Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 15:45
Behavioral task
behavioral1
Sample
b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe
Resource
win7-20220901-en
General
-
Target
b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe
-
Size
200KB
-
MD5
302b61562fd258c88ab0db3ffa640faf
-
SHA1
bf6d895f57b8f18d5b2a0f6ca969c93b142fbce5
-
SHA256
b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594
-
SHA512
71f9e1b27653fa8af02e9846691014ccf8676b07679b4555a09dbf2e9e347027f0d186ec96c80a26abc252d74cec8ef43cfbc1b684c8edf003dcc79cadb58fe0
-
SSDEEP
3072:GNkhoRdoQbxSTcbrh82bQZfR3pKHJLbSvGft0WtPwpIC:GNgo3oInbQZp5MJLbSvGfh0
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
avatarshader.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat avatarshader.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
avatarshader.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings avatarshader.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix avatarshader.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings avatarshader.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 avatarshader.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05B2C8E8-7666-415E-96A5-AD7D4C1D4CE0}\WpadDecisionReason = "1" avatarshader.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-eb-13-bf-fe-a4 avatarshader.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-eb-13-bf-fe-a4\WpadDecisionReason = "1" avatarshader.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections avatarshader.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 avatarshader.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05B2C8E8-7666-415E-96A5-AD7D4C1D4CE0}\WpadDecisionTime = a0afcc005706d901 avatarshader.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05B2C8E8-7666-415E-96A5-AD7D4C1D4CE0}\WpadNetworkName = "Network 2" avatarshader.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" avatarshader.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 avatarshader.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05B2C8E8-7666-415E-96A5-AD7D4C1D4CE0}\5a-eb-13-bf-fe-a4 avatarshader.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" avatarshader.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" avatarshader.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad avatarshader.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05B2C8E8-7666-415E-96A5-AD7D4C1D4CE0} avatarshader.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{05B2C8E8-7666-415E-96A5-AD7D4C1D4CE0}\WpadDecision = "0" avatarshader.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-eb-13-bf-fe-a4\WpadDecisionTime = a0afcc005706d901 avatarshader.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-eb-13-bf-fe-a4\WpadDecision = "0" avatarshader.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
avatarshader.exepid process 588 avatarshader.exe 588 avatarshader.exe 588 avatarshader.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exepid process 1996 b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exeb6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exeavatarshader.exeavatarshader.exepid process 1168 b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe 1996 b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe 1488 avatarshader.exe 588 avatarshader.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exeavatarshader.exedescription pid process target process PID 1168 wrote to memory of 1996 1168 b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe PID 1168 wrote to memory of 1996 1168 b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe PID 1168 wrote to memory of 1996 1168 b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe PID 1168 wrote to memory of 1996 1168 b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe PID 1488 wrote to memory of 588 1488 avatarshader.exe avatarshader.exe PID 1488 wrote to memory of 588 1488 avatarshader.exe avatarshader.exe PID 1488 wrote to memory of 588 1488 avatarshader.exe avatarshader.exe PID 1488 wrote to memory of 588 1488 avatarshader.exe avatarshader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe"C:\Users\Admin\AppData\Local\Temp\b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b6a03ef6505f465c895d0887c0479db9e2cdf7d391123a14c03b1af7dcb69594.exe--41c2bf6d2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\avatarshader.exe"C:\Windows\SysWOW64\avatarshader.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\avatarshader.exe--ee7ec2d02⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-60-0x0000000000000000-mapping.dmp
-
memory/588-62-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/588-64-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1168-55-0x00000000002B0000-0x00000000002CB000-memory.dmpFilesize
108KB
-
memory/1168-56-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1996-54-0x0000000000000000-mapping.dmp
-
memory/1996-57-0x00000000003A0000-0x00000000003BB000-memory.dmpFilesize
108KB
-
memory/1996-58-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1996-59-0x00000000760E1000-0x00000000760E3000-memory.dmpFilesize
8KB
-
memory/1996-61-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB