Analysis
-
max time kernel
148s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 00:50
Static task
static1
Behavioral task
behavioral1
Sample
c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
Resource
win10v2004-20220812-en
General
-
Target
c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe
-
Size
1.6MB
-
MD5
47265030482ff347272cdf09aef25e8d
-
SHA1
2ae7ac78dc11f0374389f1f15031a1a1a4d30b70
-
SHA256
c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9
-
SHA512
35c09678bde4841c3bc0432229c6b84bd4ca39c963290cfcc7d25bb6b10002346e0dc798c684bf9d3ab95b4e286f5366430758733ee2f33eb8610e9773e78b0e
-
SSDEEP
24576:U61I7CpxnYP1uyFQ3OfzYSu2+PVAJeA4Qsi84XVKCuVSs1DKNbGvFic2Y+O:D+7vdNwERuDrZQsN4YpSKWG9ic2Yl
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1720-73-0x0000000000400000-0x0000000000432800-memory.dmp family_gh0strat -
Executes dropped EXE 3 IoCs
pid Process 1464 ¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe 1720 server.exe 1668 dedcisjxuu -
Loads dropped DLL 5 IoCs
pid Process 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 1720 server.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377173350" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A5AA0871-7618-11ED-BDDC-626677DD231B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000577a4e8c989fa34ca15aacf76e598b8e00000000020000000000106600000001000020000000bfff82df9dd300b134acf46d58989265bfb895b3059b5e9fb97b8a1eba068a37000000000e80000000020000200000006459a0df7a18b1f48a647f5cf7a81192286cdf3b30753b8e485f1bfd2e35abd2900000007f92e8b261726abc93b64d0a0c0abcc5795a9c8fb706b50b92e47f165dd93f149d0ee2e7867101a8b30f01398224fb9e3ee69334484e799bef4e8e61121ae97b9dac3818cc45917bb13d0a5358890d360701228d01a02d0767630329b9fd3ce6133629cff80d7e2bc0d85b24971d676dd560785c7ef566880eaea5121f8a644e51aba0918371f9f515faa419ad94211b400000002e2fa800214311b238bac35fea210e3b80f7abff65da821395ecdbf0553fb96a047ef3b2ba43f3362c513765400213f50ef6000d5422755971ad63d2675e5abd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e70f85250ad901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000577a4e8c989fa34ca15aacf76e598b8e00000000020000000000106600000001000020000000314c5ead4f0909bae249246f3f9d28d150ad8cfcdc3b043f68938d32ec8317f4000000000e80000000020000200000007a079c8b770b3abe62efac0094b980f7330940f5a94ea0a2700f4c2f3b594f5c200000002675fde47eac1dceae793ef5f353f9f1c215cfa89a26638fa068d4259e05a12140000000e01cb15747110427ce1189fcc566affd9ae00db706e432d30ee15a1b497d836f97289a3b1611eb42384dd13bf82fc6eff1261891d78a84cdf9e006cc843732b0 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1720 server.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 1720 server.exe Token: SeBackupPrivilege 1720 server.exe Token: SeBackupPrivilege 1720 server.exe Token: SeRestorePrivilege 1720 server.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1476 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1464 ¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe 1464 ¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe 1476 iexplore.exe 1476 iexplore.exe 1912 IEXPLORE.EXE 1912 IEXPLORE.EXE 1912 IEXPLORE.EXE 1912 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1552 wrote to memory of 1464 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 26 PID 1552 wrote to memory of 1464 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 26 PID 1552 wrote to memory of 1464 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 26 PID 1552 wrote to memory of 1464 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 26 PID 1552 wrote to memory of 1720 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 27 PID 1552 wrote to memory of 1720 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 27 PID 1552 wrote to memory of 1720 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 27 PID 1552 wrote to memory of 1720 1552 c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe 27 PID 1464 wrote to memory of 1476 1464 ¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe 28 PID 1464 wrote to memory of 1476 1464 ¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe 