Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 19:21
Static task
static1
Behavioral task
behavioral1
Sample
01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe
Resource
win7-20220901-en
General
-
Target
01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe
-
Size
122KB
-
MD5
699e79f6240a9edb393841bbff83e939
-
SHA1
2a0f31420c92fd5b603db742a332d9b916e74d45
-
SHA256
01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28
-
SHA512
67b66843d3006e46e9a90a84b89cdd6ca17944136b4b9881c504ff79c523e73cc7dfa43268e75bb34637aaafc56a4a24366a6a1054617b4a172a0cdf53ee0b1b
-
SSDEEP
3072:Xpe0SFTgkJNr/LJHD06mYG46MA5df+BC3K5eqyI:X80igkJJ/V06mR4P0K7yI
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
keytargets.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat keytargets.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
keytargets.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections keytargets.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix keytargets.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-92-1c-a1-fc-9f\WpadDecisionReason = "1" keytargets.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F2DE04-C2DB-4C84-945D-639AD30F9C67}\WpadDecisionTime = 705cad9b8106d901 keytargets.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F2DE04-C2DB-4C84-945D-639AD30F9C67}\WpadNetworkName = "Network 2" keytargets.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-92-1c-a1-fc-9f\WpadDecision = "0" keytargets.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings keytargets.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" keytargets.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 keytargets.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F2DE04-C2DB-4C84-945D-639AD30F9C67} keytargets.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad keytargets.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0013000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 keytargets.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F2DE04-C2DB-4C84-945D-639AD30F9C67}\WpadDecisionReason = "1" keytargets.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F2DE04-C2DB-4C84-945D-639AD30F9C67}\WpadDecision = "0" keytargets.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 keytargets.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" keytargets.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings keytargets.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" keytargets.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-92-1c-a1-fc-9f keytargets.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E8F2DE04-C2DB-4C84-945D-639AD30F9C67}\8e-92-1c-a1-fc-9f keytargets.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-92-1c-a1-fc-9f\WpadDecisionTime = 705cad9b8106d901 keytargets.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
keytargets.exepid process 580 keytargets.exe 580 keytargets.exe 580 keytargets.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exepid process 2040 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exekeytargets.exekeytargets.exepid process 1184 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe 2040 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe 784 keytargets.exe 580 keytargets.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exekeytargets.exedescription pid process target process PID 1184 wrote to memory of 2040 1184 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe PID 1184 wrote to memory of 2040 1184 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe PID 1184 wrote to memory of 2040 1184 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe PID 1184 wrote to memory of 2040 1184 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe 01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe PID 784 wrote to memory of 580 784 keytargets.exe keytargets.exe PID 784 wrote to memory of 580 784 keytargets.exe keytargets.exe PID 784 wrote to memory of 580 784 keytargets.exe keytargets.exe PID 784 wrote to memory of 580 784 keytargets.exe keytargets.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe"C:\Users\Admin\AppData\Local\Temp\01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01613e4009813b9c524e3a1c4b14ba35a5e1b382d0de721d0c627d9a20c4af28.exe--6c43f3cd2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\keytargets.exe"C:\Windows\SysWOW64\keytargets.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\keytargets.exe--de02f3952⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-60-0x0000000000000000-mapping.dmp
-
memory/580-62-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/580-64-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1184-54-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1184-56-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1184-57-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2040-55-0x0000000000000000-mapping.dmp
-
memory/2040-58-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2040-59-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/2040-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB