Analysis

  • max time kernel
    166s
  • max time network
    180s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 19:25

General

  • Target

    b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe

  • Size

    136KB

  • MD5

    eb7906c1b79d9808b8b2fd425ee3e36a

  • SHA1

    98aa3c018a6341f30e42b54e577fd7388fc11a8a

  • SHA256

    b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521

  • SHA512

    63c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3

  • SSDEEP

    768:h/raHM782f9rvs2Zg5nicskQzTGfxgzh3emu4v/eB4z7VP7LdGSu2HyTAzfMgTA1:h/roM7ZJfUQWgY54v

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies registry class 37 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe
    "C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp\b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521
      2⤵
        PID:1912
      • C:\Windows\SysWOW64\msng.exe
        "C:\Windows\system32\msng.exe" fuckystart
        2⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5036
        • C:\Windows\SysWOW64\explorer.exe
          explorer.exe http://www.OpenClose.ir
          3⤵
            PID:216
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4852
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4260
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.openclose.ir/
          2⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:764
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff82f5946f8,0x7ff82f594708,0x7ff82f594718
            3⤵
              PID:744
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
              3⤵
                PID:1440
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
                3⤵
                  PID:1188
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
                  3⤵
                    PID:3736
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:1
                    3⤵
                      PID:3672
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,2534838685567581859,7932663363044752182,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
                      3⤵
                        PID:976
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:2020

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Windows\SysWOW64\msng.exe

                      Filesize

                      136KB

                      MD5

                      eb7906c1b79d9808b8b2fd425ee3e36a

                      SHA1

                      98aa3c018a6341f30e42b54e577fd7388fc11a8a

                      SHA256

                      b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521

                      SHA512

                      63c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3

                    • C:\Windows\SysWOW64\msng.exe

                      Filesize

                      136KB

                      MD5

                      eb7906c1b79d9808b8b2fd425ee3e36a

                      SHA1

                      98aa3c018a6341f30e42b54e577fd7388fc11a8a

                      SHA256

                      b01209a99d4830af3756ff3799fee754ab75f05a275bca42b27eafe246f6c521

                      SHA512

                      63c326b8a6efe9ac3a0995f4b42bae91f6bf9009ab156d8ce29a31d3c03888721ce13bf0edb094a6c5b57825d44f602008623933e9ccc9cbad318a95807f89d3

                    • C:\~0002ftd.tmp

                      Filesize

                      100B

                      MD5

                      86149294c30f48d736a47cfe9f86499c

                      SHA1

                      8bf7fa89c1a028b978110c8bd69301a1af0cdc1b

                      SHA256

                      7e13a885b9e34e5c304fc7623b35355ad1e7ccf2968fcd9c5250e73e30118f19

                      SHA512

                      e88ac89bab38557b54288f5d4e208a55fdd6f3912841ce5f2ecf5e2082019450deb6f7101d9ea33b8b8153df38d7396087bb5a1e56c11ab65f0ab538a823874c

                    • memory/4428-132-0x0000000000400000-0x0000000000486000-memory.dmp

                      Filesize

                      536KB

                    • memory/4428-140-0x0000000000400000-0x0000000000486000-memory.dmp

                      Filesize

                      536KB

                    • memory/5036-146-0x0000000000400000-0x0000000000486000-memory.dmp

                      Filesize

                      536KB

                    • memory/5036-143-0x0000000000400000-0x0000000000486000-memory.dmp

                      Filesize

                      536KB