Analysis
-
max time kernel
131s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:23
Static task
static1
Behavioral task
behavioral1
Sample
2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe
Resource
win7-20220812-en
General
-
Target
2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe
-
Size
220KB
-
MD5
66af1323084d8a85acfed88938411a66
-
SHA1
d7d36e66333b281bf870dedb54fa4061013b190c
-
SHA256
2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb
-
SHA512
aeb6c03a388e84bfe63c63b13837c8902e780cfcd56aed8bb63aff6c40122f4b48081c6a4400977ca46b6ab3220afcc98e1448b5229ebf4134e0610c3c5b72b7
-
SSDEEP
3072:V5X8Hk2GgrQCz+VGUbqPM902yHydVi0Cy3pCdu6IqVZFBF:jX8E29z+VGUQM9UHQLCy3pCddh5
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
basedstarted.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat basedstarted.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
basedstarted.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\WpadDecisionReason = "1" basedstarted.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections basedstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 basedstarted.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" basedstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" basedstarted.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad basedstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 basedstarted.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix basedstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 basedstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\WpadDecisionTime = b00e52818206d901 basedstarted.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\WpadNetworkName = "Network 2" basedstarted.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" basedstarted.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings basedstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\WpadDecision = "0" basedstarted.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509}\ce-d9-9d-36-8c-9f basedstarted.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-d9-9d-36-8c-9f\WpadDecisionTime = b00e52818206d901 basedstarted.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings basedstarted.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{927785FF-6FDD-4EA2-A504-67A742DAD509} basedstarted.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-d9-9d-36-8c-9f basedstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-d9-9d-36-8c-9f\WpadDecisionReason = "1" basedstarted.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ce-d9-9d-36-8c-9f\WpadDecision = "0" basedstarted.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exebasedstarted.exebasedstarted.exepid process 1000 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe 1668 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe 1648 basedstarted.exe 1740 basedstarted.exe 1740 basedstarted.exe 1740 basedstarted.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exepid process 1668 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exebasedstarted.exebasedstarted.exepid process 1000 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe 1668 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe 1648 basedstarted.exe 1740 basedstarted.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exebasedstarted.exedescription pid process target process PID 1000 wrote to memory of 1668 1000 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe PID 1000 wrote to memory of 1668 1000 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe PID 1000 wrote to memory of 1668 1000 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe PID 1000 wrote to memory of 1668 1000 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe 2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe PID 1648 wrote to memory of 1740 1648 basedstarted.exe basedstarted.exe PID 1648 wrote to memory of 1740 1648 basedstarted.exe basedstarted.exe PID 1648 wrote to memory of 1740 1648 basedstarted.exe basedstarted.exe PID 1648 wrote to memory of 1740 1648 basedstarted.exe basedstarted.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe"C:\Users\Admin\AppData\Local\Temp\2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe"C:\Users\Admin\AppData\Local\Temp\2d377b9e72ef2f1984a219e44a6b79066d9b66dfaa3e645c17b09119efab85cb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\basedstarted.exe"C:\Windows\SysWOW64\basedstarted.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\basedstarted.exe"C:\Windows\SysWOW64\basedstarted.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1000-54-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB
-
memory/1000-57-0x0000000000220000-0x0000000000235000-memory.dmpFilesize
84KB
-
memory/1000-58-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1000-60-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1648-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1668-55-0x0000000000000000-mapping.dmp
-
memory/1668-59-0x00000000001B0000-0x00000000001C5000-memory.dmpFilesize
84KB
-
memory/1668-66-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/1740-62-0x0000000000000000-mapping.dmp
-
memory/1740-65-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB