Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:21
Behavioral task
behavioral1
Sample
5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe
Resource
win7-20220901-en
General
-
Target
5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe
-
Size
139KB
-
MD5
a0305a77c02444357ef9b7e75eab4cf2
-
SHA1
c2624bbf3e4ac11defe87c906d1d117d6dd13448
-
SHA256
5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d
-
SHA512
8bfd8ee70f01560a12e14644997e34b4c25d0ad748fa4417c43930aaa935d3e4d298e4664b2089a8ef45a09e4051f1874df9669766e7b2b0dffcfb96b2de0f42
-
SSDEEP
3072:vKf26p04PgDvcLVonnjqP6R8pmg+dXVWRJDjZj7:vKu6pxxieP6AmvCDd/
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
licsphoenix.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat licsphoenix.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
licsphoenix.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-03-fd-b3-6a-ca licsphoenix.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3FC8BC12-6529-4CF7-93D5-68187D02130E}\76-03-fd-b3-6a-ca licsphoenix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-03-fd-b3-6a-ca\WpadDecision = "0" licsphoenix.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix licsphoenix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 licsphoenix.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3FC8BC12-6529-4CF7-93D5-68187D02130E} licsphoenix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3FC8BC12-6529-4CF7-93D5-68187D02130E}\WpadDecisionTime = e046908f0e34d901 licsphoenix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3FC8BC12-6529-4CF7-93D5-68187D02130E}\WpadDecision = "0" licsphoenix.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections licsphoenix.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" licsphoenix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" licsphoenix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3FC8BC12-6529-4CF7-93D5-68187D02130E}\WpadDecisionReason = "1" licsphoenix.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings licsphoenix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 licsphoenix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-03-fd-b3-6a-ca\WpadDecisionTime = e046908f0e34d901 licsphoenix.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3FC8BC12-6529-4CF7-93D5-68187D02130E}\WpadNetworkName = "Network 2" licsphoenix.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\76-03-fd-b3-6a-ca\WpadDecisionReason = "1" licsphoenix.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings licsphoenix.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 licsphoenix.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" licsphoenix.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad licsphoenix.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
licsphoenix.exepid process 580 licsphoenix.exe 580 licsphoenix.exe 580 licsphoenix.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exepid process 2016 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe -
Suspicious use of UnmapMainImage 4 IoCs
Processes:
5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exelicsphoenix.exelicsphoenix.exepid process 1928 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe 2016 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe 1372 licsphoenix.exe 580 licsphoenix.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exelicsphoenix.exedescription pid process target process PID 1928 wrote to memory of 2016 1928 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe PID 1928 wrote to memory of 2016 1928 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe PID 1928 wrote to memory of 2016 1928 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe PID 1928 wrote to memory of 2016 1928 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe 5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe PID 1372 wrote to memory of 580 1372 licsphoenix.exe licsphoenix.exe PID 1372 wrote to memory of 580 1372 licsphoenix.exe licsphoenix.exe PID 1372 wrote to memory of 580 1372 licsphoenix.exe licsphoenix.exe PID 1372 wrote to memory of 580 1372 licsphoenix.exe licsphoenix.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe"C:\Users\Admin\AppData\Local\Temp\5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5da488771253d92cef780635917ccaad602bf0ae9c61ca9ea4b5a4b01189700d.exe--67865eb62⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\licsphoenix.exe"C:\Windows\SysWOW64\licsphoenix.exe"1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\licsphoenix.exe--75fe96b82⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/580-60-0x0000000000000000-mapping.dmp
-
memory/580-62-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/580-64-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1928-55-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1928-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2016-54-0x0000000000000000-mapping.dmp
-
memory/2016-57-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/2016-58-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2016-59-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/2016-61-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB