Analysis
-
max time kernel
117s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 17:24
Behavioral task
behavioral1
Sample
4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe
Resource
win10v2004-20220812-en
General
-
Target
4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe
-
Size
474KB
-
MD5
d7cc8c751cc1258c35f06d9815dffa77
-
SHA1
0dcb9dfa6abe02172ef6fadf24be365d99507238
-
SHA256
4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6
-
SHA512
5faf10919aae0614d13a7c3ae993cb3f1b1bb4a6d8f703866c32123ac283e997b4f8bd959b47015c5c1729d65c5d6278a56ac1f63c5b4df35469e04e72230b6b
-
SSDEEP
1536:+ClDA7EOw+76us77QomZ05cVEGbTu57PMK042FbXgFJDhhsK7hMt7d3zTNNn9kOj:+Tqw6u0coW0WVoZSjABhmdDTnA8
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1488-56-0x0000000000400000-0x000000000040A000-memory.dmp upx behavioral1/memory/1488-67-0x0000000000400000-0x000000000040A000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exedescription pid process target process PID 1488 set thread context of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8238ea1dad50c4ca4bd07a36c01b92b00000000020000000000106600000001000020000000c06bdca97c38447e0b3472019acf63fb045a64c50d2782445298d2a54e0b3200000000000e800000000200002000000061cef451f3d3d94b72621afe76cc96b0051e24f3246157ce377e618911c53529200000004a6c9b9559f06daf75be7eeaa0fb24db6b2f592b21b3e816402aa55a1f278f99400000003d7cca0df8049148a8cb996f57d9aed37e5619abe5f630922acffeea6bacbd4a751c68e6dc250866f5d15a42530612e5d62f1dfd57b81dc764111f9d3fbeec96 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D9E789B1-7266-11ED-8C25-6AB3F8C7EA51} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376767142" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105806bf7306d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8238ea1dad50c4ca4bd07a36c01b92b000000000200000000001066000000010000200000005a4f58fbda11deca826e4a1bb6f50787a301f4986ba18101a1115962977c0fa5000000000e80000000020000200000009c2154c05a539f19574c71de6e00835b48623f06fdcfd15c233065e87f4eb233900000000a428bafed2781c25034fd118f709d0d3c5408b9fca70fd544d9e850833257fd007461486bdb39fc04c29c57fc3d025c2c640dce08eebabaf9ffa71087ddae09c11c3c47357625799645997903b500443b722848eab90101b58c2fd3c05da8e92b6836f7c052bbd9d3d886eba29c818442cac3f78f14a87eacf3fbabbeb9765b919a88ae74ec094ee16c51f5524ad34840000000dfad33d0001ec9fbf56077dde4fbe0c13a25bd0e864ae9f3d9685280551272be29d42ac04edef3cf138ef5de8e622ff4815fc70ce85b6069e6b612d102d4617d iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1548 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exeiexplore.exeIEXPLORE.EXEpid process 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 1548 iexplore.exe 1548 iexplore.exe 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exeiexplore.exedescription pid process target process PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 1488 wrote to memory of 112 1488 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe PID 112 wrote to memory of 1548 112 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe iexplore.exe PID 112 wrote to memory of 1548 112 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe iexplore.exe PID 112 wrote to memory of 1548 112 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe iexplore.exe PID 112 wrote to memory of 1548 112 4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe iexplore.exe PID 1548 wrote to memory of 1448 1548 iexplore.exe IEXPLORE.EXE PID 1548 wrote to memory of 1448 1548 iexplore.exe IEXPLORE.EXE PID 1548 wrote to memory of 1448 1548 iexplore.exe IEXPLORE.EXE PID 1548 wrote to memory of 1448 1548 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe"C:\Users\Admin\AppData\Local\Temp\4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe"C:\Users\Admin\AppData\Local\Temp\4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4417db4bcc2a251ca668f1e5e21f7f68b21b3044286649b0904716c2995fdca6.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\H4QHL81V.txtFilesize
598B
MD53343e30bb683bfe773fc778fe6e219f0
SHA11b5177191e636b63409e97094c34f52dde0a4c9c
SHA2562bc14fb9725bac32c8076822d371dda18e695e9f7ec3faf7dd2b7e99fe6b22fc
SHA512b7e36f873c1fcf18d778715a804c1349b9c83e6309f4d49e508d656aa0912beb7a37c5958beb3f52e3b7b40f3966e7a08a122418689c0eee6db2b6b97cedbd41
-
memory/112-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-58-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-60-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-61-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-62-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/112-63-0x000000000040602E-mapping.dmp
-
memory/112-65-0x0000000000402000-0x0000000000406200-memory.dmpFilesize
16KB
-
memory/112-66-0x0000000000402000-0x0000000000406200-memory.dmpFilesize
16KB
-
memory/112-68-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1488-56-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1488-67-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB