Analysis
-
max time kernel
188s -
max time network
219s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe
-
Size
286KB
-
MD5
0c89a7f0acb3f3da130cf6358063d5e7
-
SHA1
26f83e7fd79d227b892e49db1becfee8442a4b48
-
SHA256
c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c
-
SHA512
4aaafe5d0a80582767e9c2d4deab44cd05e81d9f4da1d89a22365ed017edcf80372c60da12cda1a288bcfb1e2b63c8a9e2f45af48572487f4472ee7230c65e82
-
SSDEEP
6144:3zynM6mVv1bYE8P23jbrry6BjvMtUQFPYVFtuChJHgVXOgDDI9QZtooiNn6ex+2W:3GnBmQZmfx+2L
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe" c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Download c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001" c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 1400 msedge.exe 1400 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2340 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 85 PID 1700 wrote to memory of 2340 1700 c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe 85 PID 2340 wrote to memory of 1396 2340 msedge.exe 87 PID 2340 wrote to memory of 1396 2340 msedge.exe 87 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 4148 2340 msedge.exe 91 PID 2340 wrote to memory of 1400 2340 msedge.exe 92 PID 2340 wrote to memory of 1400 2340 msedge.exe 92 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93 PID 2340 wrote to memory of 1276 2340 msedge.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe"C:\Users\Admin\AppData\Local\Temp\c7f56169cff22e4dd66e6c368c4aa7ea9153ca65d34e1383ac214f4c8576607c.exe"1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/watch?v=FvCdqOQZQuk2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffb6cfb46f8,0x7ffb6cfb4708,0x7ffb6cfb47183⤵PID:1396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5561037731479064488,9844405290310660321,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 /prefetch:23⤵PID:4148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5561037731479064488,9844405290310660321,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2640 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5561037731479064488,9844405290310660321,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3204 /prefetch:83⤵PID:1276
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3148