Analysis
-
max time kernel
107s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 15:20
Static task
static1
Behavioral task
behavioral1
Sample
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe
Resource
win10v2004-20220812-en
General
-
Target
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe
-
Size
1.3MB
-
MD5
e969721bbcbbaecaf72ab2bc214cb9c1
-
SHA1
50fb570b74d03bc5ac25c8b4972249360fac711a
-
SHA256
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1
-
SHA512
64f06ffa75d3d908e15bca45b7cbb08f40e9172fb830119cc9686220a17c2b362189c96f1308f126799b0083ad9d39212da232169480c368d848913df3e7e9f7
-
SSDEEP
24576:3tb20pkaCqT5TBWgNQ7aKC0N39gKSKLb2sr5wUCsNOLJ6A:0Vg5tQ7aKdN3KKS2b2sr5b5O5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
9736.exepid process 1428 9736.exe -
Loads dropped DLL 4 IoCs
Processes:
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exepid process 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9736.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 9736.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\WerFault = "C:\\Users\\Admin\\AppData\\Roaming\\9736.exe" 9736.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\9736.exe autoit_exe \Users\Admin\AppData\Roaming\9736.exe autoit_exe \Users\Admin\AppData\Roaming\9736.exe autoit_exe \Users\Admin\AppData\Roaming\9736.exe autoit_exe C:\Users\Admin\AppData\Roaming\9736.exe autoit_exe C:\Users\Admin\AppData\Roaming\9736.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9736.exedescription pid process target process PID 1428 set thread context of 332 1428 9736.exe WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{461F8A71-7031-11ED-AE24-CE372EDB0509} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000006cc9a409e6a4b2e26663d1d6ee22ca4879c41a8f0cf64de0fdfad143e6f49041000000000e80000000020000200000004577e8db0c352e0713ea3616c6706909ac462dfdd2b66743d4b9a7313154477620000000c3a18b6f0184f0b2a7ae1b1309cd7c79afc0753bf92a862648c397f63d1c2d074000000064bd9f867bbebb5a76753362d7d378ef352b08ca0cf0b4df0468e9a75a51f19eb04fd9475f25088c96223dd5094b121a95366fb8b67ecdd9bd1227b12ae9fdd4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e083af1f3e04d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000c1e76994e038ff2771b71b13dad9836d24b966d8fd9b40bd8bc06b5a0a30ddf8000000000e80000000020000200000007f9f2678d9c5c209af122037b1e1d9c0a1572e6c2066fb1a0e1051482461c23890000000bbe5a6a2b26590f8022fa9089cf0c9e35dd6ea4f524d8bb7db6edb611c8eda0476c4052752a4c0324a31cf44e5d6682ae1e9f28a955cbbaf664128da05025c9a1b7bdb5c8087ae419151c4fb2559f419fb53bb459f25baef5204f6d6436d696edabffdda26973576245cb7b96650830805322630ed04e1be102b3a53636ace23a10978784a79f99164fa73d151e086a140000000bda4e237ad005a2b998fc32ef2e170d39c8d7c1ea7e084fbc2519147362d105940595f4bd3488dd360ee617c312425244a29f052b6a5578c428b6f300af858c8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376524221" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
NTFS ADS 3 IoCs
Processes:
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe9736.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\9736.exe\:Zone.Identifier:$DATA eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe File opened for modification C:\Users\Admin\AppData\Roaming\9736.exe:Zone.Identifier:$DATA 9736.exe File created C:\Users\Admin\AppData\Local\Temp\eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe:Zone.Identifier:$DATA eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe9736.exeiexplore.exepid process 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1428 9736.exe 1428 9736.exe 1428 9736.exe 768 iexplore.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe9736.exepid process 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 1428 9736.exe 1428 9736.exe 1428 9736.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 768 iexplore.exe 768 iexplore.exe 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe9736.exeiexplore.exedescription pid process target process PID 1228 wrote to memory of 1428 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 9736.exe PID 1228 wrote to memory of 1428 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 9736.exe PID 1228 wrote to memory of 1428 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 9736.exe PID 1228 wrote to memory of 1428 1228 eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe 9736.