Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 21:16
Static task
static1
Behavioral task
behavioral1
Sample
9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe
-
Size
1.2MB
-
MD5
d2bf483fba9f8c45f5e2c8ef73f7f3db
-
SHA1
6907d737daacc2be85ad508b99d6eaf18238747b
-
SHA256
9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e
-
SHA512
f6b131ae1456cd9ddc114ac3c0169e984972aeae84c44529c949558605dd24084377126c1f726d74381006ef56a34b5858aa14597512009b6ad3501a44881107
-
SSDEEP
24576:V1oWVB6F3KYAv9QqGz6rn9K5z1+XXYwCs:Q/dKbqz6rnswXXY
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\360saft = "C:\\Program Files\\Internet Explorer\\ie.exe" 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ie.exe 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe File opened for modification C:\Program Files\Internet Explorer\ie.exe 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe File created C:\Program Files\Internet Explorer\le.exe 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 9 IoCs
pid Process 1984 taskkill.exe 5048 taskkill.exe 396 taskkill.exe 3604 taskkill.exe 4244 taskkill.exe 4716 taskkill.exe 2092 taskkill.exe 5052 taskkill.exe 388 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 396 taskkill.exe Token: SeDebugPrivilege 5048 taskkill.exe Token: SeDebugPrivilege 3604 taskkill.exe Token: SeDebugPrivilege 388 taskkill.exe Token: SeDebugPrivilege 4244 taskkill.exe Token: SeDebugPrivilege 2092 taskkill.exe Token: SeDebugPrivilege 1984 taskkill.exe Token: SeDebugPrivilege 4716 taskkill.exe Token: SeDebugPrivilege 5052 taskkill.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3524 wrote to memory of 4244 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 80 PID 3524 wrote to memory of 4244 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 80 PID 3524 wrote to memory of 4244 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 80 PID 3524 wrote to memory of 4716 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 81 PID 3524 wrote to memory of 4716 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 81 PID 3524 wrote to memory of 4716 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 81 PID 3524 wrote to memory of 1984 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 83 PID 3524 wrote to memory of 1984 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 83 PID 3524 wrote to memory of 1984 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 83 PID 3524 wrote to memory of 5048 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 85 PID 3524 wrote to memory of 5048 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 85 PID 3524 wrote to memory of 5048 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 85 PID 3524 wrote to memory of 2092 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 87 PID 3524 wrote to memory of 2092 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 87 PID 3524 wrote to memory of 2092 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 87 PID 3524 wrote to memory of 396 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 89 PID 3524 wrote to memory of 396 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 89 PID 3524 wrote to memory of 396 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 89 PID 3524 wrote to memory of 3604 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 90 PID 3524 wrote to memory of 3604 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 90 PID 3524 wrote to memory of 3604 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 90 PID 3524 wrote to memory of 5052 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 92 PID 3524 wrote to memory of 5052 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 92 PID 3524 wrote to memory of 5052 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 92 PID 3524 wrote to memory of 388 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 96 PID 3524 wrote to memory of 388 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 96 PID 3524 wrote to memory of 388 3524 9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe"C:\Users\Admin\AppData\Local\Temp\9ea8802ad7f3eaac9e578939b75fd0c280bec567bcbe5c975f53841a1626d54e.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4244
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KVXP.kxp2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1984
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:396
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360sd.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360rp.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:388
-