Analysis
-
max time kernel
106s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 19:31
Static task
static1
Behavioral task
behavioral1
Sample
0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe
Resource
win10v2004-20220812-en
General
-
Target
0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe
-
Size
1.4MB
-
MD5
01fd884a92da62e9796257b889594709
-
SHA1
5c92e5d3d80c587a8db443947d79d327f44aa437
-
SHA256
0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a
-
SHA512
c1de8e07da62a813912a04bb9bf23f3abaeb7c3bfb095d3a57ae70c59853ae6911d564fca861a677fe200708c47aaaea4fd58453bb1cf05817d37c11e6abf889
-
SSDEEP
24576:Ab/JZbr1coVWDAc/HTvMsaFnLKBkwDJBR99RZ+yUDTVrhD85Oe4:a/JZbJIcLKBbJRZ+ZTVd85A
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exedescription pid process target process PID 1280 set thread context of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b79446bdab3c44e91660dacddfeb5d800000000020000000000106600000001000020000000d26e4b8a5c4897ea83d850b71d553d8fb72aa2941b9231cc8f65a178ad14f315000000000e8000000002000020000000b2e87352cc1dc661750d43d0c7462eb761c52591984d9a7704f6c694ba23372f200000002112d8528eb06be331e1557094cc66026b0075db02828499a4b4b5ae295a8c624000000023fd6aedddca614b0e1c7f128eb6b647a8389ecf9827b4d4bc16d31688f1d72d97a89f4015a91f83c578ea44583259c67a47a825218f101068e9cb602ba4ea42 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80247a558706d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376775564" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b79446bdab3c44e91660dacddfeb5d80000000002000000000010660000000100002000000023f8f990fa5c5c3e4548b101f802b5c1a1f23c252560ca5b33920d84d9dd41b6000000000e80000000020000200000000f71c07618d2d478b74b1bef36372dee03995a05367bd628aa5b36eda64c88969000000091c224d90244a248bc44b561e4a2974bbab626d2cfc0d3dd407802e79dc935a0558a95ac78a428767d58756bbff9bc42aaf125d1419b70a81fb5103cb7ccbf7ebcba3533bea01f08e7ed638bca5ae119c310f2c03d5c9617d162453effc3d8bc475daa85db1cb5a82f5f80d294d9c7a836e9cac896ed34f1379e0627988ad8f5bbb858dc3cb4b7c0da1851b7e99e6d72400000009e1e65e35113ecb812d389378a7a39ba9c58b180366497eaa35a9baeea2cbb674382d49571cc7b55ba4ccf98558c91846df5df397f10fa06f37d6bf393580ec0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B13F721-727A-11ED-AA9B-EE0F1DD48A27} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exeiexplore.exeIEXPLORE.EXEpid process 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 1664 iexplore.exe 1664 iexplore.exe 1104 IEXPLORE.EXE 1104 IEXPLORE.EXE 1104 IEXPLORE.EXE 1104 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exeiexplore.exedescription pid process target process PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 1280 wrote to memory of 2044 1280 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe PID 2044 wrote to memory of 1664 2044 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe iexplore.exe PID 2044 wrote to memory of 1664 2044 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe iexplore.exe PID 2044 wrote to memory of 1664 2044 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe iexplore.exe PID 2044 wrote to memory of 1664 2044 0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe iexplore.exe PID 1664 wrote to memory of 1104 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 1104 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 1104 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 1104 1664 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe"C:\Users\Admin\AppData\Local\Temp\0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe"C:\Users\Admin\AppData\Local\Temp\0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=0a71d1bf605fb50be57e5b76b7914d0b158c618e6a42c1c571cafe489fdde16a.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.03⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I85KP1CO.txtFilesize
531B
MD58b2171d9364222b3778ce98ab7f430fd
SHA1e2e1653683c51a55b48f992a8688f963ad6d4622
SHA2569f995ef09737e31fed30797317e23e02731d540ec16e214a65a367eb17488ac3
SHA5121cc0cbc6c3180728072b342ee834da28c46cfeccfd4a9005a2fc6b44aa29e9ef5f9ad28a9d5e4769aacdb87d7d0024283d959da29c987882419eb6a1a7673347
-
memory/1280-54-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/2044-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2044-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2044-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2044-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2044-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/2044-64-0x000000000040C4FE-mapping.dmp
-
memory/2044-66-0x0000000000402000-0x000000000040C600-memory.dmpFilesize
41KB