d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656

Analysis

max time kernel
132s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656.exe
Size

1.4MB
MD5

b428e5d6f582edeccd49c4a8a42449f8
SHA1

f9ea1edee886d38e5543e2d98221ba87fea3a514
SHA256

d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656
SHA512

970e9127c17ed87f73782de129baeb144602f16d93cc21189f9faae36aaa7ac29f311443d4f88eb6e48347bebaa739b937263a728c690fcf74756b7faf81ca0f
SSDEEP

24576:ZAYKY2GH6W0vXJccTACK5nSc61JtDlxnIvL0nEG5a7sR+y2rr71Z8xxn7F9AurMK:ZAJY9s5/Ann0JWLAEpy2rr71k7FKuruy

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4244	explorer.exe
3552	wins.exe
4672	wins.exe
1104	19410

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\SYSTEM~1\AppData\Local\WINDOW~1\QUERIE~1.CAC	wins.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service	wins.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\queries-07.cache	wins.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\queries-07.cache	wins.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\queries-06.cache	wins.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\queries-02.cache	wins.exe
File opened for modification	C:\Windows\SysWOW64\config\SYSTEM~1\AppData\Local\WINDOW~1\QUERIE~2.CAC	wins.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\known2_64.met	wins.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\known2_64.met	wins.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe	explorer.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\queries-03.cache	wins.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\Autoconnect = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\Scoresystem = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\FilterComments = "0"	wins.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\QueueSizePref = "50"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\StatsAverageMinutes = "5"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\MessageFilter	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\Statistics\TotalUploadedBytes = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\SmartIdCheck = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\WebServer\UseGzip = "1"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\DownloadCompleted\CoreCommand	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\DownloadCompleted\GUIEnabled = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\AICHTrust = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\MaxConnections = "480"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\Browser\CustomBrowserString	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\Proxy\ProxyEnablePassword = "0"	wins.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aMule\Razor_Preferences	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\OutOfDiskSpace\CoreEnabled = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\SplitterbarPosition = "75"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\Proxy\ProxyType = "0"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\Proxy\ProxyPassword	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\AddServerListFromServer = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\CheckDiskspace = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\ManualHighPrio = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\AllocateFullFile = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\WebServer\PageRefreshTime = "120"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\ShowOverhead = "0"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\Proxy\ProxyName	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\ErrorOnCompletion\CoreEnabled = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\Obfuscation\CryptoPaddingLenght = "254"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\ExternalConnect\ShowProgressBar = "1"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\ExternalConnect\ECAddress	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\Razor_Preferences\FastED2KLinksHandler = "1"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\VideoPlayer	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\ShowAllNotCats = "0"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\Ed2kServersUrl = "http://gruk.org/server.met.gz"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\MaxSourcesPerFile = "300"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\ConnectToKad = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\SkinGUIOptions\UseSkinFiles = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\ExternalConnect\IpFilterClients = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\NewChatSession\GUIEnabled = "0"	wins.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aMule\Browser	wins.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aMule\WebServer	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\ShowInfoOnCatTabs = "1"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\SkinGUIOptions\Skin	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\OSDirectory = "C:\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Windows Internet Name Service\\"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\AddServerListFromClient = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\EnableTrayIcon = "0"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\CommentFilter	wins.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\DownloadCompleted	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\Serverlist = "1"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\ExternalConnect\AcceptExternalConnections = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\ExternalConnect\ECPort = "4712"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\FilterLevel = "127"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\Obfuscation\IsClientCryptLayerSupported = "1"	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\ErrorOnCompletion\GUICommand	wins.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aMule	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\ExternalConnect\ECPassword	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\eMule\ShowPartFileNumber = "0"	wins.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\NewChatSession	wins.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\OutOfDiskSpace	wins.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\OutOfDiskSpace\GUICommand	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\WebServer\Enabled = "0"	wins.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\aMule\UserEvents\NewChatSession\CoreEnabled = "0"	wins.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\crutch	wins.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\crutch\LocalService = "Windows Internet Name Service"	wins.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4672	wins.exe
4672	wins.exe
4672	wins.exe
4672	wins.exe
1104	19410
1104	19410
1104	19410
1104	19410

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4672	wins.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 4244	1376	d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656.exe	81
PID 1376 wrote to memory of 4244	1376	d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656.exe	81
PID 1376 wrote to memory of 4244	1376	d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656.exe	81
PID 4244 wrote to memory of 3552	4244	explorer.exe	82
PID 4244 wrote to memory of 3552	4244	explorer.exe	82
PID 4244 wrote to memory of 3552	4244	explorer.exe	82
PID 4672 wrote to memory of 1104	4672	wins.exe	91
PID 4672 wrote to memory of 1104	4672	wins.exe	91
PID 4672 wrote to memory of 1104	4672	wins.exe	91
PID 1104 wrote to memory of 4440	1104	19410	92
PID 1104 wrote to memory of 4440	1104	19410	92
PID 1104 wrote to memory of 4440	1104	19410	92

