Analysis
-
max time kernel
133s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
08/02/2023, 06:18
Static task
static1
Behavioral task
behavioral1
Sample
73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe
Resource
win10v2004-20221111-en
General
-
Target
73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe
-
Size
566KB
-
MD5
49062f220f2344d3a22d9d3a9582249b
-
SHA1
3a635fc712ee8b9fea8e35f98ff6fe1e76048a54
-
SHA256
73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72
-
SHA512
fad2af04fe902842d2f090dd7dbcf89ced9fc04de35a70af8008bb4c910442432707dc7056af546439431d1d13c1d8d155cf854c76106ef842c4e677d3239f2f
-
SSDEEP
12288:UMrAy90cXLcV/rUQ+R1Hu+RJvopkjU01LQUF:MyhwVToDR1XQUF
Malware Config
Extracted
amadey
3.66
62.204.41.5/Bu58Ngs/index.php
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" aPrx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" aPrx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" aPrx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" aPrx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" mika.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection aPrx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" aPrx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" mika.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" mika.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation vona.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 7 IoCs
pid Process 4848 cPrn.exe 4056 aPrx.exe 4072 mika.exe 768 vona.exe 1552 mnolyk.exe 2376 mnolyk.exe 3216 mnolyk.exe -
Loads dropped DLL 1 IoCs
pid Process 2152 rundll32.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features aPrx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" aPrx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" mika.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cPrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" cPrn.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4316 4056 WerFault.exe 83 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2996 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4056 aPrx.exe 4056 aPrx.exe 4072 mika.exe 4072 mika.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4056 aPrx.exe Token: SeDebugPrivilege 4072 mika.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4908 wrote to memory of 4848 4908 73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe 82 PID 4908 wrote to memory of 4848 4908 73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe 82 PID 4908 wrote to memory of 4848 4908 73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe 82 PID 4848 wrote to memory of 4056 4848 cPrn.exe 83 PID 4848 wrote to memory of 4056 4848 cPrn.exe 83 PID 4848 wrote to memory of 4056 4848 cPrn.exe 83 PID 4848 wrote to memory of 4072 4848 cPrn.exe 89 PID 4848 wrote to memory of 4072 4848 cPrn.exe 89 PID 4908 wrote to memory of 768 4908 73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe 90 PID 4908 wrote to memory of 768 4908 73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe 90 PID 4908 wrote to memory of 768 4908 73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe 90 PID 768 wrote to memory of 1552 768 vona.exe 91 PID 768 wrote to memory of 1552 768 vona.exe 91 PID 768 wrote to memory of 1552 768 vona.exe 91 PID 1552 wrote to memory of 2996 1552 mnolyk.exe 92 PID 1552 wrote to memory of 2996 1552 mnolyk.exe 92 PID 1552 wrote to memory of 2996 1552 mnolyk.exe 92 PID 1552 wrote to memory of 4156 1552 mnolyk.exe 94 PID 1552 wrote to memory of 4156 1552 mnolyk.exe 94 PID 1552 wrote to memory of 4156 1552 mnolyk.exe 94 PID 4156 wrote to memory of 4528 4156 cmd.exe 96 PID 4156 wrote to memory of 4528 4156 cmd.exe 96 PID 4156 wrote to memory of 4528 4156 cmd.exe 96 PID 4156 wrote to memory of 3928 4156 cmd.exe 97 PID 4156 wrote to memory of 3928 4156 cmd.exe 97 PID 4156 wrote to memory of 3928 4156 cmd.exe 97 PID 4156 wrote to memory of 4448 4156 cmd.exe 98 PID 4156 wrote to memory of 4448 4156 cmd.exe 98 PID 4156 wrote to memory of 4448 4156 cmd.exe 98 PID 4156 wrote to memory of 488 4156 cmd.exe 99 PID 4156 wrote to memory of 488 4156 cmd.exe 99 PID 4156 wrote to memory of 488 4156 cmd.exe 99 PID 4156 wrote to memory of 3164 4156 cmd.exe 100 PID 4156 wrote to memory of 3164 4156 cmd.exe 100 PID 4156 wrote to memory of 3164 4156 cmd.exe 100 PID 4156 wrote to memory of 4224 4156 cmd.exe 101 PID 4156 wrote to memory of 4224 4156 cmd.exe 101 PID 4156 wrote to memory of 4224 4156 cmd.exe 101 PID 1552 wrote to memory of 2152 1552 mnolyk.exe 108 PID 1552 wrote to memory of 2152 1552 mnolyk.exe 108 PID 1552 wrote to memory of 2152 1552 mnolyk.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe"C:\Users\Admin\AppData\Local\Temp\73436cdf2c11a8a18d8a802c6e84d4141e82d0d9142888e59dcb92c6f2278e72.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cPrn.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cPrn.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aPrx.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\aPrx.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 10804⤵
- Program crash
PID:4316
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\mika.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vona.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
PID:2996
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4528
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵PID:3928
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵PID:4448
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:488
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:N"5⤵PID:3164
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\5eb6b96734" /P "Admin:R" /E5⤵PID:4224
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:2152
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4056 -ip 40561⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:2376
-
C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe1⤵
- Executes dropped EXE
PID:3216
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
379KB
MD5f0971548ca335649b43713907598f9b1
SHA1d610d79ddeb2a9c6c13f6ec397b74e965da7fc3c
SHA25618d247af5eefc949aaf72e445f723ba5824764828dc9faa376bee6879be3a4db
SHA512d7c5b79e7386d9e3c83f78170d195ac3faceca59991884ed9fc51e76c4bc654ceaf8db8855563f7696afb8faa4a384866c859bb10e92b3ec4b72c45e68065a23
-
Filesize
379KB
MD5f0971548ca335649b43713907598f9b1
SHA1d610d79ddeb2a9c6c13f6ec397b74e965da7fc3c
SHA25618d247af5eefc949aaf72e445f723ba5824764828dc9faa376bee6879be3a4db
SHA512d7c5b79e7386d9e3c83f78170d195ac3faceca59991884ed9fc51e76c4bc654ceaf8db8855563f7696afb8faa4a384866c859bb10e92b3ec4b72c45e68065a23
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
236KB
MD5fde8915d251fada3a37530421eb29dcf
SHA144386a8947ddfab993409945dae05a772a13e047
SHA2566cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116
SHA512ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd
-
Filesize
356KB
MD578b0fb1bab98b19e24afee54ae0cefb7
SHA1634df9939b433e5da1c60302d0dd5c3d33f9d9f0
SHA2568e166fa7c156ea6f945de6c3706a5b08f5761d4f498a1d0570400f2d9449533c
SHA512a46a67d5e479e7238f338c9d0c12a174c3fea8a1ec5722ba0d948563b0e474461595001286ccb93cfc1d4416b8d6387de63d3b432d35267c5b270d2d49a4b028
-
Filesize
356KB
MD578b0fb1bab98b19e24afee54ae0cefb7
SHA1634df9939b433e5da1c60302d0dd5c3d33f9d9f0
SHA2568e166fa7c156ea6f945de6c3706a5b08f5761d4f498a1d0570400f2d9449533c
SHA512a46a67d5e479e7238f338c9d0c12a174c3fea8a1ec5722ba0d948563b0e474461595001286ccb93cfc1d4416b8d6387de63d3b432d35267c5b270d2d49a4b028
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3
-
Filesize
89KB
MD59221a421a3e777eb7d4ce55e474bcc4a
SHA1c96d7bd7ccbf9352d50527bff472595b3dc5298e
SHA25610ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8
SHA51263ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3