dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292

Analysis

max time kernel
113s
max time network
117s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292.exe
Size

1.7MB
MD5

6f46e054f64095cdd33c8a91ddb10f2c
SHA1

d7268f8668fde3c9edbfb31f326620a99c1bfc04
SHA256

dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292
SHA512

c02c4b772004efdb45c4ec2b5b550d47ef5ed12e548a7866dbe049169be6de5b3b9842fff99202b9809cf14bb47a3050409c371798c322f52371fb9b1d0317e5
SSDEEP

49152:wC9fzeXGpYWoa2pFBva4d1Ml3OKY8EwNmDjEaggUvtcRv:VfKXG2WcFRxE3WbxDjEagPG1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
536	DownloadManager.exe

Loads dropped DLL 1 IoCs

pid	Process
1944	dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000000c55cb701100557365727300600008000400efbeee3a851a0c55cb702a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 7a003100000000007d55353611004465736b746f7000640008000400efbe0c55cb707d5535362a000000ea0100000000020000000000000000003a00000000004400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000000c553d79100041646d696e00380008000400efbe0c55cb700c553d792a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
536	DownloadManager.exe
536	DownloadManager.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	DownloadManager.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 536	1944	dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292.exe	27
PID 1944 wrote to memory of 536	1944	dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292.exe	27
PID 1944 wrote to memory of 536	1944	dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292.exe	27
PID 1944 wrote to memory of 536	1944	dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292.exe	27
PID 536 wrote to memory of 1896	536	DownloadManager.exe	30
PID 536 wrote to memory of 1896	536	DownloadManager.exe	30
PID 536 wrote to memory of 1896	536	DownloadManager.exe	30
PID 536 wrote to memory of 1896	536	DownloadManager.exe	30

C:\Users\Admin\AppData\Local\Temp\dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292.exe
"C:\Users\Admin\AppData\Local\Temp\dc6f4504cce94fae8ca9ea856090de2f29ae7782fada96182fc01c093e4bb292.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\DownloadManager.exe
  "C:\Users\Admin\AppData\Local\Temp\config.xml" --dmlauncher --uploader
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\System32\explorer.exe" /select, "C:\Users\Admin\Desktop\YourFile.exe"
    3⤵
    PID:1896

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DownloadManager.exe

Filesize
1.6MB

MD5
1ea016c071898502e2f72869e5d86402

SHA1
748907109ecddeb9950c02583e240657f5873a86

SHA256
dc4adf26fdfee4ee179aae6310d9c7a5dd7c04d5ca0954decd9889c120d8f9d6

SHA512
6afe6344fe0ef2587cf049431679d20dd9a9e8ed3f80c9469d122c88d09697051229ab165495acbcbe34369298c671e73bd9ebafce13b4f0934f7490bbf6eaf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\DownloadManager.exe

Filesize
1.6MB

MD5
1ea016c071898502e2f72869e5d86402

SHA1
748907109ecddeb9950c02583e240657f5873a86

SHA256
dc4adf26fdfee4ee179aae6310d9c7a5dd7c04d5ca0954decd9889c120d8f9d6

SHA512
6afe6344fe0ef2587cf049431679d20dd9a9e8ed3f80c9469d122c88d09697051229ab165495acbcbe34369298c671e73bd9ebafce13b4f0934f7490bbf6eaf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.xml

Filesize
880B

MD5
301ed07a0adeee53a9ad96071078f6aa

SHA1
b93aa0c6fa2cfe6fc59d5cf27fc5f98ad116c311

SHA256
f47fbfcfa38b342236e30deab51b70b60c3c5a8a6883592754821ab1433c6788

SHA512
430ef44287422b6c9270fb6a7a545b4b9595a5a189d5818a2c788bd308c543d976afbd635e759643f4239f9c8bc6d9436328f48dd7226c611a1a044443500cb5

Download Submit
\Users\Admin\AppData\Local\Temp\DownloadManager.exe

Filesize
1.6MB

MD5
1ea016c071898502e2f72869e5d86402

SHA1
748907109ecddeb9950c02583e240657f5873a86

SHA256
dc4adf26fdfee4ee179aae6310d9c7a5dd7c04d5ca0954decd9889c120d8f9d6

SHA512
6afe6344fe0ef2587cf049431679d20dd9a9e8ed3f80c9469d122c88d09697051229ab165495acbcbe34369298c671e73bd9ebafce13b4f0934f7490bbf6eaf0

Download Submit
memory/536-62-0x0000000002026000-0x0000000002037000-memory.dmp

Filesize
68KB

Download
memory/536-59-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/536-58-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/536-61-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/536-63-0x0000000002026000-0x0000000002037000-memory.dmp

Filesize
68KB

Download
memory/536-69-0x0000000074F40000-0x00000000754EB000-memory.dmp

Filesize
5.7MB

Download
memory/536-70-0x0000000002026000-0x0000000002037000-memory.dmp

Filesize
68KB

Download
memory/1572-67-0x000007FEFC511000-0x000007FEFC513000-memory.dmp

Filesize
8KB

Download
memory/1572-68-0x0000000003780000-0x0000000003790000-memory.dmp

Filesize
64KB

Download
memory/1896-66-0x0000000071731000-0x0000000071733000-memory.dmp

Filesize
8KB

Download