ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af

Analysis

max time kernel
139s
max time network
167s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe
Size

67KB
MD5

51d14f3fabb33d8becc7f87d080d03ef
SHA1

b7e22e9262ef1cda272723d11aad9026f6437822
SHA256

ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af
SHA512

2f1f17bb1f734ea9961be867e714759dd8dab844475cc703d727354403a55766ef62490c0aff12fff80367ff4d67041032a05be133871cf285ad7cd04701679d
SSDEEP

1536:7hriDnHI3mTiQbgNqtn0l4xVNHOmSqLtAIfD8ogK:7Wck3bqc0l4jN1LtAIfIogK

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1928-54-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/1928-57-0x0000000000400000-0x0000000000430000-memory.dmp	upx
behavioral1/memory/1928-66-0x0000000000400000-0x0000000000430000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e045d553600cd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1ba173c15831d40ad8583aca5560e0300000000020000000000106600000001000020000000829a554f83683b255ec9f1fec2e91d45f6fb10614290dda88a6305bd3f52fa66000000000e8000000002000020000000d4926037a82e4eb9746503d2d5d60b5ec52774d57d646dbe227232cc9730be51900000009f27c0b875a9c37c2597e835d9ba455d93bc0b4fe195b00d50cc0cf3254371c5d587c6c67ef8577185a4eab04153c6d8770a68be00f1bad089bd89f944d1cd784dbc5acb6d75eb0e932569209471988318570f8aa180636e8daa29e4ae27e6c9ea090a10fa7e5d4b2b556f87af89156e88bc136cf7d11e472efae55119e9bc7e273ec0ba629e1be297258acbb1652edf400000001a8bf54d0fe4ae4e9e290d597bd29efa0733fc88a44d4e6a023f58f95275b800f483e12f1f67d0636e41e746b8d0cb582efd2338e80444bce75389d643755376	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{74C9C3C1-7853-11ED-8B0A-7A3897842414} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c1ba173c15831d40ad8583aca5560e0300000000020000000000106600000001000020000000be8e25fd5c657d25fb89d3740a8435279346a21db911b586c946e7b3fac44bf0000000000e8000000002000020000000c1b730f39e79796b0a71709aefa93f3ae32737bed58569598ae3cca2668a233420000000851a9096dd6f4c92b1a18ff27bb61c9b9aed56a0abdb1b99cf67f5df4482210e400000003d8f670809ba3d224010ca0dafc0d2673f886d44567db2eb967b667cb6c43177a189e7a19d94cbce7355e4ed27fb5b3f3bcb66ccf1b3462935e71732b0d3975e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377418515"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1116	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe
1172	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe
1116	iexplore.exe
1116	iexplore.exe
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1928 wrote to memory of 1172	1928	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	26
PID 1172 wrote to memory of 1116	1172	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	27
PID 1172 wrote to memory of 1116	1172	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	27
PID 1172 wrote to memory of 1116	1172	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	27
PID 1172 wrote to memory of 1116	1172	ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe	27
PID 1116 wrote to memory of 1304	1116	iexplore.exe	29
PID 1116 wrote to memory of 1304	1116	iexplore.exe	29
PID 1116 wrote to memory of 1304	1116	iexplore.exe	29
PID 1116 wrote to memory of 1304	1116	iexplore.exe	29

C:\Users\Admin\AppData\Local\Temp\ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe
"C:\Users\Admin\AppData\Local\Temp\ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe
  "C:\Users\Admin\AppData\Local\Temp\ba17ea4757a2d3c257c7dd889a5edcd86a0bd4392310bf2fd1486f9ffdc667af.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com/
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1116 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
b5e2365adfee911965bade59fee527a1

SHA1
16ddcf9f2c2f155f3318aa42db9d60138b84863e

SHA256
e75e8614c942591c5ef1a18db55f8cf955953c4b54363aac2953fae548fea669

SHA512
3a8cb41e4cfb4b106e8b121366eedd50f8653a368ac5c21224ed0090ee43ddcd5c828eda8734499e02fc131159311049b874cb79b66945d8078e4a6526587f70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1evexod\imagestore.dat

Filesize
9KB

MD5
f55892df2dbfe9ff5c04e97503be6272

SHA1
f1bb1e70aef5a0c588612b06aa6578d6fbdae74a

SHA256
1071f0e84db90e34db956a912ea305fe1e4eebb6fce5da2a7690051f9f06bdf5

SHA512
f66d2497bac6536b59db564178f9a95680124f8587a47f2b63ca84897629c52daad5ab345f54b08fb0e824b56e2a01989227330f5fd4865a43ef6aebd47e7d5e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K2D250WY.txt

Filesize
606B

MD5
8f0b8be95798e49f83bdfb33a35a8dd4

SHA1
389d6587529454bd34bd0da8863b57b79c13d400

SHA256
c9503b7e7fdc877989318d6e00cfeda690dfa72fbba10360c1515542738b2433

SHA512
3e1e78d9a5603cb049563a37834e5be842368a5b3a2185e9fadbed600307ee561b43bfef13c3f803a1f2835e3bc578722b78cdcf172328076899159d03d8ed98

Download Submit
memory/1172-61-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1172-63-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1172-69-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1172-70-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1172-71-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1172-72-0x0000000001FA0000-0x0000000001FAD000-memory.dmp

Filesize
52KB

Download
memory/1172-59-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1172-58-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1928-54-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1928-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1928-57-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download