Analysis
-
max time kernel
133s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 15:07
Static task
static1
Behavioral task
behavioral1
Sample
9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe
-
Size
49KB
-
MD5
4a61c1bd26498d8d6d40bde39fd65fa1
-
SHA1
43e40151601cc0cf6cd2e9a4cf1d34b93cee569b
-
SHA256
9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578
-
SHA512
38b00021b1d0e678810a4f78f4ab68e6ce8001b6dd093395c7291974f4043c608fa264f15d6a3a7d4ded689fc2817a4ab603c2f3c602325653f00507970a5ced
-
SSDEEP
384:BbVWjDvtK+pTr+P7lf19XZt5hBxkcb1lpl8rC8Ska8de7jyrN+vQdML4N+ngsx3z:iDsS418pDUouKMLGOla
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Modems = "\"C:\\TEMP01\\userFiles\\dataFiles\\AlmostThere\\keepGoing\\Here\\openFolder.exe\"" 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe -
Drops autorun.inf file 1 TTPs 9 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\ic_tek\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe File created C:\Downloads\Web\FreeStuffs\More\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe File opened for modification C:\UserData\TempFiles\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe File opened for modification C:\TEMP01\userFiles\dataFiles\AlmostThere\keepGoing\Here\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe File created C:\ic_tek\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe File created C:\Programm\Media\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe File created C:\Programm\Web\Services\Vista\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe File created C:\UserData\TempFiles\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe File created C:\TEMP01\userFiles\dataFiles\AlmostThere\keepGoing\Here\autorun.inf 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: 33 1796 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1796 AUDIODG.EXE Token: 33 1796 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1796 AUDIODG.EXE Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe Token: SeShutdownPrivilege 960 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe -
Suspicious use of SendNotifyMessage 15 IoCs
pid Process 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe 960 explorer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 916 wrote to memory of 1592 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 29 PID 916 wrote to memory of 1592 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 29 PID 916 wrote to memory of 1592 916 9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe"C:\Users\Admin\AppData\Local\Temp\9fd754de933b5340912f3c96f385d1906d869d79ce8f661f93fc658e2bdd1578.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵PID:1592
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:960
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5841⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796