C:\Users\Admin\AppData\Local\Temp\d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656.exe
"C:\Users\Admin\AppData\Local\Temp\d3bdc82b9dac56c0c627a57095b8acfc96753e5df4849b2cf7949f44cb9e5656.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\explorer.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe
    "C:\Windows\system32\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe" /Service
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:3552

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe
"C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\TEMP\19410
  "C:\Windows\TEMP\19410" -u "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\TEMP\19518.bat"
    3⤵
    PID:4440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\explorer.exe

Filesize
5.1MB

MD5
53772d0e0aa23e5cc43f405d8d846b27

SHA1
e00c2ef1cec31aec62a2a6ef4eb980382315df51

SHA256
ee49c1a2c59ecaa31c2ea92f89e3b83f8edd88e713054d2278aab89821381f88

SHA512
a6ddb1c7147c5776ce88025e44d64b0228857223dc06f82948c00bcef89c4217083e229385796c49783487a0f9f14bc68bb44a90500927381cb1b261f9fdf581

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\explorer.exe

Filesize
5.1MB

MD5
53772d0e0aa23e5cc43f405d8d846b27

SHA1
e00c2ef1cec31aec62a2a6ef4eb980382315df51

SHA256
ee49c1a2c59ecaa31c2ea92f89e3b83f8edd88e713054d2278aab89821381f88

SHA512
a6ddb1c7147c5776ce88025e44d64b0228857223dc06f82948c00bcef89c4217083e229385796c49783487a0f9f14bc68bb44a90500927381cb1b261f9fdf581

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe

Filesize
5.1MB

MD5
53772d0e0aa23e5cc43f405d8d846b27

SHA1
e00c2ef1cec31aec62a2a6ef4eb980382315df51

SHA256
ee49c1a2c59ecaa31c2ea92f89e3b83f8edd88e713054d2278aab89821381f88

SHA512
a6ddb1c7147c5776ce88025e44d64b0228857223dc06f82948c00bcef89c4217083e229385796c49783487a0f9f14bc68bb44a90500927381cb1b261f9fdf581

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe

Filesize
5.1MB

MD5
53772d0e0aa23e5cc43f405d8d846b27

SHA1
e00c2ef1cec31aec62a2a6ef4eb980382315df51

SHA256
ee49c1a2c59ecaa31c2ea92f89e3b83f8edd88e713054d2278aab89821381f88

SHA512
a6ddb1c7147c5776ce88025e44d64b0228857223dc06f82948c00bcef89c4217083e229385796c49783487a0f9f14bc68bb44a90500927381cb1b261f9fdf581

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Windows Internet Name Service\wins.exe

Filesize
5.1MB

MD5
53772d0e0aa23e5cc43f405d8d846b27

SHA1
e00c2ef1cec31aec62a2a6ef4eb980382315df51

SHA256
ee49c1a2c59ecaa31c2ea92f89e3b83f8edd88e713054d2278aab89821381f88

SHA512
a6ddb1c7147c5776ce88025e44d64b0228857223dc06f82948c00bcef89c4217083e229385796c49783487a0f9f14bc68bb44a90500927381cb1b261f9fdf581

Download Submit
C:\Windows\TEMP\19410

Filesize
5.1MB

MD5
53772d0e0aa23e5cc43f405d8d846b27

SHA1
e00c2ef1cec31aec62a2a6ef4eb980382315df51

SHA256
ee49c1a2c59ecaa31c2ea92f89e3b83f8edd88e713054d2278aab89821381f88

SHA512
a6ddb1c7147c5776ce88025e44d64b0228857223dc06f82948c00bcef89c4217083e229385796c49783487a0f9f14bc68bb44a90500927381cb1b261f9fdf581

Download Submit
C:\Windows\TEMP\19518.bat

Filesize
115B

MD5
44accbff4ad4da61d471138371a176f8

SHA1
121df60dcbcc1e6c501520fc4b5e8da9356420b8

SHA256
93e9ed9e5c9730f0a3ab4a18518acb6f0ea927b2a54e59717d7bae9e0f5ebbc5

SHA512
6dc1c4f371e1c3dc8645116f6491ef373603593fb3396e56ab1d7644b03a8696ed9a21eb7ac7abe3e648202a572cd44623dc8d2aeca5c21d02588aec38a2317e

Download Submit
C:\Windows\Temp\19410

Filesize
5.1MB

MD5
53772d0e0aa23e5cc43f405d8d846b27

SHA1
e00c2ef1cec31aec62a2a6ef4eb980382315df51

SHA256
ee49c1a2c59ecaa31c2ea92f89e3b83f8edd88e713054d2278aab89821381f88

SHA512
a6ddb1c7147c5776ce88025e44d64b0228857223dc06f82948c00bcef89c4217083e229385796c49783487a0f9f14bc68bb44a90500927381cb1b261f9fdf581

Download Submit