28 PID 1464 wrote to memory of 1476 1464 ¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe 28 PID 1464 wrote to memory of 1476 1464 ¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe 28 PID 1476 wrote to memory of 1912 1476 iexplore.exe 30 PID 1476 wrote to memory of 1912 1476 iexplore.exe 30 PID 1476 wrote to memory of 1912 1476 iexplore.exe 30 PID 1476 wrote to memory of 1912 1476 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe"C:\Users\Admin\AppData\Local\Temp\c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe"C:\Users\Admin\AppData\Local\Temp\¾¢Îè6.9ͨÓð棨֧³Ö˽·þ£©.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.5203y.com/3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1912
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
\??\c:\users\admin\appdata\local\dedcisjxuu"C:\Users\Admin\AppData\Local\Temp\server.exe" a -sc:\users\admin\appdata\local\temp\server.exe3⤵
- Executes dropped EXE
PID:1668
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD554b5926b964e7280448dff92eff7fd38
SHA1d9fa67ffe3e33a530a929368bcec80212d57477e
SHA256375d6fc7db4185183b562b63352d89a5865d3d3f7d9b7988ed48f4e2af600c95
SHA512b0ab73c30503aa14b207b17e10b492c4cfe39896e247d4de245068756671298cc6498538f20947245ff182d6df3945487644b3e1d8c41eef27e60610f7aedae2
-
Filesize
904KB
MD599ea9f16c4f432f12d23ac1f50f05fbc
SHA1660bda601a4f6c078d47ffdc91bba3a6875dda0f
SHA256b8c05c9f4bdd4fb29b7d1c50771c630cfeed85b3fb26146e171cd75cba2542d4
SHA512783a892754092ccbfb462487751f690a3df72aa9e5c6c88d6a229e04b8f24ee11da3de0b282d8e1707edc11ae07c96e49ca27ddc0b7df71ec10f88b17930d985
-
Filesize
23.7MB
MD58a41d175a2a6473bce239e518a584983
SHA1e686ddb39c29462c7ea9da086a66f835a812563e
SHA256946f824b3296b0fc7a1905050c1352a1d0769d59de565a8736b30eb2b08177ff
SHA512819028c229e5ac3d7da769b79b30f43abb5561fa0e1d58a88e408d005c26cfdbb27ff2565536b9f209eeb8c718388378041c778f02d68b3b904129c25d6f2c1d
-
Filesize
603B
MD57a3cb5165a7a60ae911779b5348c464b
SHA10f54e5e48ac96044f8ad090838c330e6ab9c78b1
SHA25638929a2ec2fe71a2bd9e8e8f9bf8520e2466c8f9d6d890297ef7e1b1a307102c
SHA512eb04c9eb61c98860ab706f1f4e19c1bed3cbca5e0050d4549baee2e7cc2e1a047c417e8107b9b76919cdc5cae232e8e2d5d0e874374f81d0532b7060852954b7
-
Filesize
196KB
MD554b5926b964e7280448dff92eff7fd38
SHA1d9fa67ffe3e33a530a929368bcec80212d57477e
SHA256375d6fc7db4185183b562b63352d89a5865d3d3f7d9b7988ed48f4e2af600c95
SHA512b0ab73c30503aa14b207b17e10b492c4cfe39896e247d4de245068756671298cc6498538f20947245ff182d6df3945487644b3e1d8c41eef27e60610f7aedae2
-
Filesize
196KB
MD554b5926b964e7280448dff92eff7fd38
SHA1d9fa67ffe3e33a530a929368bcec80212d57477e
SHA256375d6fc7db4185183b562b63352d89a5865d3d3f7d9b7988ed48f4e2af600c95
SHA512b0ab73c30503aa14b207b17e10b492c4cfe39896e247d4de245068756671298cc6498538f20947245ff182d6df3945487644b3e1d8c41eef27e60610f7aedae2
-
Filesize
196KB
MD554b5926b964e7280448dff92eff7fd38
SHA1d9fa67ffe3e33a530a929368bcec80212d57477e
SHA256375d6fc7db4185183b562b63352d89a5865d3d3f7d9b7988ed48f4e2af600c95
SHA512b0ab73c30503aa14b207b17e10b492c4cfe39896e247d4de245068756671298cc6498538f20947245ff182d6df3945487644b3e1d8c41eef27e60610f7aedae2
-
Filesize
904KB
MD599ea9f16c4f432f12d23ac1f50f05fbc
SHA1660bda601a4f6c078d47ffdc91bba3a6875dda0f
SHA256b8c05c9f4bdd4fb29b7d1c50771c630cfeed85b3fb26146e171cd75cba2542d4
SHA512783a892754092ccbfb462487751f690a3df72aa9e5c6c88d6a229e04b8f24ee11da3de0b282d8e1707edc11ae07c96e49ca27ddc0b7df71ec10f88b17930d985
-
Filesize
904KB
MD599ea9f16c4f432f12d23ac1f50f05fbc
SHA1660bda601a4f6c078d47ffdc91bba3a6875dda0f
SHA256b8c05c9f4bdd4fb29b7d1c50771c630cfeed85b3fb26146e171cd75cba2542d4
SHA512783a892754092ccbfb462487751f690a3df72aa9e5c6c88d6a229e04b8f24ee11da3de0b282d8e1707edc11ae07c96e49ca27ddc0b7df71ec10f88b17930d985
-
Filesize
23.7MB
MD58a41d175a2a6473bce239e518a584983
SHA1e686ddb39c29462c7ea9da086a66f835a812563e
SHA256946f824b3296b0fc7a1905050c1352a1d0769d59de565a8736b30eb2b08177ff
SHA512819028c229e5ac3d7da769b79b30f43abb5561fa0e1d58a88e408d005c26cfdbb27ff2565536b9f209eeb8c718388378041c778f02d68b3b904129c25d6f2c1d