4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f

Analysis

max time kernel
131s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe
Size

104KB
MD5

4b3339c4fddb9fbbef399fc19659666c
SHA1

5313e44dcbef2f8913042c37573a7ad77a9f4e71
SHA256

4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f
SHA512

c1a16398c048b9c02fcfd906aba16b2a5da49c5df1ef16ad9009e125b46dada4a2d1002e70415ea94e6b100877e0bb212515eafa86d2268f6b8edd33c8ff1446
SSDEEP

1536:a9XM2K4Y3kK5MNq5cktsVPkRcT5nEYJyuXtg/I/rSLfrsSKPHRPmKJjrz3nYxx:a98xkK5h5xwPDTZrJ/rqzsFjrz3nYxx

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 4 IoCs

Processes:

iproplics.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	iproplics.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	iproplics.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	iproplics.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	iproplics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

iproplics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	iproplics.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iproplics.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	iproplics.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

iproplics.exe

pid	process
2260	iproplics.exe
2260	iproplics.exe
2260	iproplics.exe
2260	iproplics.exe
2260	iproplics.exe
2260	iproplics.exe
2260	iproplics.exe
2260	iproplics.exe
2260	iproplics.exe
2260	iproplics.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe

pid process

4644 4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe

pid	process
4644	4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exeiproplics.exe

description	pid	process	target process
PID 4964 wrote to memory of 4644	4964	4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe	4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe
PID 4964 wrote to memory of 4644	4964	4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe	4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe
PID 4964 wrote to memory of 4644	4964	4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe	4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe
PID 2804 wrote to memory of 2260	2804	iproplics.exe	iproplics.exe
PID 2804 wrote to memory of 2260	2804	iproplics.exe	iproplics.exe
PID 2804 wrote to memory of 2260	2804	iproplics.exe	iproplics.exe

C:\Users\Admin\AppData\Local\Temp\4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe
"C:\Users\Admin\AppData\Local\Temp\4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964

C:\Users\Admin\AppData\Local\Temp\4e363da4b64303394b6980de48849bc3e7010cbe0b3015eb2f95e9737676186f.exe
--a6f587e9
2⤵
- Suspicious behavior: RenamesItself
PID:4644

C:\Windows\SysWOW64\iproplics.exe
"C:\Windows\SysWOW64\iproplics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\SysWOW64\iproplics.exe
--f557b42f
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-141-0x0000000000000000-mapping.dmp

Download
memory/2260-143-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2260-144-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4644-136-0x0000000000000000-mapping.dmp

Download
memory/4644-139-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4644-140-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4644-142-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4964-135-0x00000000005C0000-0x00000000005D1000-memory.dmp

Filesize
68KB

Download
memory/4964-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4964-137-0x00000000005C0000-0x00000000005D1000-memory.dmp

Filesize
68KB

Download