4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773

Analysis

max time kernel
91s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2022, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe
Size

363KB
MD5

54919e1bd37c6431b3b1b8b6d53aabfe
SHA1

c2327bab84fa0d55cc23ee5006c83f0a6dc53e4c
SHA256

4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773
SHA512

9b1d07e28cc63075748d42c2afdac6f55332d35dcd791c93ecfbe73d5868c3fbc84558f0778358e576babb955210b4fc79a263fa703009ed247391ccc3790722
SSDEEP

6144:5aPIWVeTdJKsLxgcSNDQL5Q9VuwLmh0kdH371oe:5uTs1gBpQL5kmh0671oe

Score

8^/10

persistence ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4076	conlhost.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\SkipMeasure.tiff	conlhost.exe
File opened for modification	C:\Users\Admin\Pictures\SwitchSplit.tiff	conlhost.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\allkeeper = "C:\\users\\Public\\conlhost.exe"	REG.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4076	4828	4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe	87
PID 4828 wrote to memory of 4076	4828	4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe	87
PID 4828 wrote to memory of 4076	4828	4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe	87
PID 4076 wrote to memory of 5112	4076	conlhost.exe	88
PID 4076 wrote to memory of 5112	4076	conlhost.exe	88
PID 4076 wrote to memory of 5112	4076	conlhost.exe	88
PID 4076 wrote to memory of 4916	4076	conlhost.exe	91
PID 4076 wrote to memory of 4916	4076	conlhost.exe	91
PID 4076 wrote to memory of 4916	4076	conlhost.exe	91
PID 4076 wrote to memory of 1512	4076	conlhost.exe	94
PID 4076 wrote to memory of 1512	4076	conlhost.exe	94
PID 4076 wrote to memory of 1512	4076	conlhost.exe	94

C:\Users\Admin\AppData\Local\Temp\4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe
"C:\Users\Admin\AppData\Local\Temp\4f60e0c2fc72ccd0d3daec562d158884ef4110c215c873c440fc10f8d0593773.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4828
- C:\users\Public\conlhost.exe
  "C:\users\Public\conlhost.exe"
  2⤵
  - Executes dropped EXE
  - Modifies extensions of user files
  - Suspicious use of WriteProcessMemory
  PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\users\Public\del.bat
    3⤵
    PID:5112
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "allkeeper" /t REG_SZ /d "C:\users\Public\conlhost.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:4916
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE" /v "crypted" /t REG_SZ /d "1" /reg:64
    3⤵
    PID:1512

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\conlhost.exe

Filesize
363KB

MD5
6ae3972a5005734b35076d52bafa2539

SHA1
6e6aa2ae0cdb70950d6140eda5893753e701c56b

SHA256
6a71f5670cae6a0f2e64d6ae92aa1a6e64cf6608b6272306cb848f77114e86aa

SHA512
7dbf64874d55eb62f52f3a1427bde48e4ec8a5cfcd1aa97946555de8b0c2b90e4d00d31ea6e01660e1905de11394ddf62225f80d79e02fa25c20cb2720d39379

Download Submit
C:\users\Public\conlhost.exe

Filesize
363KB

MD5
6ae3972a5005734b35076d52bafa2539

SHA1
6e6aa2ae0cdb70950d6140eda5893753e701c56b

SHA256
6a71f5670cae6a0f2e64d6ae92aa1a6e64cf6608b6272306cb848f77114e86aa

SHA512
7dbf64874d55eb62f52f3a1427bde48e4ec8a5cfcd1aa97946555de8b0c2b90e4d00d31ea6e01660e1905de11394ddf62225f80d79e02fa25c20cb2720d39379

Download Submit
C:\users\Public\del.bat

Filesize
130B

MD5
7a7b5ecbedf88d68ebaadc94b4d4aa28

SHA1
ddd995ab350655c23eac808d86102094bb8263d2

SHA256
efa0f89bf88e23b3de5931571c180ae80bd784b02ea1e5f433e84fe8d3fd9c82

SHA512
8b9b7829d05755106292f5d90cb1c483360a5e4c81d484f32521003b9f7f9dda6957a2a8c1de7e08a7bcf80980030ba79ff8838374834b96077f3f4288c87578

Download Submit