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 1428 wrote to memory of 332 1428 9736.exe WerFault.exe PID 768 wrote to memory of 1692 768 iexplore.exe IEXPLORE.EXE PID 768 wrote to memory of 1692 768 iexplore.exe IEXPLORE.EXE PID 768 wrote to memory of 1692 768 iexplore.exe IEXPLORE.EXE PID 768 wrote to memory of 1692 768 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe"C:\Users\Admin\AppData\Local\Temp\eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\9736.exe"C:\Users\Admin\AppData\Roaming\9736.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\SysWOW64\WerFault.exe"3⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=WerFault.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.04⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\rFilesize
1KB
MD58db5d85d4e4fdd5502d657ac2f777304
SHA1c0e5a0782cf843aa2e82c36a1df367d8ea5c03d4
SHA256af005b46e08dddc9820363673bc425500f5ed7ab5c30f26f3ce273b8f9971f5c
SHA512acc00a26d8177723fe8c8caf413e88d72c446d9a56d459b8748102a90cbfb1a56e9df9c2d7db40eb5b6d4888ec9519e7af715d23644d99ceb33fd0c8081835ff
-
C:\Users\Admin\AppData\Local\Temp\rrFilesize
496KB
MD593ed2434324660e891edd06cf238731f
SHA1f7790a13ee6abbc1a06b811a5ed242e80094daec
SHA256fa2601aa41afbde218085ce6ebc685aa994f44031369ee0fbc0346241bc3cc8c
SHA512514fcc6327affd7c772a1b3703b5c8b0c401bbe26eb78ee0fd0ddaaf8ec37d79568b6d081851758f0aabc9485d50fae44b7f5976b7690e4944ec54f01e9ab4ea
-
C:\Users\Admin\AppData\Roaming\9736.exeFilesize
1.3MB
MD5e969721bbcbbaecaf72ab2bc214cb9c1
SHA150fb570b74d03bc5ac25c8b4972249360fac711a
SHA256eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1
SHA51264f06ffa75d3d908e15bca45b7cbb08f40e9172fb830119cc9686220a17c2b362189c96f1308f126799b0083ad9d39212da232169480c368d848913df3e7e9f7
-
C:\Users\Admin\AppData\Roaming\9736.exeFilesize
1.3MB
MD5e969721bbcbbaecaf72ab2bc214cb9c1
SHA150fb570b74d03bc5ac25c8b4972249360fac711a
SHA256eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1
SHA51264f06ffa75d3d908e15bca45b7cbb08f40e9172fb830119cc9686220a17c2b362189c96f1308f126799b0083ad9d39212da232169480c368d848913df3e7e9f7
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PNDN4XTB.txtFilesize
603B
MD5514a4ea1c85252fd62ae0ec6a1aa47c1
SHA159634d501ac63119b3c8da5d8761902e623f4573
SHA256f9b36e8c8731e1f9af15c1ccc5f3e5b9c57ba767bc63e873d72865f0baa2f74c
SHA5126ca9bc04ef75903d0929a3f2f45a318fa90cd59c1ef7ba3f4b40bbcdf9612441315835f2fa100209916ecae861e5be91960e81860a7a68dd87b5afa2ef1c441d
-
\Users\Admin\AppData\Roaming\9736.exeFilesize
1.3MB
MD5e969721bbcbbaecaf72ab2bc214cb9c1
SHA150fb570b74d03bc5ac25c8b4972249360fac711a
SHA256eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1
SHA51264f06ffa75d3d908e15bca45b7cbb08f40e9172fb830119cc9686220a17c2b362189c96f1308f126799b0083ad9d39212da232169480c368d848913df3e7e9f7
-
\Users\Admin\AppData\Roaming\9736.exeFilesize
1.3MB
MD5e969721bbcbbaecaf72ab2bc214cb9c1
SHA150fb570b74d03bc5ac25c8b4972249360fac711a
SHA256eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1
SHA51264f06ffa75d3d908e15bca45b7cbb08f40e9172fb830119cc9686220a17c2b362189c96f1308f126799b0083ad9d39212da232169480c368d848913df3e7e9f7
-
\Users\Admin\AppData\Roaming\9736.exeFilesize
1.3MB
MD5e969721bbcbbaecaf72ab2bc214cb9c1
SHA150fb570b74d03bc5ac25c8b4972249360fac711a
SHA256eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1
SHA51264f06ffa75d3d908e15bca45b7cbb08f40e9172fb830119cc9686220a17c2b362189c96f1308f126799b0083ad9d39212da232169480c368d848913df3e7e9f7
-
\Users\Admin\AppData\Roaming\9736.exeFilesize
1.3MB
MD5e969721bbcbbaecaf72ab2bc214cb9c1
SHA150fb570b74d03bc5ac25c8b4972249360fac711a
SHA256eed34df5ae4ba41952148c118e306bc522dd3248a8f288e7d0eacd32d61911b1
SHA51264f06ffa75d3d908e15bca45b7cbb08f40e9172fb830119cc9686220a17c2b362189c96f1308f126799b0083ad9d39212da232169480c368d848913df3e7e9f7
-
memory/332-65-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/332-66-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/332-68-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/332-69-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/332-70-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/332-71-0x0000000000479FFE-mapping.dmp
-
memory/1228-54-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/1428-59-0x0000000000000000-mapping.dmp