b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24

Analysis

max time kernel
80s
max time network
165s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe
Size

407KB
MD5

06392177fb86322b250e730563ad0b12
SHA1

af8888959e3d0edf9d69717664babc99ddaac859
SHA256

b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24
SHA512

7f17449ce1725a237afba7e6f53bb83c38a91edf9b0caeeb3e2782f92d25b1af4051f9051d5bc8a79779a6721c5c726cfa9717162155fe01207d7679860d3a0c
SSDEEP

6144:TkE8FSh4HT7d2PojIvSdBo9zMeBmwRiU3bPP0N1vbm6Hq12IYI:ZX/5a2d7iU3b0y1Z

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1016 set thread context of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807dd38dc90bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002554b0b20296c24390f681aa90626d650000000002000000000010660000000100002000000023fd4ad87bbd459a1bd693dc926d2fea89bf875aa397972d6df8c37f958f783b000000000e80000000020000200000007169aab6b227621c3a0163c524456b716d8e5c0d7caa68e9ab0122a8833dd7bd2000000073a44445912a9c9b6e5c9d2e83e9295978085c49a1edaff7b8aff612edba1b8c400000009adc17406083a14c33488bce26e74ddb25e03fcee44690ca71bd1e3978b65a3a4898f0bce6f687c81fbc00880290313b255298efc46cb3c2abc47471a37afa54	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B331C5F1-77BC-11ED-BD84-7E4CDA66D2DC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377353765"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002554b0b20296c24390f681aa90626d6500000000020000000000106600000001000020000000a9e17d2b911d414213b85999d586df76cf0a007865914b7e0710dddfc12a14bb000000000e80000000020000200000005d42cbd798be4150f244d70bf7851a877b9e4229827bcdd5dce23a3f49fd122f90000000414637fa20c94021206d376c6b17594b17b0be9caf02606241aa88d6fa0221df23628667b4b39047ad8ea191180d1288242d8fa63a2396142a54dbeeb721c18076da0b69c1ad8c491b62549cc81d2915e19df5564d2ab4dcf7c7a1b69ee6c40c5d243753052872f0c002ac8643af40d342ba7c58b580ef21ceb0556cc99a913456d678e08791dd1372ef7bd3d02a13b940000000ae32e0473c175e640da2c1da618d411caa0133ac2dc053bcb7ec7c171711829e14992afda0f1b744049592e7ac989702fe84b9c4313c89f1f2dafefa5bb6eb6c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
836	iexplore.exe
836	iexplore.exe
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE
1336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 1016 wrote to memory of 2032	1016	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	28
PID 2032 wrote to memory of 836	2032	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	29
PID 2032 wrote to memory of 836	2032	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	29
PID 2032 wrote to memory of 836	2032	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	29
PID 2032 wrote to memory of 836	2032	b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe	29
PID 836 wrote to memory of 1336	836	iexplore.exe	31
PID 836 wrote to memory of 1336	836	iexplore.exe	31
PID 836 wrote to memory of 1336	836	iexplore.exe	31
PID 836 wrote to memory of 1336	836	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe
"C:\Users\Admin\AppData\Local\Temp\b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe
  C:\Users\Admin\AppData\Local\Temp\b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b2fcde8b80e8e07cf1ac3afa5e110dc0d67556ff583771b73874b9422afa4c24.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:836 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AHSY1RSG.txt

Filesize
608B

MD5
5c603484f6dfbd32039d40fd29a8c0ca

SHA1
4db76eb03b63d4ec25aa01633e8c3988b67b089a

SHA256
647bb3bb97b6e47e6e85502f6212f46ecd86daafd7c0bc8d412f77466c72c22f

SHA512
65ed7f4f1e7bdd8da17c9f476ba722c56f305377a5722f474f3ca446229ae8954325fc6b7590b9f8dec99fe6e03d885cd4e333937d5dcbe7e9447429d3e9b30a

Download Submit
memory/2032-54-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2032-55-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2032-57-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2032-58-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2032-60-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2032-61-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2032-65-0x0000000000402000-0x000000000043D800-memory.dmp

Filesize
238KB

Download
memory/2032-64-0x0000000000402000-0x000000000043D800-memory.dmp

Filesize
238KB

Download
memory/2032-66-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download