Analysis
-
max time kernel
156s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 05:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe
-
Size
803KB
-
MD5
1717fd05ca9477fa922196bcb5227e47
-
SHA1
2c806e40c4a2278da671688f2b88a306d53b4003
-
SHA256
b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1
-
SHA512
9cc4b0fe73f1f6c8d7fbfc680d45bb6e78c4fda922f8e08ae7e79fea8bfae8a6426fc41427cbcec3e78275e1807a3ac078ffe4155234dc9ba9f7377c2422f25a
-
SSDEEP
6144:xpqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCV:xpqiC/2OGAtkCP4cejGSOpRK3CGY
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe" b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe -
Disables Task Manager via registry modification
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe" b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\x: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\i: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\j: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\n: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\t: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\w: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\z: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\a: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\f: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\k: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\l: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\m: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\p: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\s: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\u: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\b: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\e: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\o: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\r: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\v: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\y: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\g: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe File opened (read-only) \??\h: b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4324-132-0x0000000000400000-0x00000000004E6000-memory.dmp autoit_exe behavioral2/memory/4324-139-0x0000000000400000-0x00000000004E6000-memory.dmp autoit_exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\d:\autorun.inf b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com" b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com" b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com" b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com" b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4324 wrote to memory of 820 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 81 PID 4324 wrote to memory of 820 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 81 PID 4324 wrote to memory of 820 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 81 PID 820 wrote to memory of 4176 820 cmd.exe 84 PID 820 wrote to memory of 4176 820 cmd.exe 84 PID 820 wrote to memory of 4176 820 cmd.exe 84 PID 4324 wrote to memory of 1812 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 85 PID 4324 wrote to memory of 1812 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 85 PID 4324 wrote to memory of 1812 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 85 PID 1812 wrote to memory of 1776 1812 cmd.exe 87 PID 1812 wrote to memory of 1776 1812 cmd.exe 87 PID 1812 wrote to memory of 1776 1812 cmd.exe 87 PID 4324 wrote to memory of 2984 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 91 PID 4324 wrote to memory of 2984 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 91 PID 4324 wrote to memory of 2984 4324 b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe 91 PID 2984 wrote to memory of 724 2984 cmd.exe 93 PID 2984 wrote to memory of 724 2984 cmd.exe 93 PID 2984 wrote to memory of 724 2984 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe"C:\Users\Admin\AppData\Local\Temp\b2f06251b7e8d15a94c4ca554792b488983aa78e1d923693ef6108f05ec073f1.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes2⤵
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\SysWOW64\at.exeAT /delete /yes3⤵PID:4176
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe3⤵PID:1776
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C cacls "C:\system volume information" /e /g "Admin":f2⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cacls.execacls "C:\system volume information" /e /g "Admin":f3⤵PID:724
-
-