Analysis
-
max time kernel
126s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe
-
Size
472KB
-
MD5
a556239106d352687659687e1832928a
-
SHA1
af477660e54642aae12a8584be9d0c7a6dbe3de3
-
SHA256
681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6
-
SHA512
d1a81e56852757a0336b60bdca21dba62599e247fbcd1f83cdbf9ac9762366122b432a150ced1274a50f241c0aff072b93091ba231a64ccb576266b98016beed
-
SSDEEP
3072:FQL8va4bjhxxp7HAM95tNez6HOB52YvpvQv5ijs3+0jJuvkca4ryF:FrdpHAM95tNez6HRxcj6u0
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a74f26d41907b4790c965c440148224000000000200000000001066000000010000200000000e1a8a4cfbaf588389fb596ec32984f84ff06a29f2c8c988830800abe6528c16000000000e80000000020000200000006bd5d8224fa4eb4035ba6a50685e235f4034e374f5e1b6b7c15a4587f47cfffc90000000d2031b4efa20378becc5106770129429a62475d99834a9ef860176095df283886a0d5d58793f6b32aefc16219ebbf049e78dd25587c5e7387143346a824ba54eb97bc22733773ad39497312b9cd0f2f08cf24ece23351e0ff8b82a2b2cee33f91499b5ecce649d6b40092e7dbf1dbb2f76c70436833914180444366e1b13129c234ebd09aeb3873b62422bf2281b3cce40000000ead527fccb10751b8d2f8eee54471cff2366cb9c24e3bb8e1c05e1ceffe98f152c636f615c61ed862265334ded92031cb4707c3657f1d261d43eb85a3a3c3d09 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006a74f26d41907b4790c965c4401482240000000002000000000010660000000100002000000077ef821c7175da26d51849f422e6598ba6fb19f73b2b6d1dd2bee96783f2b74f000000000e8000000002000020000000b70ad91c6b18cc4af380a631d62d5631288cbc0a9c7f781c0a3cf37d6116063d20000000a867ab3594f6c97b539c47214d54249bfa4414a3b65ca92a6fc953115a890dce400000004b063f4b490a2baf004cfa1d6ca2067f3f512ca500aa383af295c09528e02793c922f7511a1bac03974b1d8b71b1572aeec66e3b902e2d09ec0ae25fcd16dd75 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B85598C1-7534-11ED-A5BF-5242C1400D5F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70ee43924109d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377075456" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1128 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 1128 iexplore.exe 1128 iexplore.exe 680 IEXPLORE.EXE 680 IEXPLORE.EXE 680 IEXPLORE.EXE 680 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1448 wrote to memory of 1128 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 27 PID 1448 wrote to memory of 1128 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 27 PID 1448 wrote to memory of 1128 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 27 PID 1448 wrote to memory of 1128 1448 681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe 27 PID 1128 wrote to memory of 680 1128 iexplore.exe 29 PID 1128 wrote to memory of 680 1128 iexplore.exe 29 PID 1128 wrote to memory of 680 1128 iexplore.exe 29 PID 1128 wrote to memory of 680 1128 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe"C:\Users\Admin\AppData\Local\Temp\681c1a99aba58046650b4e2e323c0e389922dea8b6e977aaf848751d281c44a6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/watch?v=FUoNq1zO0BM2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1128 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:680
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b18754ce37f6d837c04a5febfc43fdd
SHA11ea889cc2b33750da28a909fb68958175356cbed
SHA256077dcd673bdd8cca1f0df1ddb20d860ae84f30c3b9fae538bf81e51968e7b60f
SHA5129593a37df0dde22e1645dff89a6fa055473600c0a085f1113b6968c6e076a49d044eaf2fd071ebf25965a42d32f4245f36f5f356c37c7355817141574ee31c05
-
Filesize
5KB
MD5530823d6bb529cf8a6415234b474c7ac
SHA12d7bfe0b9689d8a49bcb2d624e7f654e3964d1a3
SHA256629f768974887bdb99e34d8d9fce2d25bfb826248bfda944e550cd7a0f988207
SHA5121b8d5e739b4ab445e611a4b443346406827195d762fdef6c16b400611a8bc00ed155ef304d1626563613cfaaab5a570d317b9f1fdf4a6df9d0041fc4f8bd330d
-
Filesize
607B
MD5026f3ccdf578a885af74193501e641ba
SHA1d094039b8fce681525d096c705c935075694c073
SHA2569e945a9992a8174bdc6973eab9747e1eb2808cff894df810c1e8e819e91c095b
SHA512bdad3ce4b9024ce537300f57143bd7e171a7a46601107c48f40cb58b9db5efb83d6e51c95ddd431a2ea6c58f7c6f218beff72dc0585175b7b6815535b1ac0f59