Analysis
- max time kernel
187s - max time network
191s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
27/11/2022, 17:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe
Resource
win7-20221111-en
windows7-x64
21 signatures
150 seconds
General
- Target 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe
- Size 285KB
- Sample221127-v65fhsaf2y
- SHA256 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536
- MD5 01daf4f618eac4c7379b4d1f8046deaa
- SHA1 c73db227644dc6cc6d9b7fb91468014572507b4d
- SHA512 435380deca7baf660e8a6b673d02ff6478bc6d823ca416b04a4ff758ffb7c821d5495f9870e9a8bbe513bde229ad5a114e44283160146e205e49d9489fbad465
- SSDEEP 6144:JAsBZACyfs1vYtn9BqNmJ5y52jzm2YYrTASZ:YCyfsYBT5yEqM7Z
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe - Sets file execution options in registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\591933uu.exe 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\591933uu.exe\DisableExceptionChainValidation 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "kymtbjavkn.exe" explorer.exe - Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe - Loads dropped DLL 1 IoCs
pid Process 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Windows Search 5.3.10 = "C:\\ProgramData\\Windows Search 5.3.10\\591933uu.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Search 5.3.10 = "\"C:\\ProgramData\\Windows Search 5.3.10\\591933uu.exe\"" explorer.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe - Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\ProgramData\Windows Search 5.3.10\desktop.ini 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe File opened for modification C:\ProgramData\Windows Search 5.3.10\desktop.ini 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 528 set thread context of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 3744 4268 WerFault.exe 84 - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe - Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe - Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe 4268 explorer.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe - Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeRestorePrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeBackupPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeLoadDriverPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeCreatePagefilePrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeShutdownPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeTakeOwnershipPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeChangeNotifyPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeCreateTokenPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeMachineAccountPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeSecurityPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeAssignPrimaryTokenPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeCreateGlobalPrivilege 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: 33 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe Token: SeDebugPrivilege 4268 explorer.exe Token: SeRestorePrivilege 4268 explorer.exe Token: SeBackupPrivilege 4268 explorer.exe Token: SeLoadDriverPrivilege 4268 explorer.exe Token: SeCreatePagefilePrivilege 4268 explorer.exe Token: SeShutdownPrivilege 4268 explorer.exe Token: SeTakeOwnershipPrivilege 4268 explorer.exe Token: SeChangeNotifyPrivilege 4268 explorer.exe Token: SeCreateTokenPrivilege 4268 explorer.exe Token: SeMachineAccountPrivilege 4268 explorer.exe Token: SeSecurityPrivilege 4268 explorer.exe Token: SeAssignPrimaryTokenPrivilege 4268 explorer.exe Token: SeCreateGlobalPrivilege 4268 explorer.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 528 wrote to memory of 536 528 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 83 PID 536 wrote to memory of 4268 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 84 PID 536 wrote to memory of 4268 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 84 PID 536 wrote to memory of 4268 536 285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe"C:\Users\Admin\AppData\Local\Temp\285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe"C:\Users\Admin\AppData\Local\Temp\285126b79a1f3e3dd5a474ae648cebee8b0da388b09414f8196c9a6349cb7536.exe"2⤵
- Sets file execution options in registry
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 11284⤵
- Program crash
PID:3744
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4268 -ip 42681⤵PID:4148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsv1639.tmp\skiers.dll
- Size 228KB
- SHA256 d059347af564675db2b15bf372282457e4c4b829712ef67c1aa2864b8c706c6d
- MD5 fc7a721c4e3c90b9598d7c81fe77e726
- SHA1 fe84f4d480c5da5e55c09842b74d502b03736770
- SHA512 7bcc246a883e12c4f8965e99f2288e13d8a754600159240df6f881818d54a611b6cbdbe7364aa992405388f8b6b68fa6ad369f53f2fe1bba724cec699e2a0f8a
- SSDEEP 1536:fj/kO7Iu5SOFOBqxxD1Y7hQ70tFZtFaj5qEyQTycg5xxuKTWJS3wcPff+bAQu4ED:fj/nIugOwqxM7hQYtFjg4JMEjUof
- MD5 SHA1 SHA512 SSDEEP