Analysis
-
max time kernel
113s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 20:32
Behavioral task
behavioral1
Sample
2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe
-
Size
25KB
-
MD5
835175db7f6ea4ead72d3cbe5e83e444
-
SHA1
1d1acfa9885150d353ee04a0c9af50ecf5f64b2f
-
SHA256
2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2
-
SHA512
90f21412a9dd03ed8be95926c6c38381a95b9b8e390ac1b2d951e40978c704d75d681dc069f160827572e2d0994900fc9e3b24c3089f0d036aed94bb29bc31fc
-
SSDEEP
384:gIeCNM2VkqNdbfuz2mGLeAgGO4IWwwDhQlui3HD+A8Aeezj+g82jRkv:/hMu5sRqB5EwDhou6H5T+g82j
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1812-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-60-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\i: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\k: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\n: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\o: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\s: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\w: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\z: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\g: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\j: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\l: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\r: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\u: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\v: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\y: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\f: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\m: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\q: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\x: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\h: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\p: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\t: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iexp1ore.exe 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
pid Process 1720 taskkill.exe 1140 taskkill.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98F34DC1-7385-11ED-9351-5A21EB137514} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376890291" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c25a7d9207d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e682ee29c5a23f4dbf30efcb54a17505000000000200000000001066000000010000200000008dc0820da21b00861c023431b494525bbd9f7a2c6e3535facc679f245ef8fd1a000000000e8000000002000020000000113894459077a09aa8598e78122b95ffa2b1804bb08155b6b190d3622c45bddd90000000b77dd72fc4f9dba1707bb91b8828984fab151f02dce17e0c3a3d39eec68f274351f35d1a8a37940a2261d9f0d4949a4ff14c9afe51bb0d4bf550b12bcc351df4d0e15541de61edcf21c34e2fdc0e332c26873f86715d0f6502430960431988e3b28add0c98120dab320c711cc3294056eb58c161397f58a8098a7cbb49d326fd2c882afa51609c86a88d6b42f0f95bc6400000008a0e3d5805020e8889361f38a07a785d6c92d3d461abbefb2f9de860015ed8bb0fe8ea45eb48b0f132f49279cbcb5727199528e7221aba1bc8ff56f20e19788f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e682ee29c5a23f4dbf30efcb54a175050000000002000000000010660000000100002000000059bbf89d0b6deb96d06419baf8772fbdf190b83a92fc12c310fffe9035d06797000000000e8000000002000020000000f910e82948fdce02276b9a88450353d4953c0acd184dc1a4a2ef3eb1bf992ea120000000e1d5a6737ba23cac4f3c5f81e1517550da6bc0eac9ad920d3f928df9458553904000000069104c150ced00e9feca367f7f6dc076c9fbe5e0b93a9eddce364900a14f0a4c20712de34547109d148a514ccd74f01aee127fce196e685472537775475ecfc0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1140 taskkill.exe Token: SeDebugPrivilege 1720 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1640 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1640 iexplore.exe 1640 iexplore.exe 544 IEXPLORE.EXE 544 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1812 wrote to memory of 856 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 29 PID 1812 wrote to memory of 856 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 29 PID 1812 wrote to memory of 856 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 29 PID 1812 wrote to memory of 856 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 29 PID 1812 wrote to memory of 1268 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 31 PID 1812 wrote to memory of 1268 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 31 PID 1812 wrote to memory of 1268 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 31 PID 1812 wrote to memory of 1268 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 31 PID 856 wrote to memory of 1720 856 cmd.exe 33 PID 856 wrote to memory of 1720 856 cmd.exe 33 PID 856 wrote to memory of 1720 856 cmd.exe 33 PID 856 wrote to memory of 1720 856 cmd.exe 33 PID 1268 wrote to memory of 1140 1268 cmd.exe 34 PID 1268 wrote to memory of 1140 1268 cmd.exe 34 PID 1268 wrote to memory of 1140 1268 cmd.exe 34 PID 1268 wrote to memory of 1140 1268 cmd.exe 34 PID 1812 wrote to memory of 1640 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 36 PID 1812 wrote to memory of 1640 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 36 PID 1812 wrote to memory of 1640 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 36 PID 1812 wrote to memory of 1640 1812 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 36 PID 1640 wrote to memory of 544 1640 iexplore.exe 38 PID 1640 wrote to memory of 544 1640 iexplore.exe 38 PID 1640 wrote to memory of 544 1640 iexplore.exe 38 PID 1640 wrote to memory of 544 1640 iexplore.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe"C:\Users\Admin\AppData\Local\Temp\2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM ie.exe2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ie.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM iexp1ore.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM iexp1ore.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1140
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" www.trackerx90.th.gs2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:544
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539B
MD5ee1b5f987aed15aa1f275d6deb7567e2
SHA1201db1050f9d2e586937ed8b4e86ba2b5ca33ae4
SHA256dcf51a5b5f3e6cf5f2ddeabf501aa2799f059771146f42f4b936e6029617db90
SHA512850440863486c5ce704e7a9139d35174bed35cb677ed441ea5b10db11c416e1f03f42b8ebc565f81ee78cf694ed7d3ff0806b402fda8437c86a65acd40157e74