Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 13:39
Behavioral task
behavioral1
Sample
9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe
Resource
win10v2004-20220901-en
General
-
Target
9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe
-
Size
59KB
-
MD5
03c2cb1bd90746fde3cf01d95c60ffc3
-
SHA1
7768a2b1ca029225859fc903ba241e85741a9ebb
-
SHA256
9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c
-
SHA512
9f7ad295ae85687f8e707263dd86d44c3180e54dc4e426f3e5f38fce1d7e349c4d32ac860852b6781592df2a8685e71549be93738ceb65a17a207a560329d689
-
SSDEEP
1536:Y+1MKLlB0OcRIds0n7X+RzviRFmJUr1d/YYOVS4OFV:oKRB0vIm0bqeXmJmcAz
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ϵͳ°²È«Ä£¿é(Í£Ö¹¿ÉÄÜ»áÒýÆðϵͳ±ÀÀ£) = "D:\\Program\\360\\AliWangWang.exe" regedit.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ϵͳ°²È«Ä£¿é(Í£Ö¹¿ÉÄÜ»áÒýÆðϵͳ±ÀÀ£) = "D:\\Program\\360\\AliWangWang.exe" regedit.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\msscp.reg 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe File opened for modification C:\Windows\SysWOW64\msscp.reg 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\web\Index.htm 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe File opened for modification C:\Windows\web\Index.htm 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe File created C:\Windows\web\Index.html 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe File opened for modification C:\Windows\web\Index.html 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://455555.net" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://455555.net" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M) 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://455555.net" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D) 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O) 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "0" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\cdafile2 = "261837" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8} 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\1 = "20221211" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "1" 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R) 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe -
Runs .reg file with regedit 2 IoCs
pid Process 4596 regedit.exe 3948 regedit.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2148 wrote to memory of 4596 2148 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 80 PID 2148 wrote to memory of 4596 2148 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 80 PID 2148 wrote to memory of 4596 2148 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 80 PID 2148 wrote to memory of 2384 2148 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 81 PID 2148 wrote to memory of 2384 2148 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 81 PID 2148 wrote to memory of 2384 2148 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 81 PID 2384 wrote to memory of 3948 2384 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 82 PID 2384 wrote to memory of 3948 2384 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 82 PID 2384 wrote to memory of 3948 2384 9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe"C:\Users\Admin\AppData\Local\Temp\9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:4596
-
-
C:\Users\Admin\AppData\Local\Temp\9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exeC:\Users\Admin\AppData\Local\Temp\9dfe03868e7c446ecedc03dc79b77c34ee070cadeb1afa676345a9456e0cfd4c.exe2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg3⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:3948
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
185B
MD5d7b73041d7be52d03e44f61558f8505c
SHA1e39021ea1eb81bf0fc60c33b07affe8b4078b25a
SHA2560f944b298ab8f2484c6fabce5b7de1931fc3f502a743129c1af1790cd99d0bb8
SHA512a8c125eddce391da04d942eb1d40547cffc512c1aa9c55b4e4e320dfb3144d372b28a26f855408cbf6f112ea60e6f5842f4b1ae1810e48d92c3a174c17015050
-
Filesize
185B
MD5d7b73041d7be52d03e44f61558f8505c
SHA1e39021ea1eb81bf0fc60c33b07affe8b4078b25a
SHA2560f944b298ab8f2484c6fabce5b7de1931fc3f502a743129c1af1790cd99d0bb8
SHA512a8c125eddce391da04d942eb1d40547cffc512c1aa9c55b4e4e320dfb3144d372b28a26f855408cbf6f112ea60e6f5842f4b1ae1810e48d92c3a174c17015050