Analysis
-
max time kernel
85s -
max time network
82s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
31/01/2023, 21:14
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://docs.google.com/uc?export=download&id=1yUruRP-TamdyfHm4P23d3rybhn-2RM5Z
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://docs.google.com/uc?export=download&id=1yUruRP-TamdyfHm4P23d3rybhn-2RM5Z
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
https://docs.google.com/uc?export=download&id=1yUruRP-TamdyfHm4P23d3rybhn-2RM5Z
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 30784c61c135d901 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381968238" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CA86421-A1B4-11ED-B06A-FE63F52BA449} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.tar rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file\shell\open\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\.tar\ = "tar_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file\shell\edit rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file\shell\edit\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\tar_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_Classes\Local Settings rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1320 iexplore.exe 1320 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1320 iexplore.exe 1320 iexplore.exe 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1716 1320 iexplore.exe 29 PID 1320 wrote to memory of 1716 1320 iexplore.exe 29 PID 1320 wrote to memory of 1716 1320 iexplore.exe 29 PID 1320 wrote to memory of 1716 1320 iexplore.exe 29 PID 1320 wrote to memory of 480 1320 iexplore.exe 31 PID 1320 wrote to memory of 480 1320 iexplore.exe 31 PID 1320 wrote to memory of 480 1320 iexplore.exe 31 PID 480 wrote to memory of 1752 480 rundll32.exe 32 PID 480 wrote to memory of 1752 480 rundll32.exe 32 PID 480 wrote to memory of 1752 480 rundll32.exe 32
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://docs.google.com/uc?export=download&id=1yUruRP-TamdyfHm4P23d3rybhn-2RM5Z1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1320 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Downloads\DOCX_FACT_FE-875.tar2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\DOCX_FACT_FE-875.tar3⤵PID:1752
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aca731cba7e303fd89738cb2f9f76c95
SHA1a0a83fcd4b87b311713e78eb8e3c87d5dd389610
SHA256a44fa5fae2843b4fe1c9bb110b3749fe46e3285bf5a9a675ab9adcaf13f6af82
SHA512522aa21de5b0dda13249b78bda695021eace6eea2592e94d0cecf29e45f7a8cdf302d16b8ab7b872908a1ddb62cd8cb86ea04ef873d39e2d863b10f4b5177a64
-
Filesize
608B
MD55a9de9975296d2301b3ea07375c264d1
SHA129636908df8531ed216979cf2d2d57c1f8da75f3
SHA256ce1a690bda1009daaa754968769c979417d3f19a8b5e5d23eb89126f00028777
SHA512d8e61583fa615e5e893553b1cc07716b1c6221551abef50066d5f772f051fe26494fe50b76e484628ed124d0239779b452a6887847234baafda5da3460a8d733
-
Filesize
721KB
MD5cbb47f4b9535ac7a34c8d5f0d3f01bb5
SHA1269685cc104aa0eab3cc12deeedb684b3ed28599
SHA256c0b12fa3db62bc736dd93176c4b295fc3461cc722b03bcaf4aae6e47d62b1d69
SHA5128d6a920ed935dc3b7f9d7169d5834b12a705cb7a444c84a675c40022ae11be71b3228c8f2198e9483093fd9d14289caa22da72efd043c46f877c84695ebe76e2