ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7

Analysis

max time kernel
76s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 04:58

Target

ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
Size

6.1MB
MD5

e41c2b8d50ee6ca63ce2c32236c99bed
SHA1

60972aa1a8f68d697fd3ff74d723609870f298f7
SHA256

ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7
SHA512

1557bdb28821d8f7be09e55f45362a1078a4de1e75a273a68bb71e6146553ba760416df66553e3173f2889188a8030adf6707456251dfac717f941f7937d0e8b
SSDEEP

196608:2M9pfAJBlQoHoGMukN8rhH5tQpb7UlJ35DB4CF:2M9pfyMap3rhEpb7UlJJDSc

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3496	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\IESettingSync	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3496	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
3496	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3496	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
3496	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
3496	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
3496	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe
3496	ca3e91a4e3175bc48cca9b15f9ea85f1c3d8cea49994fedf68e3d4a006a3b2b7.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3496-132-0x0000000000400000-0x0000000001070000-memory.dmp

Filesize
12.4MB

Download
memory/3496-133-0x0000000000400000-0x0000000001070000-memory.dmp

Filesize
12.4MB

Download
memory/3496-135-0x0000000000400000-0x0000000001070000-memory.dmp

Filesize
12.4MB

Download
memory/3496-136-0x0000000000400000-0x0000000001070000-memory.dmp

Filesize
12.4MB

Download
memory/3496-137-0x0000000000400000-0x0000000001070000-memory.dmp

Filesize
12.4MB

Download