Analysis
-
max time kernel
188s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 18:33
Static task
static1
Behavioral task
behavioral1
Sample
1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe
Resource
win7-20221111-en
General
-
Target
1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe
-
Size
279KB
-
MD5
2838dbfc712c09e9797dafb02e1a7f3f
-
SHA1
4107eb23bca94f3adfe6c5ddefcf83b12a4312e8
-
SHA256
1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8
-
SHA512
45af689b9c2881ba67e98551acf62c1c1b9920580e0cb5f4805a9c6a4c0aafa74c0d247c21a0349992684307a362a0f4db251e3f82adb22595aebdbe2acc8b35
-
SSDEEP
6144:jKkCmx7H9i7+iFINAS+S/9M4Fea4qZAU0rZpX6:dCmx7Hg7+vW4o2AU0rZV6
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
ielliell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ielliell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
ielliell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ielliell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9CFCECE3-63FE-4415-A91E-3DD7FEEA2DF4} ielliell.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9CFCECE3-63FE-4415-A91E-3DD7FEEA2DF4}\WpadDecision = "0" ielliell.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-06-10-b6-50-57\WpadDecisionReason = "1" ielliell.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-06-10-b6-50-57\WpadDecision = "0" ielliell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-06-10-b6-50-57 ielliell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9CFCECE3-63FE-4415-A91E-3DD7FEEA2DF4}\92-06-10-b6-50-57 ielliell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ielliell.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ielliell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ielliell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ielliell.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9CFCECE3-63FE-4415-A91E-3DD7FEEA2DF4}\WpadDecisionReason = "1" ielliell.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ielliell.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ielliell.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ielliell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ielliell.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9CFCECE3-63FE-4415-A91E-3DD7FEEA2DF4}\WpadNetworkName = "Network 2" ielliell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ielliell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ielliell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9CFCECE3-63FE-4415-A91E-3DD7FEEA2DF4}\WpadDecisionTime = c0e367438406d901 ielliell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\92-06-10-b6-50-57\WpadDecisionTime = c0e367438406d901 ielliell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ielliell.exepid process 1004 ielliell.exe 1004 ielliell.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exepid process 560 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exeielliell.exeielliell.exepid process 1744 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe 560 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe 1880 ielliell.exe 1004 ielliell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exeielliell.exedescription pid process target process PID 1744 wrote to memory of 560 1744 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe PID 1744 wrote to memory of 560 1744 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe PID 1744 wrote to memory of 560 1744 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe PID 1744 wrote to memory of 560 1744 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe 1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe PID 1880 wrote to memory of 1004 1880 ielliell.exe ielliell.exe PID 1880 wrote to memory of 1004 1880 ielliell.exe ielliell.exe PID 1880 wrote to memory of 1004 1880 ielliell.exe ielliell.exe PID 1880 wrote to memory of 1004 1880 ielliell.exe ielliell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe"C:\Users\Admin\AppData\Local\Temp\1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\1febf4ebc138dd01f1a4e9e302ffaeb5207f8a3e7de9e790a8755b5d125d67b8.exe--704c6c782⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
PID:560
-
C:\Windows\SysWOW64\ielliell.exe"C:\Windows\SysWOW64\ielliell.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\ielliell.exe--83a44c8a2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:1004
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-55-0x0000000000000000-mapping.dmp
-
memory/560-58-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/560-59-0x0000000075A31000-0x0000000075A33000-memory.dmpFilesize
8KB
-
memory/560-60-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/560-62-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1004-61-0x0000000000000000-mapping.dmp
-
memory/1004-63-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/1744-54-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1744-56-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1744-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB