7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600

Analysis

max time kernel
113s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2022, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe
Size 368KB
Sample221220-mkdrnscd8v
SHA256 7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600
MD5 dc4ae2105938cb68c5b6988465e13da1
SHA1 4bf9313e1b4f51df9b94cf73e36adb53f8c29ac0
SHA512 02ad76fcda95f5fc06bc8c5f0fa7e103379f7001e05f1bb23bfe1e67262bda8b045ae1f317569aa30a44566bf26bcb487ec9319f1a51fff79d57c40612b1bdf7
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371o0:/uTs1gBpQL5kmh0671o0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4564	conlhost.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ConvertToResize.tiff	conlhost.exe
File opened for modification	C:\Users\Admin\Pictures\LimitHide.tiff	conlhost.exe
File opened for modification	C:\Users\Admin\Pictures\SetInstall.tiff	conlhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4564	4736	7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe	88
PID 4736 wrote to memory of 4564	4736	7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe	88
PID 4736 wrote to memory of 4564	4736	7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe	88
PID 4564 wrote to memory of 316	4564	conlhost.exe	89
PID 4564 wrote to memory of 316	4564	conlhost.exe	89
PID 4564 wrote to memory of 316	4564	conlhost.exe	89
PID 4564 wrote to memory of 3540	4564	conlhost.exe	92
PID 4564 wrote to memory of 3540	4564	conlhost.exe	92
PID 4564 wrote to memory of 3540	4564	conlhost.exe	92
PID 4564 wrote to memory of 1332	4564	conlhost.exe	96
PID 4564 wrote to memory of 1332	4564	conlhost.exe	96
PID 4564 wrote to memory of 1332	4564	conlhost.exe	96

C:\Users\Admin\AppData\Local\Temp\7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe
"C:\Users\Admin\AppData\Local\Temp\7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies extensions of user files
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    PID:316
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:3540
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

conlhost.exe

Path C:\Users\Public\conlhost.exe
Size 368KB
SHA256 0de070e106cbea6a47f09bd0d624ec8b7978a5e9b2fbb116340303b070fef93b
MD5 4979467106a80fdffb634075385dfa92
SHA1 82ecccf5c32418b12f72aa06dbf6cd8473554e83
SHA512 2c6a39b309eb7d81ea95329623ba19b7ef3224003e21cc238a86ae97a24b65b6fb6d97a8153f88e5fcda7d832f2823bb19c18a2560f57e37a2c59c219a7912d2
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oI:/uTs1gBpQL5kmh0671oI
MD5 SHA1 SHA512 SSDEEP

Submit Download

conlhost.exe

Path C:\users\Public\conlhost.exe
Size 368KB
SHA256 0de070e106cbea6a47f09bd0d624ec8b7978a5e9b2fbb116340303b070fef93b
MD5 4979467106a80fdffb634075385dfa92
SHA1 82ecccf5c32418b12f72aa06dbf6cd8473554e83
SHA512 2c6a39b309eb7d81ea95329623ba19b7ef3224003e21cc238a86ae97a24b65b6fb6d97a8153f88e5fcda7d832f2823bb19c18a2560f57e37a2c59c219a7912d2
SSDEEP 6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oI:/uTs1gBpQL5kmh0671oI
MD5 SHA1 SHA512 SSDEEP

Submit Download

del.bat

Path C:\users\Public\del.bat
Size 130B
SHA256 6a33e468731a7cf2265edd54e4275abcbef829d53f2557d0c2261175962a09f0
MD5 c56da57d7cd38194bb77cf4af01c1303
SHA1 83d8aa6a0a1907d4b75f924d72a66ff4060adf93
SHA512 51fbed1701adca7d915b302a01c01362cbc1e1a0b7f21615247d86a0defc1ca1af1a252bb5f0389390a0161a17d3675c29460383783aa29fbcc4bafe14eebdb4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads