Analysis
-
max time kernel
217s -
max time network
232s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 11:28
Static task
static1
Behavioral task
behavioral1
Sample
a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe
Resource
win7-20220812-en
General
-
Target
a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe
-
Size
95KB
-
MD5
92abcb46ed44b6f5e4457839d63c048f
-
SHA1
d409f13652b6bd456a3b08ccc775392950aa3739
-
SHA256
a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80
-
SHA512
cbfda6d0a54f59612a581929d33ff6deb2faba9e781227c933a255c1f067e7736f484346bc7ab9e1acc3ea2192a3731ab3e57ad6592810bb0d41b415a2306fa6
-
SSDEEP
1536:u7dkoVi9I2VK/JmpMZGH7+NICr3DUDloBzq3GmT2BbahE7jwaaHw7Koj4rhfu+u1:mdkoV4I2VK/Jmp6Gb+eCDgb3GmT2Bb5B
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
waxlirokiwplaosc.exepid process 2096 waxlirokiwplaosc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 628 1348 WerFault.exe svchost.exe 4468 2388 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011805" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2497432081" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A78D51BB-9FD0-11ED-B5DD-E2CDD1D11107} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381760384" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011805" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2202275930" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2202275930" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011805" IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 660 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exewaxlirokiwplaosc.exedescription pid process Token: SeSecurityPrivilege 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe Token: SeDebugPrivilege 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe Token: SeSecurityPrivilege 2096 waxlirokiwplaosc.exe Token: SeLoadDriverPrivilege 2096 waxlirokiwplaosc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
IEXPLORE.EXEpid process 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE 4548 IEXPLORE.EXE 4548 IEXPLORE.EXE 4548 IEXPLORE.EXE 4548 IEXPLORE.EXE 1156 IEXPLORE.EXE 1156 IEXPLORE.EXE 3780 IEXPLORE.EXE 3780 IEXPLORE.EXE 3780 IEXPLORE.EXE 3780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exeiexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1348 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 776 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe iexplore.exe PID 1892 wrote to memory of 776 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe iexplore.exe PID 1892 wrote to memory of 776 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe iexplore.exe PID 776 wrote to memory of 1156 776 iexplore.exe IEXPLORE.EXE PID 776 wrote to memory of 1156 776 iexplore.exe IEXPLORE.EXE PID 1156 wrote to memory of 4548 1156 IEXPLORE.EXE IEXPLORE.EXE PID 1156 wrote to memory of 4548 1156 IEXPLORE.EXE IEXPLORE.EXE PID 1156 wrote to memory of 4548 1156 IEXPLORE.EXE IEXPLORE.EXE PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 2388 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe svchost.exe PID 1892 wrote to memory of 1964 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe iexplore.exe PID 1892 wrote to memory of 1964 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe iexplore.exe PID 1892 wrote to memory of 1964 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe iexplore.exe PID 1964 wrote to memory of 2584 1964 iexplore.exe IEXPLORE.EXE PID 1964 wrote to memory of 2584 1964 iexplore.exe IEXPLORE.EXE PID 1156 wrote to memory of 3780 1156 IEXPLORE.EXE IEXPLORE.EXE PID 1156 wrote to memory of 3780 1156 IEXPLORE.EXE IEXPLORE.EXE PID 1156 wrote to memory of 3780 1156 IEXPLORE.EXE IEXPLORE.EXE PID 1892 wrote to memory of 2096 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe waxlirokiwplaosc.exe PID 1892 wrote to memory of 2096 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe waxlirokiwplaosc.exe PID 1892 wrote to memory of 2096 1892 a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe waxlirokiwplaosc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe"C:\Users\Admin\AppData\Local\Temp\a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 2043⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1156 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1156 CREDAT:82950 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 2043⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\waxlirokiwplaosc.exe"C:\Users\Admin\AppData\Local\Temp\waxlirokiwplaosc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1348 -ip 13481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2388 -ip 23881⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD50518b0c986ebecc2e8b7d18563f3a3f9
SHA1f64c6bf2713c74c0519bc4dfbb1ef2d361d8fa0f
SHA2565beab60b4c60e1dd16a188541199742eb97df28aa6a3e41f7dcabc1c75dee492
SHA512a49b8b37bc4d23c631e891b9cc8921bc724f52a66c59f01823536423336fd387223f544ff6de19db5ed691a18285004bc2a1fc5730f4165e26b89479713f9915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD53fbca63c0132e7c5eb3b32fdb6eebcd6
SHA1560af40f4c6a058d02cd9d5bd8a6553a1401f2de
SHA256feee789a4bbeacb36c08638c4df8eee590c8da4637f8e078e54fdeb1d423e708
SHA51213dfff060a40449772c31b90fcc3efeef4a1e2be4f266f34ed3ebb07b380eab770ef421ff35abd73ba16bece3b2b9702d739597a4293d8ae8dbf5f2c36c51ece
-
C:\Users\Admin\AppData\Local\Temp\waxlirokiwplaosc.exeFilesize
95KB
MD592abcb46ed44b6f5e4457839d63c048f
SHA1d409f13652b6bd456a3b08ccc775392950aa3739
SHA256a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80
SHA512cbfda6d0a54f59612a581929d33ff6deb2faba9e781227c933a255c1f067e7736f484346bc7ab9e1acc3ea2192a3731ab3e57ad6592810bb0d41b415a2306fa6
-
C:\Users\Admin\AppData\Local\Temp\waxlirokiwplaosc.exeFilesize
95KB
MD592abcb46ed44b6f5e4457839d63c048f
SHA1d409f13652b6bd456a3b08ccc775392950aa3739
SHA256a78aa7e8cb918a202fbc37863674fea1008063e771cc440f2e466bd1cc418f80
SHA512cbfda6d0a54f59612a581929d33ff6deb2faba9e781227c933a255c1f067e7736f484346bc7ab9e1acc3ea2192a3731ab3e57ad6592810bb0d41b415a2306fa6
-
memory/1348-133-0x0000000000000000-mapping.dmp
-
memory/1892-134-0x0000000000400000-0x000000000043A0EC-memory.dmpFilesize
232KB
-
memory/1892-141-0x0000000000400000-0x000000000043A0EC-memory.dmpFilesize
232KB
-
memory/2096-137-0x0000000000000000-mapping.dmp
-
memory/2096-140-0x0000000000400000-0x000000000043A0EC-memory.dmpFilesize
232KB
-
memory/2096-142-0x0000000000400000-0x000000000043A0EC-memory.dmpFilesize
232KB
-
memory/2096-143-0x0000000000400000-0x000000000043A0EC-memory.dmpFilesize
232KB
-
memory/2388-136-0x0000000000000000-mapping.dmp