Analysis
-
max time kernel
161s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 22:45
Behavioral task
behavioral1
Sample
926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe
Resource
win7-20220812-en
General
-
Target
926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe
-
Size
120KB
-
MD5
fcc3e83c605961ce711a28522be916f6
-
SHA1
18681477b75de6979d9d3c857fa09f72da36ec90
-
SHA256
926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b
-
SHA512
b7fa234511234e1c81980d18c34021d5aa93f6c120f4c2be96eb2fbc8dafc24b622d9fc71c18ff75520ba7ac284ecf46f771a0ca333089db4a7d6fc42d1268ad
-
SSDEEP
3072:Ig+3fh/PHrgNUqOBx4J2vNbGfvGnd3gW5ZM4/uBnh:h+3fRb9NdndPZMT7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
jcbqdctseuljtvnr.exepid process 4252 jcbqdctseuljtvnr.exe -
Processes:
resource yara_rule behavioral2/memory/4340-134-0x0000000000400000-0x000000000043957C-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jcbqdctseuljtvnr.exe upx behavioral2/memory/4340-140-0x0000000000400000-0x000000000043957C-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\jcbqdctseuljtvnr.exe upx behavioral2/memory/4252-141-0x0000000000400000-0x000000000043957C-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4088 2476 WerFault.exe svchost.exe 3664 4632 WerFault.exe svchost.exe -
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3804839109" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011899" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0CF54DAA-A02F-11ED-89AC-4A8324823CC0} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3804839109" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3991245405" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381800937" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011899" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011899" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3308 iexplore.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 648 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exejcbqdctseuljtvnr.exedescription pid process Token: SeSecurityPrivilege 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe Token: SeDebugPrivilege 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe Token: SeSecurityPrivilege 4252 jcbqdctseuljtvnr.exe Token: SeLoadDriverPrivilege 4252 jcbqdctseuljtvnr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 3308 iexplore.exe 3308 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 3308 iexplore.exe 3308 iexplore.exe 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE 3736 IEXPLORE.EXE 3308 iexplore.exe 3308 iexplore.exe 3104 IEXPLORE.EXE 3104 IEXPLORE.EXE 3104 IEXPLORE.EXE 3104 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exeiexplore.exedescription pid process target process PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 2476 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 3308 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe iexplore.exe PID 4340 wrote to memory of 3308 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe iexplore.exe PID 3308 wrote to memory of 3736 3308 iexplore.exe IEXPLORE.EXE PID 3308 wrote to memory of 3736 3308 iexplore.exe IEXPLORE.EXE PID 3308 wrote to memory of 3736 3308 iexplore.exe IEXPLORE.EXE PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 4632 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe svchost.exe PID 4340 wrote to memory of 1568 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe iexplore.exe PID 4340 wrote to memory of 1568 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe iexplore.exe PID 3308 wrote to memory of 3104 3308 iexplore.exe IEXPLORE.EXE PID 3308 wrote to memory of 3104 3308 iexplore.exe IEXPLORE.EXE PID 3308 wrote to memory of 3104 3308 iexplore.exe IEXPLORE.EXE PID 4340 wrote to memory of 4252 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe jcbqdctseuljtvnr.exe PID 4340 wrote to memory of 4252 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe jcbqdctseuljtvnr.exe PID 4340 wrote to memory of 4252 4340 926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe jcbqdctseuljtvnr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe"C:\Users\Admin\AppData\Local\Temp\926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 2043⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3308 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3308 CREDAT:82950 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 2083⤵
- Program crash
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\jcbqdctseuljtvnr.exe"C:\Users\Admin\AppData\Local\Temp\jcbqdctseuljtvnr.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2476 -ip 24761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4632 -ip 46321⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD50518b0c986ebecc2e8b7d18563f3a3f9
SHA1f64c6bf2713c74c0519bc4dfbb1ef2d361d8fa0f
SHA2565beab60b4c60e1dd16a188541199742eb97df28aa6a3e41f7dcabc1c75dee492
SHA512a49b8b37bc4d23c631e891b9cc8921bc724f52a66c59f01823536423336fd387223f544ff6de19db5ed691a18285004bc2a1fc5730f4165e26b89479713f9915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD56f2f62307f534b687064b34f30e94251
SHA1ae535ce69d19d94ff8adddf21168ffd8ffaf8336
SHA256f445656fa2f7be40e5c492d5ad7d6d6cd23b19cebfaa7b337d02e5a4bb973f60
SHA5128abe8cbee1f651f8f0a75d43c6cc137fbcfe8949132170d5c2d09591c8fc1cbdd26485306ee064261a1411e955d517d9d5ef8a9bc39117b3c314ed92a326cbf7
-
C:\Users\Admin\AppData\Local\Temp\jcbqdctseuljtvnr.exeFilesize
120KB
MD5fcc3e83c605961ce711a28522be916f6
SHA118681477b75de6979d9d3c857fa09f72da36ec90
SHA256926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b
SHA512b7fa234511234e1c81980d18c34021d5aa93f6c120f4c2be96eb2fbc8dafc24b622d9fc71c18ff75520ba7ac284ecf46f771a0ca333089db4a7d6fc42d1268ad
-
C:\Users\Admin\AppData\Local\Temp\jcbqdctseuljtvnr.exeFilesize
120KB
MD5fcc3e83c605961ce711a28522be916f6
SHA118681477b75de6979d9d3c857fa09f72da36ec90
SHA256926bf338297a71450377e65aa6c0078e71faa674a08b8be39748d60124cec08b
SHA512b7fa234511234e1c81980d18c34021d5aa93f6c120f4c2be96eb2fbc8dafc24b622d9fc71c18ff75520ba7ac284ecf46f771a0ca333089db4a7d6fc42d1268ad
-
memory/2476-133-0x0000000000000000-mapping.dmp
-
memory/4252-137-0x0000000000000000-mapping.dmp
-
memory/4252-141-0x0000000000400000-0x000000000043957C-memory.dmpFilesize
229KB
-
memory/4340-134-0x0000000000400000-0x000000000043957C-memory.dmpFilesize
229KB
-
memory/4340-140-0x0000000000400000-0x000000000043957C-memory.dmpFilesize
229KB
-
memory/4632-136-0x0000000000000000-mapping.dmp