Analysis
-
max time kernel
179s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:05
Behavioral task
behavioral1
Sample
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe
Resource
win10v2004-20220812-en
General
-
Target
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe
-
Size
1.8MB
-
MD5
78441f991293b8d65f3b68bc1539d582
-
SHA1
8ce1e5dfff6cb3e003bab58319cde8de8c720469
-
SHA256
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c
-
SHA512
156a47740901b1df797684a5575d2a1806cd9acacfc92105bbf5db887d4402052f1a5728937e45bd4bb78a240fc749e60b820b6e349ce1b64c42a62e2f0b44e5
-
SSDEEP
49152:oTomOgdQjNHREmE7A9D5l8O1U96I89WiG:oTCpumEOtxg6IUWi
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/5072-132-0x0000000000400000-0x00000000008F3000-memory.dmp vmprotect behavioral2/memory/5072-133-0x0000000000400000-0x00000000008F3000-memory.dmp vmprotect behavioral2/memory/5072-135-0x0000000000400000-0x00000000008F3000-memory.dmp vmprotect behavioral2/memory/5072-136-0x0000000000400000-0x00000000008F3000-memory.dmp vmprotect behavioral2/memory/5072-137-0x0000000000400000-0x00000000008F3000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000463ac3045c11f147ad8f273570aa680a00000000020000000000106600000001000020000000969ddccf3155250ecd95a31ab289b2ecf31239a5c909ef6d26eda661c2b835b9000000000e8000000002000020000000994acf4c479433807f29f67f878368bcaec26a47663e261f27e1b9b0cd30e00920000000edda7e7ce5e5c53335dcc4495e59de7bd9de12dc83b11fb3a7aa559506f352a940000000320a2b51c000e6328d1cd1529b5820100d87ac65782cf5b1c3f628c1a9bc6d2359a255004feba241c2371312cba0247f15bbdc2b1a5a355eb31593f4dcfc2b7c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000463ac3045c11f147ad8f273570aa680a000000000200000000001066000000010000200000009f19f38a2f89470bcc1386f760b655b12d94d22d437ca23ee93bd9d3238ff1ea000000000e8000000002000020000000f7508a994a2ebb3a1cc5c0192f35d8985a5a8fddc4e15d18b9a6c1c6370fb80e20000000162cf61847d5417015a497b161329b9f7c56a930bca3b52404d964d273885ddb400000002b048218e2d2f4c08a178207fa260a04795214275ebda21879726dbe49fc250430ebbe3a42a7c5675fe2546d7a99dcd12a27e6930f13c583d488f9b029dc820e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CB3E7DCF-70B4-11ED-B696-DEF0885D2AEB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.5923wg.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\jp.aliyuncdnjs.com\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.5923wg.com\ = "63" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999745" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999745" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\5923wg.com\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402d4fc5c104d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\5923wg.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\5923wg.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2690152601" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliyuncdnjs.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\jp.aliyuncdnjs.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376580716" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2690152601" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305ffcbec104d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\5923wg.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliyuncdnjs.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\aliyuncdnjs.com\Total = "63" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exepid process 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exedescription pid process Token: SeDebugPrivilege 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3444 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exeiexplore.exeIEXPLORE.EXEpid process 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe 3444 iexplore.exe 3444 iexplore.exe 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE 1680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exeiexplore.exedescription pid process target process PID 5072 wrote to memory of 3444 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe iexplore.exe PID 5072 wrote to memory of 3444 5072 6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe iexplore.exe PID 3444 wrote to memory of 1680 3444 iexplore.exe IEXPLORE.EXE PID 3444 wrote to memory of 1680 3444 iexplore.exe IEXPLORE.EXE PID 3444 wrote to memory of 1680 3444 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe"C:\Users\Admin\AppData\Local\Temp\6e319dc10f3b79842c936c8bfc66a3c8b3db17c950186af569429c445ea6db6c.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" www.5923wg.com2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3444 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5072-132-0x0000000000400000-0x00000000008F3000-memory.dmpFilesize
4.9MB
-
memory/5072-133-0x0000000000400000-0x00000000008F3000-memory.dmpFilesize
4.9MB
-
memory/5072-135-0x0000000000400000-0x00000000008F3000-memory.dmpFilesize
4.9MB
-
memory/5072-136-0x0000000000400000-0x00000000008F3000-memory.dmpFilesize
4.9MB
-
memory/5072-137-0x0000000000400000-0x00000000008F3000-memory.dmpFilesize
4.9MB