7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600

Analysis

max time kernel
113s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2022, 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe
Size

368KB
MD5

dc4ae2105938cb68c5b6988465e13da1
SHA1

4bf9313e1b4f51df9b94cf73e36adb53f8c29ac0
SHA256

7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600
SHA512

02ad76fcda95f5fc06bc8c5f0fa7e103379f7001e05f1bb23bfe1e67262bda8b045ae1f317569aa30a44566bf26bcb487ec9319f1a51fff79d57c40612b1bdf7
SSDEEP

6144:/aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371o0:/uTs1gBpQL5kmh0671o0

Score

8^/10

persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4564	conlhost.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\ConvertToResize.tiff	conlhost.exe
File opened for modification	C:\Users\Admin\Pictures\LimitHide.tiff	conlhost.exe
File opened for modification	C:\Users\Admin\Pictures\SetInstall.tiff	conlhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4564	4736	7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe	88
PID 4736 wrote to memory of 4564	4736	7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe	88
PID 4736 wrote to memory of 4564	4736	7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe	88
PID 4564 wrote to memory of 316	4564	conlhost.exe	89
PID 4564 wrote to memory of 316	4564	conlhost.exe	89
PID 4564 wrote to memory of 316	4564	conlhost.exe	89
PID 4564 wrote to memory of 3540	4564	conlhost.exe	92
PID 4564 wrote to memory of 3540	4564	conlhost.exe	92
PID 4564 wrote to memory of 3540	4564	conlhost.exe	92
PID 4564 wrote to memory of 1332	4564	conlhost.exe	96
PID 4564 wrote to memory of 1332	4564	conlhost.exe	96
PID 4564 wrote to memory of 1332	4564	conlhost.exe	96

C:\Users\Admin\AppData\Local\Temp\7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe
"C:\Users\Admin\AppData\Local\Temp\7138cd509c6c098feaf4128f7ed5b74a74a646e45137c6550f1231dbdac22600.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies extensions of user files
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    PID:316
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:3540
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\conlhost.exe

Filesize
368KB

MD5
4979467106a80fdffb634075385dfa92

SHA1
82ecccf5c32418b12f72aa06dbf6cd8473554e83

SHA256
0de070e106cbea6a47f09bd0d624ec8b7978a5e9b2fbb116340303b070fef93b

SHA512
2c6a39b309eb7d81ea95329623ba19b7ef3224003e21cc238a86ae97a24b65b6fb6d97a8153f88e5fcda7d832f2823bb19c18a2560f57e37a2c59c219a7912d2

Download Submit
C:\users\Public\conlhost.exe

Filesize
368KB

MD5
4979467106a80fdffb634075385dfa92

SHA1
82ecccf5c32418b12f72aa06dbf6cd8473554e83

SHA256
0de070e106cbea6a47f09bd0d624ec8b7978a5e9b2fbb116340303b070fef93b

SHA512
2c6a39b309eb7d81ea95329623ba19b7ef3224003e21cc238a86ae97a24b65b6fb6d97a8153f88e5fcda7d832f2823bb19c18a2560f57e37a2c59c219a7912d2

Download Submit
C:\users\Public\del.bat

Filesize
130B

MD5
c56da57d7cd38194bb77cf4af01c1303

SHA1
83d8aa6a0a1907d4b75f924d72a66ff4060adf93

SHA256
6a33e468731a7cf2265edd54e4275abcbef829d53f2557d0c2261175962a09f0

SHA512
51fbed1701adca7d915b302a01c01362cbc1e1a0b7f21615247d86a0defc1ca1af1a252bb5f0389390a0161a17d3675c29460383783aa29fbcc4bafe14eebdb4

Download Submit