Analysis
-
max time kernel
139s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:11
Behavioral task
behavioral1
Sample
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe
Resource
win7-20220812-en
General
-
Target
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe
-
Size
360KB
-
MD5
8c150a49cf075c56a977d5a5aa858b14
-
SHA1
a755d1e193c3d81eaa4a581a33f8d49cc7d10507
-
SHA256
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954
-
SHA512
9af5073d5e869009564b2d7c540c8918deeb4768d9f90ddd647c90c4a40a6583d8f3e671bb5330cf29b525683025b489af4b359ab68960092936db1ee3f0baab
-
SSDEEP
6144:IT9P02oCOcImaKGD0oEOGSerEhgVIXFMv:0PlosIHooDerLIXi
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
adammdmmcd.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat adammdmmcd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 22 IoCs
Processes:
adammdmmcd.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections adammdmmcd.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C0DAF255-CCBA-43AF-8385-67065F31E3C8} adammdmmcd.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-2a-95-5c-c4-06\WpadDecisionReason = "1" adammdmmcd.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C0DAF255-CCBA-43AF-8385-67065F31E3C8}\WpadDecisionTime = 208a02cf1534d901 adammdmmcd.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adammdmmcd.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adammdmmcd.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C0DAF255-CCBA-43AF-8385-67065F31E3C8}\WpadDecisionReason = "1" adammdmmcd.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C0DAF255-CCBA-43AF-8385-67065F31E3C8}\WpadDecisionTime = 000f578e1534d901 adammdmmcd.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-2a-95-5c-c4-06\WpadDecisionTime = 000f578e1534d901 adammdmmcd.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-2a-95-5c-c4-06\WpadDecision = "0" adammdmmcd.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-2a-95-5c-c4-06\WpadDetectedUrl adammdmmcd.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings adammdmmcd.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" adammdmmcd.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adammdmmcd.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C0DAF255-CCBA-43AF-8385-67065F31E3C8}\WpadDecision = "0" adammdmmcd.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C0DAF255-CCBA-43AF-8385-67065F31E3C8}\26-2a-95-5c-c4-06 adammdmmcd.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-2a-95-5c-c4-06\WpadDecisionTime = 208a02cf1534d901 adammdmmcd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings adammdmmcd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad adammdmmcd.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 adammdmmcd.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C0DAF255-CCBA-43AF-8385-67065F31E3C8}\WpadNetworkName = "Network 2" adammdmmcd.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\26-2a-95-5c-c4-06 adammdmmcd.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exec15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exeadammdmmcd.exeadammdmmcd.exepid process 1356 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe 1964 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe 480 adammdmmcd.exe 1268 adammdmmcd.exe 1268 adammdmmcd.exe 1268 adammdmmcd.exe 1268 adammdmmcd.exe 1268 adammdmmcd.exe 1268 adammdmmcd.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exepid process 1964 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exec15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exeadammdmmcd.exeadammdmmcd.exepid process 1356 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe 1964 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe 480 adammdmmcd.exe 1268 adammdmmcd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exeadammdmmcd.exedescription pid process target process PID 1356 wrote to memory of 1964 1356 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe PID 1356 wrote to memory of 1964 1356 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe PID 1356 wrote to memory of 1964 1356 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe PID 1356 wrote to memory of 1964 1356 c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe PID 480 wrote to memory of 1268 480 adammdmmcd.exe adammdmmcd.exe PID 480 wrote to memory of 1268 480 adammdmmcd.exe adammdmmcd.exe PID 480 wrote to memory of 1268 480 adammdmmcd.exe adammdmmcd.exe PID 480 wrote to memory of 1268 480 adammdmmcd.exe adammdmmcd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe"C:\Users\Admin\AppData\Local\Temp\c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe"C:\Users\Admin\AppData\Local\Temp\c15be020a73c9a655c49fdde613a8056729a7afbf13fde1d509d2b15ab9ca954.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\adammdmmcd.exe"C:\Windows\SysWOW64\adammdmmcd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\adammdmmcd.exe"C:\Windows\SysWOW64\adammdmmcd.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/480-59-0x0000000000360000-0x0000000000375000-memory.dmpFilesize
84KB
-
memory/1268-60-0x0000000000000000-mapping.dmp
-
memory/1268-62-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/1268-64-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/1356-55-0x0000000000220000-0x0000000000235000-memory.dmpFilesize
84KB
-
memory/1356-56-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1964-54-0x0000000000000000-mapping.dmp
-
memory/1964-57-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/1964-58-0x0000000075BA1000-0x0000000075BA3000-memory.dmpFilesize
8KB
-
memory/1964-61-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB