Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 20:32
Behavioral task
behavioral1
Sample
2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe
-
Size
25KB
-
MD5
835175db7f6ea4ead72d3cbe5e83e444
-
SHA1
1d1acfa9885150d353ee04a0c9af50ecf5f64b2f
-
SHA256
2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2
-
SHA512
90f21412a9dd03ed8be95926c6c38381a95b9b8e390ac1b2d951e40978c704d75d681dc069f160827572e2d0994900fc9e3b24c3089f0d036aed94bb29bc31fc
-
SSDEEP
384:gIeCNM2VkqNdbfuz2mGLeAgGO4IWwwDhQlui3HD+A8Aeezj+g82jRkv:/hMu5sRqB5EwDhou6H5T+g82j
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4856-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-137-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\m: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\t: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\z: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\s: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\u: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\e: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\i: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\l: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\o: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\p: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\q: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\v: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\f: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\h: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\k: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\n: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\r: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\w: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\g: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\j: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\x: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe File opened (read-only) \??\y: 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iexp1ore.exe 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 2 IoCs
pid Process 4576 taskkill.exe 4236 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BFBFFBAD-7385-11ED-B696-DEF0885D2AEB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2649500206" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376890376" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000466" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03ba4989207d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407c439f9207d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000466" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d96d88a715781469a8af09d9f1df7960000000002000000000010660000000100002000000051c504012fe62d511d041be8db1e7044e03342bfa9081f3d00dceaf15aa4e962000000000e8000000002000020000000de8b1f1ac910142874ef78eac6c6659a68c3f836f724f7d6800492e60fac3d7720000000c1fbf7af812c6b3f6e080f60e3893cf539bdf73d708aecd298fa159b712ddb4340000000b23df0dba551a6cf77b2e0da8acb331b31be32e65fdb848ffc69d335717cfd74b38b2e27dd0210228de55b426c5b5eca4ffe4910bc5cea843b2f513de1002aba iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2649500206" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d96d88a715781469a8af09d9f1df79600000000020000000000106600000001000020000000aaf5aecf0ff0e856892b267f577da9029de498b01ca4663d20827e4db649d4d7000000000e8000000002000020000000437f40495c1db6329d5c0d986a27fbe093f7b83b9ba60e4428373e54d10cce96200000008c40df27604478521aff66b0837f482674e40ce8e7260ed26fb480ea1a6de90640000000becbbf44f328203274c21810832c42aa4db2e00092d3cfb3f4cd5a4ba777267068597559dc4a278544ad7367429c099b1d727346be767bc65c6fbbc7365f0412 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4576 taskkill.exe Token: SeDebugPrivilege 4236 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3124 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3124 iexplore.exe 3124 iexplore.exe 2080 IEXPLORE.EXE 2080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4856 wrote to memory of 4692 4856 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 81 PID 4856 wrote to memory of 4692 4856 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 81 PID 4856 wrote to memory of 4692 4856 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 81 PID 4856 wrote to memory of 4612 4856 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 83 PID 4856 wrote to memory of 4612 4856 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 83 PID 4856 wrote to memory of 4612 4856 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 83 PID 4692 wrote to memory of 4576 4692 cmd.exe 85 PID 4692 wrote to memory of 4576 4692 cmd.exe 85 PID 4692 wrote to memory of 4576 4692 cmd.exe 85 PID 4612 wrote to memory of 4236 4612 cmd.exe 86 PID 4612 wrote to memory of 4236 4612 cmd.exe 86 PID 4612 wrote to memory of 4236 4612 cmd.exe 86 PID 4856 wrote to memory of 3124 4856 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 88 PID 4856 wrote to memory of 3124 4856 2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe 88 PID 3124 wrote to memory of 2080 3124 iexplore.exe 89 PID 3124 wrote to memory of 2080 3124 iexplore.exe 89 PID 3124 wrote to memory of 2080 3124 iexplore.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe"C:\Users\Admin\AppData\Local\Temp\2e750671568ddd3fb7b750398e93a8849c5ca0ba434d2115ecd534c91f519ef2.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM ie.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM ie.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM iexp1ore.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM iexp1ore.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4236
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" www.trackerx90.th.gs2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3124 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2080
-
-