Analysis
-
max time kernel
136s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 09:53
Static task
static1
Behavioral task
behavioral1
Sample
a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe
-
Size
548KB
-
MD5
ab9481150fe8215d11c616e13df4a2f6
-
SHA1
29c3d66fc3b61613f0a542bf41ffb5a64d9cbe75
-
SHA256
a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64
-
SHA512
219500a87890c6721ab758abeee101527b5c97d7c2968f440b55620e72f3b2bfe07ddd0b64c1e19fdf4606b97797205e7619b038f184864bbfb71fe3d1a3144a
-
SSDEEP
6144:zau1UioOm1xJ3T1h/YoU+oBWGRTFo9neex+2LQKHK:zau1UiowWGxax+2L
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmplayer = "C:\\MessengerPlus\\mplayer2.exe" a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA538E71-78CE-11ED-A503-626C2AE6DC56} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000837c82cf0d97f040a1c3a45ad1492274000000000200000000001066000000010000200000008e663586137c9a25cc6f30aadb5a4106f81e7991437269890be61612ec286bd4000000000e8000000002000020000000061362dcd5f0c929db55ed6dd2f7c5458d26abe08f1f5d00ec2c3f4465e861ad90000000be2c7fcb12d149e56c043e6d78a1883ab59b72bc8e5a38cefc8f9b0c836b3ddd50e6e6fd90b8ff64075296fddcec2b854826afb35170f0b9ce6d47586ef4d7825afc3851eb37ab737785ad604a7b7e30b96a6a97addd69e6d09defa8928d2a2dd968f225d900ba650d139fca7af3b16d6c77b601e40ed34a9409cb456665c6530174731f752b23f46d092717888b063f40000000d43e7c8542a32ae8e2bbd2ace6f2ab3e7003b96962825404784dcedb90694366dfb01705ee137c775cdcc317ce11abf07f41d60fdc8712d692bd0caa040b429d iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no" a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377471544" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60519fdcdb0cd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Download a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000837c82cf0d97f040a1c3a45ad149227400000000020000000000106600000001000020000000a27eee061e456e30918e2f54277dc4d39c9336933f50e79b21f8f09d3bd023df000000000e800000000200002000000007831ef8f94eb83ea5d6a3d464c00524fa3e56a7057ebb585654ef80159b7e1120000000181111ebd3434452166613960bdbf4ef8763ebb1e80e4e72921e346503951c104000000046cbf5403f5cf38d2634b713d42d3121595c4ae0a71c6e2efa0f839f6d6bb325b43d5646147bf061fcc1a082b3cb8a8178e17d2a5faef020e815fda311279cfc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "00000001" a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1800 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 1800 iexplore.exe 1800 iexplore.exe 948 IEXPLORE.EXE 948 IEXPLORE.EXE 948 IEXPLORE.EXE 948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1800 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 27 PID 1672 wrote to memory of 1800 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 27 PID 1672 wrote to memory of 1800 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 27 PID 1672 wrote to memory of 1800 1672 a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe 27 PID 1800 wrote to memory of 948 1800 iexplore.exe 29 PID 1800 wrote to memory of 948 1800 iexplore.exe 29 PID 1800 wrote to memory of 948 1800 iexplore.exe 29 PID 1800 wrote to memory of 948 1800 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe"C:\Users\Admin\AppData\Local\Temp\a93d24db4644df42205cbe01db7afb11c7d0767ba3509b96472d72f1bd4a0b64.exe"1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.youtube.com/watch?v=ZvizXaqutWM2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:948
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize340B
MD5ccf7ddcab740be17f6f4d490fbc121a3
SHA17fdbf50ba37f7d741b5344b6c3b330cba354f1ea
SHA25695497d743fc269f7f8edd0888b031264ece8fc9b6f2d7aad051b909772f53ab6
SHA5124b3b84163a700db88d81493344b09ca88198c4894d4accd83bf9cfae5f79c40b6cbabeb2f5a444f005962fc7b95e99b6ea610be87961d5f6e70fb2173a312b77
-
Filesize
5KB
MD5721ea0dc49147b4f5fc4f1db9722baf2
SHA115e578518802bf14a7e82a79e9881d5a4ea61412
SHA25698f68384dd004cb0252ba9d014ef7b88923ab67dc249f5da059c54875a7458a1
SHA51274137141fd1a6b1765e938b1180107481371d671af3f657d718188d5a2d26c6d540644c82040a65a2607a1c75238bf0cbb645c52b79f23c9ba0db3d2164c848c
-
Filesize
601B
MD57b63816883453d9d34fbb83defc1d1ea
SHA1d6403fbb2c678f31c3d7773039d9997409e36dc2
SHA2561e49899c66b9ad32b85548448d5cce0b25130d052cbf6794fde115f2b57bdcf1
SHA5127dc2fbe6bdca52bf2267a9e32b43e6e1b378698547f4c226de85d7b84f8f9e511974798addaf47ac29e6dcb404bdce07f133411e0c42049a5fe4b88c09def249