Analysis
-
max time kernel
76s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18/12/2022, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe
-
Size
712KB
-
MD5
317bd4f007363543ce5ba2f0e17dbc39
-
SHA1
4d8a8d810113182286ff8af6a645b0f9a238e8a1
-
SHA256
b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44
-
SHA512
96d2a43c2eb4bc27bde4e95c1327481c993754f9f82554782e53167591b22669ac5844085b7e1017fd2cb3475128f0518c74adde8ce9ca44b85071f8ef30f25e
-
SSDEEP
12288:svJyN0GaWUhvm6Yp7TYmWH90Zuvafi4NigK/Br3:sv4qTkTY9HiZuvSi4NYr3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b96984f25d38ad479238fbb4a0f572240000000002000000000010660000000100002000000036875f0c9481418d2898fc24f7383d141b9c9ca7fde7a3d28259b61c781dbe67000000000e8000000002000020000000872616b8f26916fd432ec520825db70a6068670f38baaefa16e9dce7f3e9d26f20000000eebd6ad895c874ce28dbe8544ef7e095fe01bd84e7fed35bea314962ffb5b8bb400000006135e3d3638c824da996b3feb06088cff02f4ee16a4a8ddc04f898cb5a1fcbbfcb64dc943eba61f3b822004ec8c2eeba3ae32d3967f48903dd7f13f25fac7f53 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b96984f25d38ad479238fbb4a0f572240000000002000000000010660000000100002000000027a4fa5542064c609570506b686075871cfcd855a73e404b0ec6ff1f15c4327e000000000e800000000200002000000009ff071b4ce43fe08554024754775d4d423373e4e3b5b15e0133b045fa5ac81b900000006acadc3710ad5ee0877750c7604ba669252dca3a1835248f871c66822c2459146b4185e0ea9084cc8081ac6639f925025f3e8acc720662448bc8b972fb3670ff360da3eae70c8c66b88efaa5e7e85b75e2cdbf873f0e815f7a2a0a202c23699b473b683357e24b22f8cf157797d98ab12b9665c493474bc0365cc143c0bf68c36c689c4e798e68e3d368e75305ceb5804000000095755066a60929573bca91c05b1b498df460c13fb54657643be328c47c42c51037b44184ca6c06211ffe4268ac44b96bd2deb0dc51156c0b7e25b8b2f748d6fa iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "378160925" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503408e22013d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{066577E1-7F14-11ED-BDAB-FE41811C61F5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1172 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1736 b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe 1736 b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe 1172 iexplore.exe 1172 iexplore.exe 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1736 wrote to memory of 1172 1736 b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe 27 PID 1736 wrote to memory of 1172 1736 b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe 27 PID 1736 wrote to memory of 1172 1736 b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe 27 PID 1736 wrote to memory of 1172 1736 b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe 27 PID 1172 wrote to memory of 1500 1172 iexplore.exe 29 PID 1172 wrote to memory of 1500 1172 iexplore.exe 29 PID 1172 wrote to memory of 1500 1172 iexplore.exe 29 PID 1172 wrote to memory of 1500 1172 iexplore.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe"C:\Users\Admin\AppData\Local\Temp\b5562145a1931a3768c3ea4e5843eb771a5295d4873f1118ff1a8225b23c3f44.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://kzz.mf531.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1500
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
603B
MD508177a790698b09b73c04d3fc24cc001
SHA1a32fecaf0bf899c7eb2ffc8bab9e74656b5bacb9
SHA256ee476d4e2de8aaaed03acd4a11f8c7dca789a708f13fe96e6c4d3172e62fed9c
SHA512b35f35d1fc582cde9de4eb3319f69a736ea370ca0af5330939696510a1b6a536f17ce3cabde5e03724563b571e4236dadcdbb61f3a8986dd9ed67652d69f4852