Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
02/03/2025, 00:44
Behavioral task
behavioral1
Sample
bin.x86_64
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
13 signatures
150 seconds
General
-
Target
bin.x86_64
-
Size
1.2MB
-
MD5
4a3c1c3b93e23346db61e05d48b6851b
-
SHA1
1aa8f6002d26188006fb6e2f844464d9cfcf225a
-
SHA256
d42209da7d4a2af37c7bb2e0bdeab6b30d7b1bfe4a0ef8e47cfba8140eb1ba34
-
SHA512
ae669cd0418ab4cdf00ac07ea3fd03b2ef9b6d37a3a201004bbdab0fdb33082024097e81e1cd245a6f3290b2b67c127e1316e59a24f6918211fd15c5d2c54add
-
SSDEEP
24576:fQK3jhP4Kp9w+CwYcS9yy+pheSHjC7CPpgkRVKs:fV3jhbp9wnwfLyDm+CPz7
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 29ff8069a781db01 iexplore.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{EDA26204-241B-4A9D-8FC3-74E8F7122B8E}" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.4355\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "447641278" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{943868C7-F6FF-11EF-8652-EA3D4F6D6FF5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\Local Settings iexplore.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\.x86_64 OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\.x86_64\ = "x86_64_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\x86_64_auto_file\shell\open OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\x86_64_auto_file\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\x86_64_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\x86_64_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\x86_64_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\x86_64_auto_file\shell\open\command\DelegateExecute = "{17FE9752-0B5A-4665-84CD-569794602F5C}" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\x86_64_auto_file\shell\open\CommandId = "IE.File" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-80166876-2127584002-2233670790-1000_Classes\Local Settings OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3940 NOTEPAD.EXE -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 2204 OpenWith.exe 3448 OpenWith.exe 5080 OpenWith.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 1124 iexplore.exe 1124 iexplore.exe 1124 iexplore.exe 1124 iexplore.exe 1124 iexplore.exe 1124 iexplore.exe 1124 iexplore.exe 1124 iexplore.exe 1124 iexplore.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 2204 OpenWith.exe 1124 iexplore.exe 1124 iexplore.exe 4932 IEXPLORE.EXE 4932 IEXPLORE.EXE 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe 3448 OpenWith.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1124 2204 OpenWith.exe 88 PID 2204 wrote to memory of 1124 2204 OpenWith.exe 88 PID 1124 wrote to memory of 4932 1124 iexplore.exe 90 PID 1124 wrote to memory of 4932 1124 iexplore.exe 90 PID 1124 wrote to memory of 4932 1124 iexplore.exe 90 PID 3448 wrote to memory of 4940 3448 OpenWith.exe 93 PID 3448 wrote to memory of 4940 3448 OpenWith.exe 93 PID 1124 wrote to memory of 3684 1124 iexplore.exe 94 PID 1124 wrote to memory of 3684 1124 iexplore.exe 94 PID 1124 wrote to memory of 3684 1124 iexplore.exe 94 PID 1124 wrote to memory of 4152 1124 iexplore.exe 96 PID 1124 wrote to memory of 4152 1124 iexplore.exe 96 PID 1124 wrote to memory of 904 1124 iexplore.exe 97 PID 1124 wrote to memory of 904 1124 iexplore.exe 97 PID 1124 wrote to memory of 904 1124 iexplore.exe 97 PID 1124 wrote to memory of 2084 1124 iexplore.exe 99 PID 1124 wrote to memory of 2084 1124 iexplore.exe 99 PID 1124 wrote to memory of 2464 1124 iexplore.exe 100 PID 1124 wrote to memory of 2464 1124 iexplore.exe 100 PID 1124 wrote to memory of 2464 1124 iexplore.exe 100 PID 1124 wrote to memory of 4316 1124 iexplore.exe 101 PID 1124 wrote to memory of 4316 1124 iexplore.exe 101 PID 5080 wrote to memory of 3940 5080 OpenWith.exe 103 PID 5080 wrote to memory of 3940 5080 OpenWith.exe 103 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\bin.x86_641⤵
- Modifies registry class
PID:3156
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bin.x86_642⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4932
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:17414 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:3684
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\bin.x86_643⤵
- Modifies Internet Explorer settings
PID:4152
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:82956 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:904
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\bin.x86_643⤵
- Modifies Internet Explorer settings
PID:2084
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:82966 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2464
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Downloads\bin.x86_643⤵
- Modifies Internet Explorer settings
PID:4316
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bin.x86_642⤵
- Modifies Internet Explorer settings
PID:4940
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\bin.x86_642⤵
- Opens file in notepad (likely ransom note)
PID:3940
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD50c37a4cf3018617bf144d3c5d1b8c7e9
SHA118ee7cef7be8105a7fe9a9bca8eafb5686ce448b
SHA2564f77d29504ab01b610ca4c969ba130ae99769b08d9f14fb3aee294980d84fb00
SHA5120224da4fca96765f626c2c71b1bc7fd6aa15cb7efdd6c3da95605425f8271256b3179c883546b750653a9eb2ff708b47ae3d12a8343d127c4b190c403e81b94f
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
16KB
MD5f7eb4ce3c54233733c8e191a6f9fe024
SHA1fd3a8b56bca24cfbe450c031f8d4b942d614f70b
SHA2563a21ef7ae52f5d85a8830d1a1fa6afb3364b144be37c2cb1504e1b90c0711cbf
SHA512b569c47054302336aff6e193601e9a17659d9b9cdd51f00757e6098a7fed844dff374792c6321bbb33e5d65f8d637b69244b27e80742a8d2f9426533d8ae0774