Static Analysis MALICIOUS
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
The submitted file 01ed102dc3e4841d00b4be37ee73c24321498e5d0727961d537d073c057e1ee6 is a RANSOMWARE |
| SHA256 | 01ed102dc3e4841d00b4be37ee73c24321498e5d0727961d537d073c057e1ee6 |
| File Name | 01ed102dc3e4841d00b4be37ee73c24321498e5d0727961d537d073c057e1ee6 |
| File Type | Win32 EXE |
| Environment | Windows10 |
| Analysis Start Time | 2023-06-07 17:41:47 (UTC) |
| Analysis End Time | 2023-06-07 17:47:24 (UTC) | Tags |
Static Analysis MALICIOUS
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
|
|
| — SearchFilterHost.exe 0 796 800 808 8192 804 780 |
| — 01ed102dc3e4841d00b4be37ee73c24321498e5d0727961d537d073c057e1ee6.exe |
| — icacls "C:\Users\Administrator\AppData\Local\ab81031a-28d7-45d6-8789-7a00c1ac829c" /deny *S-1-1-0:(OI)(CI)(DE,DC) |
| — 01ed102dc3e4841d00b4be37ee73c24321498e5d0727961d537d073c057e1ee6.exe --Admin IsNotAutoStart IsNotTask |
| — build3.exe |
| — C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe" |
| — conhost.exe 0xffffffff -ForceV1 |
| — svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc |
| — WINWORD.exe /n "C:\Windows\System32\Tasks\Time Trigger Task" |
| — 01ED10~1.EXE |
| — ApplicationFrameHost.exe -Embedding |
| — svchost.exe -k LocalService -p -s BthAvctpSvc |
| — WINWORD.EXE /Automation -Embedding |
| — SystemSettings.exe -ServerName:microsoft.windows.immersivecontrolpanel |
| — UserOOBEBroker.exe -Embedding |
| — FileCoAuth.exe -Embedding |
| — msedge.exe --default-search-provider=? --out-pipe-name=MSEdgeDefaultda31566bh7088h4e29hb564h92e4d0d7e517 |
| — msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=111.0.5563.111 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=111.0.1661.54 --initial-client-data=0x120,0x124,0x128,0xfc,0x1d4,0x7ff88288b5f8,0x7ff88288b608,0x7ff88288b618 |
| — msedge.exe --default-search-provider=? --out-pipe-name=MSEdgeDefault83fc9704hcdfeh403dh91f4he5934294ebcf |
| — msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=111.0.5563.111 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=111.0.1661.54 --initial-client-data=0x120,0x124,0x128,0xfc,0x130,0x7ff88288b5f8,0x7ff88288b608,0x7ff88288b618 |
| — WINWORD.exe /n "C:\Windows\System32\Tasks\Azure-Update-Task" |
| — mstsca.exe |
| — WINWORD.exe /n "C:\Windows\System32\WDI\LogFiles\StartupInfo\S-1-5-21-2530950276-3298662170-1402498598-500_StartupInfo2.xml" |
| — splwow64.exe 12288 |
| — svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc |
| — svchost.exe -k NetworkService -p |
| — SgrmBroker.exe |
| — svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc |
| — svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc |
| — shutdown.exe /r /f /t 0 |
| — LogonUI.exe /flags:0x4 /state0:0xa3fb4055 /state1:0x41c64e6d |
| — C:\Users\Administrator\AppData\Local\ab81031a-28d7-45d6-8789-7a00c1ac829c\01ED10~1.EXE |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\752WOBP4\build3[1].exe |
| — C:\Users\Administrator\AppData\Local\482e61da-7253-4a8a-9252-b339a444ae93\build3.exe |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe |
| — C:\Users\Administrator\AppData\Local\a4f4e6ec-f771-4524-a6ef-d68ed4d18275\build3.exe |
| — HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL |
| — HKLM\System\CurrentControlSet\Control\WMI\Security |
| — HKLM\System\CurrentControlSet\Services\SharedAccess\Epoch |
| Registry | Value |
|---|---|
| HKU\S-1-5-21-2530950276-3298662170-1402498598-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper | "C:\Users\Administrator\AppData\Local\ab81031a-28d7-45d6-8789-7a00c1ac829c\01ED10~1.EXE" --AutoStart |
| HKU\S-1-5-21-2530950276-3298662170-1402498598-500\SOFTWARE\Microsoft\Office\14.0\Word\Security\Trusted Documents\LastPurgeTime | DWORD (0x01accdea) |
| HKLM\System\CurrentControlSet\Control\WMI\Security\c688cf83-9945-5ff6-0e1e-1ff1f8a2ec9a | Binary Data |
| Type | Indicator | Reputation |
|---|---|---|
| IP Address | 189[.]245[.]66[.]56 | Malicious |
| IP Address | 201[.]252[.]19[.]77 | Malicious |
| IP Address | 119[.]148[.]40[.]122 | Malicious |
| IP Address | 123[.]140[.]161[.]243 | Malicious |
| IP Address | 195[.]158[.]3[.]162 | Malicious |
| IP Address | 187[.]232[.]176[.]222 | Malicious |
| IP Address | 175[.]120[.]254[.]9 | Malicious |
| IP Address | 210[.]182[.]34[.]10 | Malicious |
| IP Address | 175[.]126[.]109[.]15 | Malicious |
| IP Address | 58[.]235[.]189[.]192 | Malicious |
| IP Address | 82[.]78[.]247[.]152 | Malicious |
| IP Address | 190[.]229[.]19[.]7 | Malicious |
| IP Address | 61[.]253[.]71[.]111 | Malicious |
| IP Address | 211[.]59[.]14[.]90 | Malicious |
| IP Address | 5[.]239[.]240[.]61 | Malicious |
| IP Address | 211[.]119[.]84[.]112 | Malicious |
| IP Address | 177[.]254[.]85[.]20 | Malicious |
| Domain | zexeq[.]com | Malicious |
| Domain | colisumy[.]com | Malicious |
| URL | hxxp://zexeq[.]com/lancer/get[.]php?pid=***&first=*** | Malicious |
| URL | hxxp://zexeq[.]com/files/1/build3[.]exe | Malicious |
| URL | hxxp://colisumy[.]com/dl/build2[.]exe | Malicious |
| Sha256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | Anomalous Activity |
| Method | URL | IP | HTTP Status |
|---|---|---|---|
| GET | hxxp://zexeq[.]com/lancer/get[.]php?pid=***&first=*** | 189[.]245[.]66[.]56 | 200 |
| GET | hxxp://colisumy[.]com/dl/build2[.]exe | 175[.]120[.]254[.]9 | - |
| GET | hxxp://zexeq[.]com/files/1/build3[.]exe | 189[.]245[.]66[.]56 | 200 |
| Domain | IP |
|---|---|
| r[.]bing[.]com | 23[.]3[.]70[.]48 23[.]3[.]70[.]91 |
| zexeq[.]com | 189[.]245[.]66[.]56 201[.]252[.]19[.]77 119[.]148[.]40[.]122 123[.]140[.]161[.]243 195[.]158[.]3[.]162 187[.]232[.]176[.]222 175[.]120[.]254[.]9 210[.]182[.]34[.]10 175[.]126[.]109[.]15 58[.]235[.]189[.]192 |
| api[.]2ip[.]ua | 162[.]0[.]217[.]254 |
| colisumy[.]com | 175[.]120[.]254[.]9 82[.]78[.]247[.]152 210[.]182[.]34[.]10 190[.]229[.]19[.]7 175[.]126[.]109[.]15 61[.]253[.]71[.]111 211[.]59[.]14[.]90 5[.]239[.]240[.]61 211[.]119[.]84[.]112 177[.]254[.]85[.]20 |
| JA3S | Domain |
|---|---|
| 61be9ce3d068c08ff99a857f62352f9d | api[.]2ip[.]ua |
| Sha256 | FileType |
|---|---|
| 4d40a89ca3f0b1ca56a278499951fbf93821132f05001f1c6930481f9a0dc910 | text/plain |
| 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | application/x-dosexec |
| Connections | IP |
|---|---|
| TCP | 175[.]120[.]254[.]9 162[.]0[.]217[.]254 189[.]245[.]66[.]56 |
