Analysis
-
max time kernel
144s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 08:06
Static task
static1
Behavioral task
behavioral1
Sample
9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7.exe
-
Size
464KB
-
MD5
4267c13bcf1d9d9e942d3c05088c186d
-
SHA1
09746d7a0847548bb68314b221c39f2d4c652957
-
SHA256
9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7
-
SHA512
7d729916248d1595a1fb18016572eeab34a7f56df36c4a4b44419c55f96cd5b570390b273bd5926d95a1f6cd58d5eae9acbd44e93b760348c57ba4fe109389f2
-
SSDEEP
6144:+x6iVRLGDZLdHbTLvSAuYC27NkoTD/Eyf/To1ysI5uw7+WJz6lyqp3U+iyPmyQCb:8F6v73qbL2vnTowJ6Vh+yPQzrfcFT
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377084717" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "463938630" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{439E1E00-754A-11ED-89AC-520B3B914C01} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000919" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000493bffefb3ae1645bea09ad7be30f4aa00000000020000000000106600000001000020000000ea4c41e317d04b8816081cbac04e4ba75a5e128cfbb84b421ff6dbfae2a2e9e2000000000e80000000020000200000007c5c3c0af32138022e872fdbf4950cba3f3f1fe21d034133dad8866b739747bb20000000becc43ef8e5f0133d19d5e12e53ea2b048ac0a54ff54597849f34b1cd114003340000000086737a90b898e2b2d0d3dabcad214eb33e992305099fcd81db65a66f2fe81e807bd4c6a030c8de54e646cd0f209d1de3e7d3e95b5ce32ec32b87750b279088d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000493bffefb3ae1645bea09ad7be30f4aa00000000020000000000106600000001000020000000a21232eb9fa4bac7cb22058fb8dd132511d7cafccc53be387cbb96ae375ae34b000000000e80000000020000200000002af8e7c992fa65aa3bfefcaeea949285031770f80cf37a9d1ce6a73f5a114e612000000003b515e6d62e3e4b8cab5a7c334c663673923f7a0e7d1ce1a7abf642678dd8294000000081a6e72b59063d5cddb99ce2020c60b03e6ee487ed809cd0a095f1f9256e56351ad786a9fa09042f6038274387db781dde262079ed9b48e6786a3187558e5a2e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000919" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5078ae205709d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09783205709d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "463938630" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4968 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4968 iexplore.exe 4968 iexplore.exe 628 IEXPLORE.EXE 628 IEXPLORE.EXE 628 IEXPLORE.EXE 628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3076 wrote to memory of 4968 3076 9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7.exe 80 PID 3076 wrote to memory of 4968 3076 9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7.exe 80 PID 4968 wrote to memory of 628 4968 iexplore.exe 81 PID 4968 wrote to memory of 628 4968 iexplore.exe 81 PID 4968 wrote to memory of 628 4968 iexplore.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7.exe"C:\Users\Admin\AppData\Local\Temp\9f2ffcf226e5b9f32ce96bc566de2e992afb9511e95fff516911e3b00110bec7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.cbsupermarket.com/society & culture/new products/relationship-back-love-spouse-step.htm2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4968 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:628
-
-