Overview

overview

8

Static

static

1

regdelete-...ts.zip

windows7-x64

1

regdelete-...ts.zip

windows10-2004-x64

8

Resubmissions

03-03-2023 01:44

230303-b6arcsfc9s 10

03-03-2023 01:42

230303-b4nv7sfc7z 7

03-03-2023 01:39

230303-b2ymmafg72 8

Analysis

  • max time kernel
    750s
  • max time network
    478s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-03-2023 01:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    regdelete-readme-edits.zip

  • Size

    102KB

  • MD5

    c311b0155c1b4b6fa69907535561ab6e

  • SHA1

    6f67ac188a59afe75c9823aa67c71f5965da3ed5

  • SHA256

    0f74f24a5c1b60aca05d1292e91b351243b3cd95dda66cd6dfdd13e8fd0c26a0

  • SHA512

    85fed902be923a86c69320568c2bf7e122a415f83cb82f414b4928da744d037e2096f2121289e988f6462da52a84bd8b0c70814e30e1f5182d64454a1c9d8484

  • SSDEEP

    3072:YmKFecO/Q3TWn8N2ArDlz4N7/82WXYAikEC:0xO/Ln8RGNL8xriJC

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 8 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 49 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\regdelete-readme-edits.zip
    1⤵
      PID:1876
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4672
      • C:\Users\Admin\Desktop\regdelete-readme-edits\hell9o.exe
        "C:\Users\Admin\Desktop\regdelete-readme-edits\hell9o.exe"
        1⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3208
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1944
          • C:\Windows\system32\reg.exe
            reg DELETE HKEY_CLASSES_ROOT /f
            3⤵
            • Modifies system executable filetype association
            • Registers COM server for autorun
            • Modifies registry class
            PID:4900
          • C:\Windows\system32\reg.exe
            reg DELETE HKEY_CURRENT_USER /f
            3⤵
              PID:3540
            • C:\Windows\system32\reg.exe
              reg DELETE HKEY_LOCAL_MACHINE /f
              3⤵
                PID:4428
          • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
            "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
            1⤵
              PID:2040
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
              1⤵
              • Drops file in Windows directory
              PID:4840
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 424 -p 3740 -ip 3740
              1⤵
                PID:3628
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 3740 -s 1868
                1⤵
                • Program crash
                PID:560
              • C:\Windows\system32\LogonUI.exe
                "LogonUI.exe" /flags:0x4 /state0:0xa394e055 /state1:0x41c64e6d
                1⤵
                  PID:3532
                • C:\Windows\System32\smss.exe
                  \SystemRoot\System32\smss.exe 0000015c 00000084
                  1⤵
                  • Modifies system executable filetype association
                  • Registers COM server for autorun
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies registry class
                  PID:4428
                • C:\Windows\System32\smss.exe
                  \SystemRoot\System32\smss.exe 000003ec 00000084
                  1⤵
                  • Modifies Installed Components in the registry
                  • Modifies system executable filetype association
                  • Adds Run key to start application
                  • Modifies Internet Explorer settings
                  PID:3540

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                  Filesize

                  9KB

                  MD5

                  7050d5ae8acfbe560fa11073fef8185d

                  SHA1

                  5bc38e77ff06785fe0aec5a345c4ccd15752560e

                  SHA256

                  cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                  SHA512

                  a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\regdel.CMD
                  Filesize

                  159B

                  MD5

                  e26bcceba32f987399a0decf331f0697

                  SHA1

                  64540b56c5ff6dbb963faa50a85159c62edf7365

                  SHA256

                  0fd1b221f5a865fd9d796857f51724ad6460d409e2cffe8cfaef091daa689d05

                  SHA512

                  d96236da499970dfd6702150a5140e947547e50e3ec6b5ee3d7923ddcc637a01a9e747ecac0b81d4268cbe1a7788c63d5b4ec1373fc46318d8a5d676f510d508

                  Download Submit