Analysis
-
max time kernel
151s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 19:31
Static task
static1
Behavioral task
behavioral1
Sample
f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe
-
Size
31KB
-
MD5
8d034cc389be6fb5d245e6b51f433924
-
SHA1
d20f6c08fa3132ad924dcf911cb5262129e2a995
-
SHA256
f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878
-
SHA512
8f3c7b0d0b7fc9f3e2ef1bef6d1734c768d14131f7b35be7ea10d835f6886adbaad5771a8a25e0532781b39c3de51edbede6fe607357496f5fad1b7035e6f5e6
-
SSDEEP
768:6Kzy3t49hU9zy5HILSvnxJAMgHSPtmg8E/WSwVy:6IyuU9zy5IL6ugyB
Score
8/10
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\64to32\Parameters\ServiceDll = "C:\\Windows\\system32\\64to32.dll" f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe -
Deletes itself 1 IoCs
pid Process 1964 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1204 svchost.exe -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 208.67.220.220 Destination IP 208.67.220.220 -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\64to32.dll f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe File opened for modification C:\Windows\SysWOW64\Windowsxp32.ini svchost.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat svchost.exe File opened for modification C:\Windows\SysWOW64\Windowsxp.ini svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\0a-33-9c-04-9d-e4 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344} svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-33-9c-04-9d-e4\WpadDecisionTime = b0a65c484e0dd901 svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\WpadDecisionTime = b0a65c484e0dd901 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\WpadDecision = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E921983C-2FAD-4A4F-83B0-DB8B61C93344}\WpadNetworkName = "Network 2" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 1760 f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe 1760 f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe 1760 f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe 1760 f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe 1204 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1964 1760 f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe 28 PID 1760 wrote to memory of 1964 1760 f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe 28 PID 1760 wrote to memory of 1964 1760 f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe 28 PID 1760 wrote to memory of 1964 1760 f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe"C:\Users\Admin\AppData\Local\Temp\f1da1ee273abd9eec295f5792df13075a10a36fe97391446ff1ac28f9cd2e878.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F1DA1E~1.EXE >> NUL2⤵
- Deletes itself
PID:1964
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1204
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD58f6fde7821d6d2908041d6dddabf8423
SHA1591f62ab4632609a5a7a208def9480daff497079
SHA2563f85c8788dd2b4e2b20c7bd617c4c9cf92d65ce9c8152874ed6f994b9ac4929a
SHA512470aa8d3b2302f2b5dc8a5400d080d233d3da81499f3bae5aa603cd3669317240cbb46844149545c5dd4f5569085fc5ca4d065197c3995451dd542313ce5a546
-
Filesize
68KB
MD58f6fde7821d6d2908041d6dddabf8423
SHA1591f62ab4632609a5a7a208def9480daff497079
SHA2563f85c8788dd2b4e2b20c7bd617c4c9cf92d65ce9c8152874ed6f994b9ac4929a
SHA512470aa8d3b2302f2b5dc8a5400d080d233d3da81499f3bae5aa603cd3669317240cbb46844149545c5dd4f5569085fc5ca4d065197c3995451dd542313ce5a546