Static Analysis MALICIOUS
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
The submitted file file.exe is a RANSOMWARE |
| SHA256 | d35d748aebd7c8112ee9d4d7cc38f430bca5b397afec832d51f3e086b828e845 |
| File Name | file.exe |
| File Type | Win32 EXE |
| Environment | Windows10 |
| Analysis Start Time | 2023-06-10 11:26:19 (UTC) |
| Analysis End Time | 2023-06-10 11:31:57 (UTC) | Tags |
Static Analysis MALICIOUS
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
|
|
| — file.exe --Admin IsNotAutoStart IsNotTask |
| — build2.exe |
| — build3.exe |
| — C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe" |
| — conhost.exe 0xffffffff -ForceV1 |
| — file.exe |
| — DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} |
| — WINWORD.exe /n "C:\Windows\System32\Tasks\Time Trigger Task" |
| — NOTEPAD.EXE C:\_readme.txt |
| — SearchProtocolHost.exe Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2530950276-3298662170-1402498598-5002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2530950276-3298662170-1402498598-5002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1" |
| — ApplicationFrameHost.exe -Embedding |
| — SystemSettings.exe -ServerName:microsoft.windows.immersivecontrolpanel |
| — mousocoreworker.exe -Embedding |
| — svchost.exe -k wusvcs -p -s WaaSMedicSvc |
| — UserOOBEBroker.exe -Embedding |
| — FileCoAuth.exe -Embedding |
| — msedge.exe --default-search-provider=? --out-pipe-name=MSEdgeDefaultc680513ah37a2h44achb218hde448ebb3f80 |
| — msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=111.0.5563.111 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=111.0.1661.54 --initial-client-data=0x11c,0x120,0x124,0xf8,0x1d0,0x7ff9d0a9b5f8,0x7ff9d0a9b608,0x7ff9d0a9b618 |
| — svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc |
| — msedge.exe --default-search-provider=? --out-pipe-name=MSEdgeDefault943e6c2ah7a93h44b6hb7ach1b2b21b3dcf8 |
| — msedge.exe --type=crashpad-handler "--user-data-dir=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=111.0.5563.111 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=111.0.1661.54 --initial-client-data=0x120,0x124,0x128,0xfc,0x1d4,0x7ff9d0a9b5f8,0x7ff9d0a9b608,0x7ff9d0a9b618 |
| — WINWORD.exe /n "C:\Windows\System32\WDI\LogFiles\StartupInfo\S-1-5-21-2530950276-3298662170-1402498598-500_StartupInfo2.xml" |
| — WINWORD.EXE /Automation -Embedding |
| — splwow64.exe 12288 |
| — svchost.exe -k netsvcs -p -s BITS |
| — svchost.exe -k NetworkService -p |
| — SgrmBroker.exe |
| — svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc |
| — svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc |
| — svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc |
| — mstsca.exe |
| — taskhostw.exe $(Arg0) |
| — wmiadap.exe /F /T |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\752WOBP4\build2[1].exe |
| — C:\Users\Administrator\AppData\Local\b0557041-daf1-4543-8c31-e68e93085dea\build2.exe |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\752WOBP4\build3[1].exe |
| — C:\Users\Administrator\AppData\Local\b0557041-daf1-4543-8c31-e68e93085dea\build3.exe |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| — C:\Windows\Logs\waasmedic\waasmedic.20230610_022650_798.etl |
