Analysis
-
max time kernel
164s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 17:29
Behavioral task
behavioral1
Sample
84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe
Resource
win7-20220812-en
General
-
Target
84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe
-
Size
144KB
-
MD5
c9d8a1567baec7320f844d6415560ae5
-
SHA1
9adf3ba3b223a7c2ed10b68b7df74b150137b400
-
SHA256
84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689
-
SHA512
f7b93cbd8694f0536a3b45c4f9164543ca5e3f178aa3281e5470f4ce9809fcb2a8aa6df1118f1e6d70f7172b38fe4226dfd4d68f35ff17fc07a6599aba44d9d7
-
SSDEEP
3072:bltrbkFEEqOWYnLdLfD/g5fVVqZZ5lYkj:bvwFEEqPYnLtf74DqZ+0
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
texturecomment.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat texturecomment.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
texturecomment.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecisionTime = 00578cdc7706d901 texturecomment.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecision = "0" texturecomment.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 texturecomment.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76\WpadDecisionReason = "1" texturecomment.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" texturecomment.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 texturecomment.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB} texturecomment.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecisionReason = "1" texturecomment.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadNetworkName = "Network 2" texturecomment.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" texturecomment.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" texturecomment.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-78-89-91-5a-76 texturecomment.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\42-78-89-91-5a-76 texturecomment.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections texturecomment.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad texturecomment.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings texturecomment.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 texturecomment.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecisionTime = 00578cdc7706d901 texturecomment.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{96334BC0-FAB4-40B7-95DA-51260C8C16EB}\WpadDecision = "0" texturecomment.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings texturecomment.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix texturecomment.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
texturecomment.exepid process 1344 texturecomment.exe 1344 texturecomment.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exepid process 1900 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exetexturecomment.exetexturecomment.exepid process 1940 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe 1900 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe 864 texturecomment.exe 1344 texturecomment.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exetexturecomment.exedescription pid process target process PID 1940 wrote to memory of 1900 1940 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe PID 1940 wrote to memory of 1900 1940 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe PID 1940 wrote to memory of 1900 1940 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe PID 1940 wrote to memory of 1900 1940 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe 84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe PID 864 wrote to memory of 1344 864 texturecomment.exe texturecomment.exe PID 864 wrote to memory of 1344 864 texturecomment.exe texturecomment.exe PID 864 wrote to memory of 1344 864 texturecomment.exe texturecomment.exe PID 864 wrote to memory of 1344 864 texturecomment.exe texturecomment.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe"C:\Users\Admin\AppData\Local\Temp\84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\84591c3c2509d1a20f9a528545f4ad25b6a647618ea71f5dd79617e157040689.exe--8e2abc7a2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\texturecomment.exe"C:\Windows\SysWOW64\texturecomment.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\texturecomment.exe--333f72f62⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1344-62-0x0000000000000000-mapping.dmp
-
memory/1344-65-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1900-55-0x0000000000000000-mapping.dmp
-
memory/1900-59-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1900-60-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1900-64-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1940-54-0x0000000076181000-0x0000000076183000-memory.dmpFilesize
8KB
-
memory/1940-56-0x0000000000230000-0x0000000000241000-memory.dmpFilesize
68KB
-
memory/1940-58-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB