Analysis
-
max time kernel
112s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30/11/2022, 23:17
Static task
static1
Behavioral task
behavioral1
Sample
afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe
Resource
win10v2004-20220812-en
General
-
Target
afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe
-
Size
1.1MB
-
MD5
4da6e26bbbe545550d7b875f5ca146a2
-
SHA1
51d5aab16ce7cbf8657f2d99e65e8a8b5e398ef3
-
SHA256
afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9
-
SHA512
3e1b6b55c63925e8fe5281c4a864145755289f32c7f1eafe2b19b8d9b6fbc39a8eb9f7841de0b21516cd06ea67542a19f5cb862985a36875c2868af39a21aded
-
SSDEEP
24576:bltjeKzlZUteRO8TCHXO1cF1+eLLJGmpAJn9dsfh3+6kbeOdV6UB:OoZIeRoHXh9LdyJrsd+6kbeOdxB
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73826051-72A2-11ED-B243-5AF036119C64} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0b54cbd918e0247a41ea5a716aab2c4000000000200000000001066000000010000200000006f81ae6f4281c27a7fc2dbbeb4e97d4230b543121124845c73103e59fe848ebc000000000e80000000020000200000001ab447f2f214fb349a5651d105ec2da21bd321ff3fba988836c4551ace1fa453200000007e1baf4d374298a8adbe4447322a2fcb360a87267b968b7e3d9275987201832240000000db0bac5fb0a954994a8070d082cd844f1efc6a49e86200dacaa3111ac86486e1159e7e0b83cc5a046bc4cb57e4c3cc4269c9e50414a2aaa793d9f05740ae4763 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0b54cbd918e0247a41ea5a716aab2c40000000002000000000010660000000100002000000095728dab8c4bff1f9f3bf64f503ce0ce5fc12514a18d1836ebe4b9beb939ef46000000000e800000000200002000000019d4ce3f8531611897604771cae0d84638adab98f5ee974a28a4e3982e1533539000000003d1f74631b99bb7dc90b4e68fc2499c1e6f7cf20ae7dac6d8c89aa8fa8dbfb145909d643f39e30a0de6b7fb2237f0e273915f568ff3b89b856a7292f53a139150d4a4cd10c94c367eac71f1d94620bcbe9f4fbc65d4fe108ec29c71acb089c58ad0646b3b95e5822a39888b495f57a5c0aaf8605eaeb915b8d2e3866b272fe03e165153336eae4320dab3f13eedc10a400000009eb2ca163e97f00d2f39572b46a710ead96e09dfc8d295fb28012bad63a92754fd981997fd73a71bab006a869e2db1a48ef75dcdac55c95fea009e83d0e589a2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9002014faf06d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376792732" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 472 Process not Found 472 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1304 AUDIODG.EXE Token: 33 1304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1304 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1520 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2012 afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe 2012 afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe 2012 afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe 2012 afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe 1520 iexplore.exe 1520 iexplore.exe 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1520 2012 afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe 30 PID 2012 wrote to memory of 1520 2012 afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe 30 PID 2012 wrote to memory of 1520 2012 afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe 30 PID 2012 wrote to memory of 1520 2012 afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe 30 PID 1520 wrote to memory of 1952 1520 iexplore.exe 31 PID 1520 wrote to memory of 1952 1520 iexplore.exe 31 PID 1520 wrote to memory of 1952 1520 iexplore.exe 31 PID 1520 wrote to memory of 1952 1520 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe"C:\Users\Admin\AppData\Local\Temp\afd3026992f1cb4e0ce5f65eed7f073aaa459d421ee0fff380545e52cd8a06e9.exe"1⤵
- Checks BIOS information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.fcgg.info/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1952
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5301⤵
- Suspicious use of AdjustPrivilegeToken
PID:1304
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539B
MD5f2fe105b5b0b4b2193dff54085ca3d90
SHA174171a6689f9510604fbe217545f97611c8f9994
SHA25602a39575c8a13813f78037a99573861e466c044848c21e886c9e36fff82c9ec7
SHA5126222d71fb1ffa8a7320d1a6705213a3afb859d92662fbf844c594ed56d8fe2fbb3ad47fa01d3d52faba82058854ebf08fa6a3f895078acf2a176f045a64bea70