Analysis
-
max time kernel
156s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:12
Behavioral task
behavioral1
Sample
ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe
Resource
win7-20220812-en
General
-
Target
ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe
-
Size
200KB
-
MD5
9d690127d647ba4d09d0ed689cac0453
-
SHA1
ab9cfc80609d094efbab60ff9afcb5d30d1435e6
-
SHA256
ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3
-
SHA512
6c1d230edb9acff06f8970febf64f05d747010feb06ae00c4c63f3bc2d6f97a2ae6547279ea040f338657d63e5430954f7d036c38271b52ffbcfc897f3da691f
-
SSDEEP
3072:XtF9bBJwMcZOz+GLRATw8dtCCLsoB0eQKqERRYmx9a+IuSxJI1CTlJo2xHiJ53Mr:JBROOztLRuwc5xRRBJ/1CTlJzA36Nsun
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
enrollenroll.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat enrollenroll.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
enrollenroll.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" enrollenroll.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 enrollenroll.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadNetworkName = "Network 3" enrollenroll.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 enrollenroll.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix enrollenroll.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings enrollenroll.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionReason = "1" enrollenroll.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionTime = 0000aeb41534d901 enrollenroll.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecision = "0" enrollenroll.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections enrollenroll.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9} enrollenroll.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e enrollenroll.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" enrollenroll.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 enrollenroll.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad enrollenroll.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionTime = 0000aeb41534d901 enrollenroll.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecision = "0" enrollenroll.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\d6-a6-83-9c-54-3e enrollenroll.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings enrollenroll.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" enrollenroll.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionReason = "1" enrollenroll.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
enrollenroll.exepid process 1964 enrollenroll.exe 1964 enrollenroll.exe 1964 enrollenroll.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exepid process 1992 ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exeba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exeenrollenroll.exeenrollenroll.exepid process 1448 ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe 1992 ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe 1984 enrollenroll.exe 1964 enrollenroll.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exeenrollenroll.exedescription pid process target process PID 1448 wrote to memory of 1992 1448 ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe PID 1448 wrote to memory of 1992 1448 ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe PID 1448 wrote to memory of 1992 1448 ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe PID 1448 wrote to memory of 1992 1448 ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe PID 1984 wrote to memory of 1964 1984 enrollenroll.exe enrollenroll.exe PID 1984 wrote to memory of 1964 1984 enrollenroll.exe enrollenroll.exe PID 1984 wrote to memory of 1964 1984 enrollenroll.exe enrollenroll.exe PID 1984 wrote to memory of 1964 1984 enrollenroll.exe enrollenroll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe"C:\Users\Admin\AppData\Local\Temp\ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ba309d71b27e294159587a0a02f25912a057294a6aca9dc384bc733b32c93cf3.exe--4539f4ff2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\enrollenroll.exe"C:\Windows\SysWOW64\enrollenroll.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\enrollenroll.exe--aed4c19e2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1448-54-0x00000000002A0000-0x00000000002BB000-memory.dmpFilesize
108KB
-
memory/1448-56-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1448-57-0x00000000002A0000-0x00000000002BB000-memory.dmpFilesize
108KB
-
memory/1964-60-0x0000000000000000-mapping.dmp
-
memory/1964-62-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1964-64-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1992-55-0x0000000000000000-mapping.dmp
-
memory/1992-58-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1992-59-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/1992-61-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB