6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788

Analysis

max time kernel
114s
max time network
194s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe
Size

500KB
MD5

eb7963c1046d089525b56ba7531d41f3
SHA1

56a2e1c147f863518565d4ad83ee1b4078e35251
SHA256

6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788
SHA512

bdb4e2140fdb47e2a277727005430638c41ca341fbd887bfd149cbb0b8f94cdeedceb628c46a02d0bfb3d6e371ebade26c4da8b0ecb158f40c9156a54d85b75f
SSDEEP

3072:3UXHF76NAzdG6slPV6v1vbpPaJx+NupzWP8OwtVRAi44g:W7VKAdbpaCjkmiK

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1092	Surprize.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows applicaton = "C:\\Users\\Admin\\AppData\\Roaming\\Surprize.exe"	6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9085f2c1b207d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000d257e09b081c63e20ce13c89d5f86815f9b0266d4fe65a32402cc165fbbea7be000000000e80000000020000200000005316f78ec2fe2cafa3334377e1020bcac87025d5a4c2f425db7226e6752ef95290000000f1b33890a2b94e321cc2c6dd7d70ea7a1f44b960938b0a322685857f1aed262d9e4fad7eff7efad8b8bd6a898065cf88205657c1a48bc83210a5107974077cd2631428c089b9178c449020481f9c47e91c143f9018bb460b49e08ad4a9f91412d4f3e5afe514a61f8e6f5e0c890eef77a374a85cd5677810355cb9ea8330177b1f350e20eb59ea2a1db862e1eed8d85d400000001bd7375478516a159b872e8fb44d95272bf96f1ddf37f6254a0a6940839ab4e632c4d63568dbfb95c361f11f34fd40caf06ecb0988365c5764ce25aac54119b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAAB8001-73A5-11ED-91F2-D2F8C2B78FDE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000067440beb905613d257d5765231810ff6c6e61a7d9f05402b5ae147e2a6b278d9000000000e80000000020000200000009890aa04ab3d4fd10a1aa10a1ace0b805563c240645f065530f42bf00753e9f9200000002b4d340b8a09e5bc9f94ae39793b147861664edda1d336b5e7a056ba3668b0bd40000000ede240c2413316e50a8b538c51d6bc0cb569841c21a6c916042eb20227a9a94eb4cdde5e0e6b29d2279e7bccc578286fbac369906615c139f511bd468a97714a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376904154"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1092	Surprize.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1908	iexplore.exe
1908	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1092	1756	6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe	28
PID 1756 wrote to memory of 1092	1756	6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe	28
PID 1756 wrote to memory of 1092	1756	6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe	28
PID 1756 wrote to memory of 1908	1756	6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe	29
PID 1756 wrote to memory of 1908	1756	6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe	29
PID 1756 wrote to memory of 1908	1756	6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe	29
PID 1908 wrote to memory of 1624	1908	iexplore.exe	31
PID 1908 wrote to memory of 1624	1908	iexplore.exe	31
PID 1908 wrote to memory of 1624	1908	iexplore.exe	31
PID 1908 wrote to memory of 1624	1908	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe
"C:\Users\Admin\AppData\Local\Temp\6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Roaming\Surprize.exe
  "C:\Users\Admin\AppData\Roaming\Surprize.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1092
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.4jok.com/sms/13/1
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YKGL4G9S.txt

Filesize
527B

MD5
541456e799e68e270891f63052934201

SHA1
a8ee557895100ffb78e36989709ab06bf9275528

SHA256
6bf0516c84f7cae546663025c776888663a81363bb5ad9111f862614e3490fe9

SHA512
5e19c89e923a9728f67ffdf41db8e3a3656fe43bcea24be4295afeaa5431ddf0c5ad8db29e7379fda9135be8fbd7346c73bc1fd5b0b9a3e9207409313746bf84

Download Submit
C:\Users\Admin\AppData\Roaming\Surprize.exe

Filesize
500KB

MD5
eb7963c1046d089525b56ba7531d41f3

SHA1
56a2e1c147f863518565d4ad83ee1b4078e35251

SHA256
6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788

SHA512
bdb4e2140fdb47e2a277727005430638c41ca341fbd887bfd149cbb0b8f94cdeedceb628c46a02d0bfb3d6e371ebade26c4da8b0ecb158f40c9156a54d85b75f

Download Submit
C:\Users\Admin\AppData\Roaming\Surprize.exe

Filesize
500KB

MD5
eb7963c1046d089525b56ba7531d41f3

SHA1
56a2e1c147f863518565d4ad83ee1b4078e35251

SHA256
6059819cbbef9b02dc164210e2fbfaff04ecfcb9a923a5b750c8ffc0c409c788

SHA512
bdb4e2140fdb47e2a277727005430638c41ca341fbd887bfd149cbb0b8f94cdeedceb628c46a02d0bfb3d6e371ebade26c4da8b0ecb158f40c9156a54d85b75f

Download Submit
memory/1092-59-0x000007FEF3D60000-0x000007FEF4783000-memory.dmp

Filesize
10.1MB

Download
memory/1092-61-0x000007FEF2CC0000-0x000007FEF3D56000-memory.dmp

Filesize
16.6MB

Download
memory/1092-62-0x000007FEFB8E1000-0x000007FEFB8E3000-memory.dmp

Filesize
8KB

Download
memory/1092-63-0x0000000000396000-0x00000000003B5000-memory.dmp

Filesize
124KB

Download
memory/1756-54-0x000007FEF3D60000-0x000007FEF4783000-memory.dmp

Filesize
10.1MB

Download
memory/1756-55-0x000007FEF2CC0000-0x000007FEF3D56000-memory.dmp

Filesize
16.6MB

Download
memory/1756-60-0x0000000000A56000-0x0000000000A75000-memory.dmp

Filesize
124KB

Download
memory/1756-64-0x0000000000A56000-0x0000000000A75000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads