Static Analysis RANSOMWARE
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
The submitted file c4d33fc79173be38c3a76223263f6b37486903188e3c081586ecd62fcc651497 is a RANSOMWARE |
| SHA256 | c4d33fc79173be38c3a76223263f6b37486903188e3c081586ecd62fcc651497 |
| File Name | c4d33fc79173be38c3a76223263f6b37486903188e3c081586ecd62fcc651497 |
| File Type | Win32 EXE |
| Environment | Windows10 |
| Analysis Start Time | 2023-06-12 17:20:48 (UTC) |
| Analysis End Time | 2023-06-12 17:23:22 (UTC) | Tags |
Static Analysis RANSOMWARE
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
|
|
| — SearchFilterHost.exe 0 796 800 808 8192 804 780 |
| — c4d33fc79173be38c3a76223263f6b37486903188e3c081586ecd62fcc651497.exe |
| — icacls "C:\Users\Administrator\AppData\Local\1e051844-9524-4044-8b26-5e080120fa0c" /deny *S-1-1-0:(OI)(CI)(DE,DC) |
| — c4d33fc79173be38c3a76223263f6b37486903188e3c081586ecd62fcc651497.exe --Admin IsNotAutoStart IsNotTask |
| — build2.exe |
| — build3.exe |
| — C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe" |
| — conhost.exe 0xffffffff -ForceV1 |
| — svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc |
| — NOTEPAD.EXE C:\_readme.txt |
| — WINWORD.exe /n "C:\Windows\System32\Tasks\Time Trigger Task" |
| — SearchProtocolHost.exe Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2530950276-3298662170-1402498598-5002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2530950276-3298662170-1402498598-5002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1" |
| — C4D33F~1.EXE |
| — wscript "C:\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\627XUPPY\17\yD8mNPwagJmEd4zTeEH-jzydwzM.br[1].js" |
| — wscript "C:\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\627XUPPY\17\ylkD7fTw1lcLZr9-GH9r2lQJisI.br[1].js" |
| — wscript "C:\Users\Administrator\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\627XUPPY\17\uDG2gcZvfxPQf2ViIjeZuGGTEzs.br[1].js" |
| — WINWORD.EXE /Automation -Embedding |
| — mstsca.exe |
| — LogonUI.exe /flags:0x4 /state0:0xa3f87055 /state1:0x41c64e6d |
| — C:\Users\Administrator\AppData\Local\1e051844-9524-4044-8b26-5e080120fa0c\C4D33F~1.EXE |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\752WOBP4\build2[1].exe |
| — C:\Users\Administrator\AppData\Local\ee7d20c3-c937-4ba5-9b4c-ab15f62482db\build2.exe |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\752WOBP4\build3[1].exe |
| — C:\Users\Administrator\AppData\Local\ee7d20c3-c937-4ba5-9b4c-ab15f62482db\build3.exe |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| — HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL |
| Registry | Value |
|---|---|
| HKU\S-1-5-21-2530950276-3298662170-1402498598-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper | "C:\Users\Administrator\AppData\Local\1e051844-9524-4044-8b26-5e080120fa0c\C4D33F~1.EXE" --AutoStart |
| Type | Indicator | Reputation |
|---|---|---|
| IP Address | 5[.]21[.]67[.]193 | Malicious |
| IP Address | 177[.]254[.]85[.]20 | Malicious |
| IP Address | 95[.]107[.]163[.]44 | Malicious |
| IP Address | 189[.]194[.]9[.]27 | Malicious |
| IP Address | 179[.]25[.]14[.]241 | Malicious |
| IP Address | 175[.]119[.]10[.]231 | Malicious |
| IP Address | 190[.]171[.]250[.]205 | Malicious |
| IP Address | 61[.]253[.]71[.]111 | Malicious |
| IP Address | 211[.]119[.]84[.]111 | Malicious |
| IP Address | 222[.]236[.]49[.]124 | Malicious |
| IP Address | 183[.]100[.]39[.]157 | Malicious |
| IP Address | 211[.]40[.]39[.]251 | Malicious |
| IP Address | 222[.]236[.]49[.]123 | Malicious |
| IP Address | 124[.]43[.]18[.]250 | Malicious |
| IP Address | 201[.]119[.]66[.]140 | Malicious |
| IP Address | 2[.]180[.]10[.]7 | Malicious |
| IP Address | 62[.]217[.]232[.]10 | Malicious |
| IP Address | 195[.]158[.]3[.]162 | Malicious |
| IP Address | 187[.]233[.]46[.]193 | Malicious |
| IP Address | 190[.]229[.]19[.]7 | Malicious |
| IP Address | 167[.]235[.]207[.]108 | Malicious |
| Domain | zexeq[.]com | Malicious |
| Domain | colisumy[.]com | Malicious |
| URL | hxxp://zexeq[.]com/files/1/build3[.]exe | Malicious |
| URL | hxxp://zexeq[.]com/test1/get[.]php?pid=***&first=*** | Malicious |
| URL | hxxp://colisumy[.]com/dl/build2[.]exe | Malicious |
| URL | hxxp://167[.]235[.]207[.]108/files[.]zip | Malicious |
| Sha256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | Anomalous Activity |
| Sha256 | c2c5560cede5fe447363e0d432707fc287312c20e92715b59700888e77eab92d | Anomalous Activity |
| Method | URL | IP | HTTP Status |
|---|---|---|---|
| GET | hxxp://colisumy[.]com/dl/build2[.]exe | 183[.]100[.]39[.]157 | 200 |
| GET | hxxp://167[.]235[.]207[.]108/files[.]zip | 167[.]235[.]207[.]108 | 200 |
| GET | hxxp://167[.]235[.]207[.]108/a81bcf59d85e6e13257840e65b9d1da8 | 167[.]235[.]207[.]108 | 200 |
| GET | hxxp://zexeq[.]com/files/1/build3[.]exe | 5[.]21[.]67[.]193 | 200 |
| POST | hxxp://167[.]235[.]207[.]108/ | 167[.]235[.]207[.]108 | 200 |
| GET | hxxp://zexeq[.]com/test1/get[.]php?pid=***&first=*** | 5[.]21[.]67[.]193 | 200 |
| Domain | IP |
|---|---|
| dual-s-ring[.]msedge[.]net | 52[.]123[.]128[.]254 52[.]123[.]129[.]254 |
| fp-vs[.]azureedge[.]net | 117[.]18[.]232[.]200 |
| wac-ring[.]msedge[.]net | 52[.]108[.]8[.]254 52[.]108[.]9[.]254 |
| zexeq[.]com | 5[.]21[.]67[.]193 177[.]254[.]85[.]20 95[.]107[.]163[.]44 189[.]194[.]9[.]27 179[.]25[.]14[.]241 175[.]119[.]10[.]231 190[.]171[.]250[.]205 61[.]253[.]71[.]111 211[.]119[.]84[.]111 222[.]236[.]49[.]124 |
| colisumy[.]com | 183[.]100[.]39[.]157 211[.]40[.]39[.]251 222[.]236[.]49[.]123 124[.]43[.]18[.]250 201[.]119[.]66[.]140 2[.]180[.]10[.]7 62[.]217[.]232[.]10 195[.]158[.]3[.]162 187[.]233[.]46[.]193 190[.]229[.]19[.]7 |
| t[.]me | 149[.]154[.]167[.]99 |
| r[.]bing[.]com | 23[.]3[.]70[.]48 23[.]3[.]70[.]91 23[.]3[.]70[.]203 |
| api[.]2ip[.]ua | 162[.]0[.]217[.]254 |
| JA3S | Domain |
|---|---|
| 895252f3ce80cebf7a8837be83ec8e16 | fp-vs[.]azureedge[.]net |
| 61be9ce3d068c08ff99a857f62352f9d | api[.]2ip[.]ua |
| c8d5b17a0fd5b4ee799ca8bd692fee69 | r[.]bing[.]com |
| 098e26e2609212ac1bfac552fbe04127 | t[.]me |
| Sha256 | FileType |
|---|---|
| c2c5560cede5fe447363e0d432707fc287312c20e92715b59700888e77eab92d | application/x-dosexec |
| 181c1ef3e42b2399d39b6c3ba14d8e55e60929f58a426d4f4814bf27591295b6 | application/zip |
| 7320c9dec9fba9f878e9f7fa3f2352951eaf82e5e10b33bb247938eeceefffd9 | text/plain |
| 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | application/x-dosexec |
| 11a770052f6df5fd0ed9b7197f4c5ea2f5d62bd1f75684959bd3b8f299d1eee6 | text/plain |
| Connections | IP |
|---|---|
| TCP | 183[.]100[.]39[.]157 149[.]154[.]167[.]99 52[.]123[.]128[.]254 23[.]3[.]70[.]48 117[.]18[.]232[.]200 23[.]192[.]96[.]123 162[.]0[.]217[.]254 167[.]235[.]207[.]108 5[.]21[.]67[.]193 52[.]108[.]8[.]254 |
