Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 16:05
Behavioral task
behavioral1
Sample
f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe
Resource
win7-20220901-en
General
-
Target
f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe
-
Size
116KB
-
MD5
b1cbc4c609da40c9c11b4bee58570374
-
SHA1
32f8602423719f9cdc86dfb6f173ab1dafbc9568
-
SHA256
f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1
-
SHA512
1d570d694ec0466b70c078d6fcf297754e65eb78bc37d64409ea1fe12cd2eddafc0d6eb509dedd16b03e259c0356249931c7de2543121f45a65de53918fe035b
-
SSDEEP
3072:k8ENSRg5KrR52iOG7jWXlnYNav5KLdIIPst5tKRJ:k8KSRg5KPHOGErRKL6Gga
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
relatedsource.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat relatedsource.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
relatedsource.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections relatedsource.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" relatedsource.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad relatedsource.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\WpadDecisionReason = "1" relatedsource.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\9e-6f-1a-e7-0f-fc relatedsource.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" relatedsource.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 relatedsource.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-6f-1a-e7-0f-fc\WpadDecisionReason = "1" relatedsource.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-6f-1a-e7-0f-fc relatedsource.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-6f-1a-e7-0f-fc\WpadDecisionTime = a04217cb5e06d901 relatedsource.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9e-6f-1a-e7-0f-fc\WpadDecision = "0" relatedsource.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings relatedsource.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix relatedsource.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings relatedsource.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 relatedsource.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\WpadDecision = "0" relatedsource.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 relatedsource.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" relatedsource.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632} relatedsource.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\WpadDecisionTime = a04217cb5e06d901 relatedsource.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8928E753-7159-46AD-9537-4B51D0E3D632}\WpadNetworkName = "Network 2" relatedsource.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
relatedsource.exepid process 592 relatedsource.exe 592 relatedsource.exe 592 relatedsource.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exepid process 1688 f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exef9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exerelatedsource.exerelatedsource.exepid process 1492 f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe 1688 f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe 296 relatedsource.exe 592 relatedsource.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exerelatedsource.exedescription pid process target process PID 1492 wrote to memory of 1688 1492 f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe PID 1492 wrote to memory of 1688 1492 f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe PID 1492 wrote to memory of 1688 1492 f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe PID 1492 wrote to memory of 1688 1492 f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe PID 296 wrote to memory of 592 296 relatedsource.exe relatedsource.exe PID 296 wrote to memory of 592 296 relatedsource.exe relatedsource.exe PID 296 wrote to memory of 592 296 relatedsource.exe relatedsource.exe PID 296 wrote to memory of 592 296 relatedsource.exe relatedsource.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe"C:\Users\Admin\AppData\Local\Temp\f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f9c10519ff6d3a53664fa72218d7e72a80cd9631ff26db0ce1a39fab504f1dd1.exe--76ecdbd12⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\relatedsource.exe"C:\Windows\SysWOW64\relatedsource.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\relatedsource.exe--ea04553c2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-62-0x0000000000000000-mapping.dmp
-
memory/592-65-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1492-55-0x00000000003A0000-0x00000000003B1000-memory.dmpFilesize
68KB
-
memory/1492-57-0x00000000003A0000-0x00000000003B1000-memory.dmpFilesize
68KB
-
memory/1492-59-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1688-56-0x0000000000000000-mapping.dmp
-
memory/1688-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1688-63-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB