Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
Resource
win7-20220812-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe
-
Size
2.0MB
-
MD5
0539d4fcc77c6376c899122568d4d267
-
SHA1
df5bce5cec0ca7e6e5279ff2339391abbf4dac24
-
SHA256
fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523
-
SHA512
70604463311b278618c707d9054e7b1e2511e2dce9ba8de3ebd293c52273c243588c4d293c47c87d10c1c0592da0f918891d5616b10fc52b3b38c3b73445054b
-
SSDEEP
24576:xKtveZAE3WsAv2lmi9az6DtLANew8spKC1c911pHH6wxsi3vYMZJSDzydsMBcwkc:xevMXC8Ip1pps1pnei3Xgssac6
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3468 KINSTALLERS_66_4430.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000a032ffdd299e9439259c16ce4439f2600000000020000000000106600000001000020000000fa11a77007cb83d799ec38c57e11b7418aa32caa6f4256f430a6cb35ab9b5d22000000000e80000000020000200000009451aa0e46bf4470da3db129a6a6060336cea1158f1131e11087faaeb81ac51a200000007ef8096eadfacc0d532b678fcf9e2fbc6aaf7a4b8953eb5fac026c28a933babe4000000091e164ca6f2624e6a1ced674e8d8b02f64d5c512e6dc769e64cfc7a55f9a9627e648c6ad2fe7b7b9e548a6a791872b8726164d4ae38287ad00aed79118be9116 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90152fe52405d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999844" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0BDD2584-7118-11ED-89AC-5EAE84113378} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3767105903" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3767105903" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000a032ffdd299e9439259c16ce4439f2600000000020000000000106600000001000020000000e82f7da6fd86e39dba4c35ef2868902c12c5f34de52d1b7ec69499ea4151628f000000000e800000000200002000000021d5349283ce179f13ef7ab164caaf56e6398169bdae13aaa98f765315bb356120000000fcac7dd929f705d6a0b457b716101e7ab32884615a25a31e98c460706e5b0cf2400000007e46f7203233219cd1f05a959783cd01decd3f960500d2010c1a2a7e9371833c0d301f942a2567f52d6ab8d63077d920555c28bc31dc58701f75199eae93aa04 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d06512e52405d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999844" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376623336" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4360 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 4360 iexplore.exe 4360 iexplore.exe 4040 IEXPLORE.EXE 4040 IEXPLORE.EXE 4040 IEXPLORE.EXE 4040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2820 wrote to memory of 3468 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 78 PID 2820 wrote to memory of 3468 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 78 PID 2820 wrote to memory of 3468 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 78 PID 2820 wrote to memory of 4360 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 79 PID 2820 wrote to memory of 4360 2820 fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe 79 PID 4360 wrote to memory of 4040 4360 iexplore.exe 80 PID 4360 wrote to memory of 4040 4360 iexplore.exe 80 PID 4360 wrote to memory of 4040 4360 iexplore.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe"C:\Users\Admin\AppData\Local\Temp\fcbe81e9231e31d0f2908c678f0524011416e5f6099b9dacf818999c4dff9523.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\KINSTALLERS_66_4430.exe\KINSTALLERS_66_4430.exe2⤵
- Executes dropped EXE
PID:3468
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" www.cfbingyue.com2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4360 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4040
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD51915689cf3a859e46042a10afdf1a0dd
SHA1873ccfc9bf4130a87fb0804cd27dc7eb11fbe4e0
SHA25684cc37ec6849e5634ed80fd1feebc54d7cbf183923a86369dde62a66afa7f259
SHA512fa375057475a05c170eee26516e38f3ef35d22fb649caff25ff4bf000bebb48d6286a6689509a11488d1355d9d7a3d910b40ff182455152bd23726a7dfc899fe
-
Filesize
58KB
MD51915689cf3a859e46042a10afdf1a0dd
SHA1873ccfc9bf4130a87fb0804cd27dc7eb11fbe4e0
SHA25684cc37ec6849e5634ed80fd1feebc54d7cbf183923a86369dde62a66afa7f259
SHA512fa375057475a05c170eee26516e38f3ef35d22fb649caff25ff4bf000bebb48d6286a6689509a11488d1355d9d7a3d910b40ff182455152bd23726a7dfc899fe