Analysis
-
max time kernel
63s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-es -
resource tags
arch:x64arch:x86image:win7-20221111-eslocale:es-esos:windows7-x64systemwindows -
submitted
28/12/2022, 09:50
Static task
static1
Behavioral task
behavioral1
Sample
Thaiphoon.exe
Resource
win7-20221111-es
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
Thaiphoon.exe
Resource
win10v2004-20221111-es
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
libeay32.dll
Resource
win7-20220901-es
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral4
Sample
libeay32.dll
Resource
win10v2004-20221111-es
windows10-2004-x64
1 signatures
300 seconds
Behavioral task
behavioral5
Sample
ssleay32.dll
Resource
win7-20220812-es
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral6
Sample
ssleay32.dll
Resource
win10v2004-20221111-es
windows10-2004-x64
1 signatures
300 seconds
General
-
Target
Thaiphoon.exe
-
Size
1.0MB
-
MD5
ffceb29d2c557b891f0fe96aa296d5bd
-
SHA1
5ef816442e0fee4c1bb0796013b6f09ef2a66c6b
-
SHA256
a1133e389c159d105656dff27c96b715a922e5115eb3a624de5b9fd08cafb1e5
-
SHA512
340dd53d699a1e09e894ead9f309c41474083c227035d8973bdd79fbd91f4df28f3309ef387d947cb8a341f5a671bfa5d04f223f70952e7e7432c5b5af1e1eb4
-
SSDEEP
12288:YDHa8U8IS9pvOleifT4HgpNKHun78m8Y4KetRTi7igp+PSrubnU/MD5XtysrN8L9:Y2IIS9pvO5TgZu7zL4XTimWuwMD5Xci
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\DRIVERS\ssgdio64.sys Thaiphoon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main Thaiphoon.exe -
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.thp Thaiphoon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ThaiphoonBurner\ = "Thaiphoon SPD Dump File" Thaiphoon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ThaiphoonBurner\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Thaiphoon.exe\" \"%1\"" Thaiphoon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ThaiphoonBurner\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Thaiphoon.exe,1" Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000 Thaiphoon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Thaiphoon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1" Thaiphoon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16" Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff Thaiphoon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ThaiphoonBurner\DefaultIcon Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Thaiphoon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}" Thaiphoon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4" Thaiphoon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ThaiphoonBurner\shell\open Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC} Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Thaiphoon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ThaiphoonBurner Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000 Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy Thaiphoon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}" Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9} Thaiphoon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.thp\ = "ThaiphoonBurner" Thaiphoon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ThaiphoonBurner\shell\open\command Thaiphoon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ThaiphoonBurner\shell Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Thaiphoon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlgLegacy\TV_TopViewVersion = "0" Thaiphoon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders Thaiphoon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257" Thaiphoon.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Thaiphoon.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlgLegacy\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1" Thaiphoon.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 960 Thaiphoon.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 416 Process not Found -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 960 Thaiphoon.exe 960 Thaiphoon.exe 960 Thaiphoon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Thaiphoon.exe"C:\Users\Admin\AppData\Local\Temp\Thaiphoon.exe"1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:960