196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf

Analysis

max time kernel
110s
max time network
190s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe
Size

1.6MB
MD5

4cccc21fc45e1b65a646d0c55e9d0ac8
SHA1

e8fe3fbadda59888bdb6bf6d297638692e084959
SHA256

196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf
SHA512

8b8331b257c399e51a061990aee3bc6c1b17ada71b4166e7bb886c85be1cb4455a1d896b16df6417d9c298b457b65ca78ce0f65c5c8524d283a3fb30adc18c5c
SSDEEP

24576:GMv+gDEDgzmhiHP2EWPkPU04HrrFrUdtMnESJnQJE2/JKJ:GKzmIVJsFUcmE2/JKJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\xiugua.net	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376856849"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\xiugua.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c0013c67cc9f5a4682fe66f3173d827800000000020000000000106600000001000020000000bc2e5f7019b8bf42a400b580aae472d6a74139cbb82e16270288f499a522896b000000000e8000000002000020000000bea6643af280b0e5a83a37c67c4a58f08a1da60a7925aa5521fb8a68a840866f200000004ca3ab3e38b45be20dfd869d607657eba68ae07930f874319fd2d817e25ad1a6400000002fe181a6a65923f9f8277fda70b128354cb6b0bf83b3ad06f01bfb35114a05158095c821c297650f695611742b02d92f1abf9bf85b7b9714effd1464dcc59518	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90dfc3964407d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c0013c67cc9f5a4682fe66f3173d82780000000002000000000010660000000100002000000081ad9417a78357b5fd217c9b28d5301d144abe44b413260ed4aa8fd6e16004f8000000000e80000000020000200000002539968bf5a73cdde8fbb35cab557f0b32d81bcf651383670141ac721786f04e90000000e7a0493b66ef44929c739cdf235c90165578a7a4abe0c912776a1b7f468a09d76938da1b930ea31b51a647908156d1b6575b262dced98af7699b2e640fda98361a7717ff9fd36d74e3aec73c729c903433e482a2eb1f13dc2c71cfced621c199c82df01147d7dfc4e28b3f60f30f56f77a4a4ef4835a04e1d362c5e043480c52e3e5ed02eb6e1bee53767e3195a807fa4000000098546ea0210cae9e63efcd614852d95cd4d15be2b426a138f8d3177a1825863db2e2faaada0a6dd15965256292a0c1b646df37e86df273c5400900d229f4f2e4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\xiugua.net\Total = "63"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\xiugua.net\Total = "126"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BACB5A31-7337-11ED-B59B-4A4A572A2DE9} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.xiugua.net	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.xiugua.net\ = "126"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\0xofi.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.xiugua.net\ = "63"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\0xofi.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1536	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
904	196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe
904	196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe
904	196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe
904	196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe
1536	iexplore.exe
1536	iexplore.exe
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE
1460	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1536	904	196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe	29
PID 904 wrote to memory of 1536	904	196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe	29
PID 904 wrote to memory of 1536	904	196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe	29
PID 904 wrote to memory of 1536	904	196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe	29
PID 1536 wrote to memory of 1460	1536	iexplore.exe	30
PID 1536 wrote to memory of 1460	1536	iexplore.exe	30
PID 1536 wrote to memory of 1460	1536	iexplore.exe	30
PID 1536 wrote to memory of 1460	1536	iexplore.exe	30

C:\Users\Admin\AppData\Local\Temp\196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe
"C:\Users\Admin\AppData\Local\Temp\196a4d91e094ad2f5f9a6321dd95dfad0d55e3df95d2ab816ea4ef4c0562f8bf.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.xiugua.net/wg/dnf/20130121/1754.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1536 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae2b7c925ea43f6b0a57942039f101ce

SHA1
00da17936fd344aa6ae9df6ea00db320bf6610f0

SHA256
cd95e8b20d0aa70dc8d21aa43dbbce892435e51830bfb66eb108113ed1cfd54c

SHA512
87e8a842da7d8df3c9a81f15e781d8267b9b71790ca10469977ef819daa7b7a04da9d9cf7d636934823dc4a71e5078308bb24fcf23b12c1c19c8acf22ec9f3b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

Filesize
8KB

MD5
a14e43fd7ba33649e4502c6f14b8fcf4

SHA1
873eabf2acbd44740d660c761843bc09908aeb04

SHA256
5d40a1dc1de75fa63bcd1f2db66d4a3c3f988fafeba5fe0dcf58a45257595b22

SHA512
f6853b81cfc4dd68bbee15065f4c1365cfdf053ed673add246a2dad6f359ec0ff4eecb7ea2a18c812863ab1db23d54a778ccff35311063c65fef2f2c8fabe01e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2CA4B70X.txt

Filesize
608B

MD5
2395d6830823c8ed13b973ee22bc2c4c

SHA1
44422462ef6f465dfa8867ccd80674de301f601f

SHA256
cb08902181254c4fc7fb946ba4728b6bba01b1c10adb9f856b8950ee84449a4b

SHA512
8a6b43bb4a4b1f7362ccacc70b8d784b8f7686cd4480eee586b9d856e41e033609ee8f8732d5f8d2c3b370c90a574410f17975b47aab52a6a3b54b3ba38a308e

Download Submit
memory/904-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download