d6ae43b593912f7da2567a74807cfdf057041a30d01422a7314ccd30f47c3fff341298acac81514879d79ca6ad48c5f7bb7b8fd786ac9aa400000001ed4d0f2e38286dc579f5f1b7e6999d901eb3f69271f20f6ccc7f55771576cd69c0e7ed56a3aee734cbdd98597264db409936cbd97e4c7a7b46300999425095d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000061c6f5590b38e32a2890076675c6187387af1aa11762a08edd17dae8fb7358d8000000000e8000000002000020000000949d8213b8ba45c1b2e9851f2ff403f4d3dc9cccadc5c995f82be97a3a4037b520000000ebb6d8448dbbc7371f576a6eba9b3ba387459b7830a25c862abe396a6f43ac7840000000aabc9e92a051ba5bc4a3a89a3de8b908e0a770691561782f9ac04e03b98059b16594afe07048a6fb00218d9adc3727467538ff122b15fa20de1f89326ded434e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4070f0d32a03d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB18B2E1-6F1D-11ED-8A3F-62E10F117DDC} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
908	d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe
1336	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
908	d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1336	iexplore.exe
1336	iexplore.exe
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 1288	908	d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe	31
PID 908 wrote to memory of 1288	908	d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe	31
PID 908 wrote to memory of 1288	908	d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe	31
PID 908 wrote to memory of 1288	908	d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe	31
PID 1288 wrote to memory of 1336	1288	cmd.exe	33
PID 1288 wrote to memory of 1336	1288	cmd.exe	33
PID 1288 wrote to memory of 1336	1288	cmd.exe	33
PID 1288 wrote to memory of 1336	1288	cmd.exe	33
PID 1336 wrote to memory of 1644	1336	iexplore.exe	34
PID 1336 wrote to memory of 1644	1336	iexplore.exe	34
PID 1336 wrote to memory of 1644	1336	iexplore.exe	34
PID 1336 wrote to memory of 1644	1336	iexplore.exe	34

C:\Users\Admin\AppData\Local\Temp\d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe
"C:\Users\Admin\AppData\Local\Temp\d05d40d4adfa08e5d86a387e00caf68e3be99c5e06de6ef47627b6b97ae12974.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=4300109^&rsn=plde^&details=^|v6.1.7601x64sp1.0ws^|tt35^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1288
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://securedfileinfo.com/404.jsp?chid=4300109&rsn=plde&details=|v6.1.7601x64sp1.0ws|tt35|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p1
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
7ef66f502cb164d6d88fd779895d5e07

SHA1
75c68e887afe0041c18bc01dc36ae719db07a436

SHA256
084f8949af79ac48c5c245e4bbeea807949d1e8e182e7d0487227231fcd97a77

SHA512
419b6e5def7e1051af856ea4256235fa4f1bdbf001b54f1db9e59c44f7da8f9cfa8d63f77e35345ec6d5c3ab13de10094281d44f42a7e1fd9d92b3b68ac5ba9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
03ad9fc0b00b5df3165dc2fb1e3b0a3e

SHA1
f8243335a8bc24d989bddd346048a055e1d0bdeb

SHA256
366b28d491f7fd632e31c1ce97f939555f7dcee14bb6875737ed2d3e96fa32ec

SHA512
a3cd8a001366e6c1b96d2b920d56e6efd34e9b69b9805e1a2b0c270346712e22420366f8bd18bbb1dd16fa60d481ad65b13385a66a3f1fa0d7aadaaa27b99796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
6695130aaab663affdf6a80adbf98ba3

SHA1
9bb20465ab3bb4aaf648a3dec4e6e8d9fc2cc210

SHA256
8dfef71e8e17a5cd2cc4f6ae24a8c708097b188ee4215ec8265c7885b35972fe

SHA512
0d250c58cc27e7cddc718ddd320aeccdd26d5250af3b1bc26aa6c0a2a3929494340f25c0b798a4e59ad0de36df7bc6beda85636bfa309723bc34314c4e88c430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
b41545967ac7069e7a04e9a1efadec8b

SHA1
075b46139137806b2c89f26675d91361adeb4147

SHA256
a99b82c6912e90e1758f70c151a0776ca376344db8e3c142deac623cbf6c8954

SHA512
3c963ee4c87f67f3748a6481a1160b279081e2c88d6178173755643a4b76d201828905e20955914f1da06a249d5cda83e57a09c31e9c68150657047d9a601917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d92eecbdd0408891e60acc51a08bbfc

SHA1
ccc792ee1b265e2766be91ca6cde8f9f04c07e3a

SHA256
e37ea9a946e71029601d768269a2960b515bde6806e4dfc8a1d490ffef744fea

SHA512
383259491b8f8fe953b9f0c79cb6b9edf224244b473cfced6c89e8d2d89977f8e8067799e6cdd205ba797c97571e6c1196720609650c8a6c675dcec0f42602fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
4653743454ebcede7098a730f3129939

SHA1
7195e7c48fb2edf839a85bfeb7e11fe58166c3f6

SHA256
e2857638c87d4019a52f4dd5008aed4bbbb2b9ad934e8e4e07fd2e610235bb22

SHA512
8dc21d380912c1bf0a0cb823487f6298dd48d76e6a097aa31352f183616367891a1a11e04de312758b3e71bd5efa93630977c2847633dd266f0dec78819e66cf

Download Submit
memory/908-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download