| — C:\Windows\debug\WIA\wiatrace.log |
| — C:\Windows\Logs\waasmedic\waasmedic.20230610_022803_751.etl |
| — HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL |
| — HKLM\System\CurrentControlSet\Control\WMI\Security |
| — HKLM\System\CurrentControlSet\Services\SharedAccess\Epoch |
| — HKLM\System\CurrentControlSet\Services\VSS\Diag\BITS Writer |
| Registry | Value |
|---|---|
| HKLM\System\CurrentControlSet\Control\WMI\Security\c688cf83-9945-5ff6-0e1e-1ff1f8a2ec9a | Binary Data |
| HKU\S-1-5-21-2530950276-3298662170-1402498598-500\SOFTWARE\Microsoft\Office\14.0\Word\Security\Trusted Documents\LastPurgeTime | DWORD (0x01acdd54) |
| Type | Indicator | Reputation |
|---|---|---|
| IP Address | 183[.]100[.]39[.]157 | Malicious |
| IP Address | 91[.]140[.]248[.]44 | Malicious |
| IP Address | 2[.]88[.]138[.]112 | Malicious |
| IP Address | 210[.]182[.]29[.]70 | Malicious |
| IP Address | 181[.]4[.]66[.]66 | Malicious |
| IP Address | 37[.]34[.]248[.]24 | Malicious |
| IP Address | 77[.]28[.]13[.]168 | Malicious |
| IP Address | 123[.]140[.]161[.]243 | Malicious |
| IP Address | 188[.]36[.]122[.]174 | Malicious |
| IP Address | 187[.]224[.]116[.]41 | Malicious |
| IP Address | 190[.]231[.]153[.]132 | Malicious |
| IP Address | 195[.]158[.]3[.]162 | Malicious |
| IP Address | 185[.]12[.]79[.]25 | Malicious |
| IP Address | 2[.]180[.]10[.]7 | Malicious |
| IP Address | 189[.]194[.]9[.]27 | Malicious |
| IP Address | 220[.]82[.]134[.]215 | Malicious |
| IP Address | 175[.]120[.]254[.]9 | Malicious |
| IP Address | 211[.]40[.]39[.]251 | Malicious |
| IP Address | 116[.]202[.]4[.]61 | Malicious |
| Domain | colisumy[.]com | Malicious |
| Domain | zexeq[.]com | Malicious |
| URL | hxxp://colisumy[.]com/dl/build2[.]exe | Malicious |
| URL | hxxp://zexeq[.]com/files/1/build3[.]exe | Malicious |
| URL | hxxp://zexeq[.]com/raud/get[.]php?pid=***&first=*** | Malicious |
| URL | hxxp://116[.]202[.]4[.]61/files[.]zip | Malicious |
| Sha256 | c2c5560cede5fe447363e0d432707fc287312c20e92715b59700888e77eab92d | Anomalous Activity |
| Sha256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | Anomalous Activity |
| Method | URL | IP | HTTP Status |
|---|---|---|---|
| GET | hxxp://zexeq[.]com/files/1/build3[.]exe | 190[.]231[.]153[.]132 | 200 |
| GET | hxxp://116[.]202[.]4[.]61/files[.]zip | 116[.]202[.]4[.]61 | 200 |
| GET | hxxp://116[.]202[.]4[.]61/a81bcf59d85e6e13257840e65b9d1da8 | 116[.]202[.]4[.]61 | 200 |
| GET | hxxp://colisumy[.]com/dl/build2[.]exe | 183[.]100[.]39[.]157 | 200 |
| GET | hxxp://zexeq[.]com/raud/get[.]php?pid=***&first=*** | 190[.]231[.]153[.]132 | 200 |
| Domain | IP |
|---|---|
| r[.]bing[.]com | 23[.]44[.]10[.]48 23[.]44[.]10[.]67 23[.]44[.]10[.]56 23[.]44[.]10[.]43 23[.]44[.]10[.]32 23[.]44[.]10[.]75 23[.]44[.]10[.]41 23[.]44[.]10[.]50 23[.]44[.]10[.]73 |
| fp-vs[.]azureedge[.]net | 117[.]18[.]232[.]200 |
| api[.]2ip[.]ua | 162[.]0[.]217[.]254 |
| t[.]me | 149[.]154[.]167[.]99 |
| colisumy[.]com | 183[.]100[.]39[.]157 91[.]140[.]248[.]44 2[.]88[.]138[.]112 210[.]182[.]29[.]70 181[.]4[.]66[.]66 37[.]34[.]248[.]24 77[.]28[.]13[.]168 123[.]140[.]161[.]243 188[.]36[.]122[.]174 187[.]224[.]116[.]41 |
| zexeq[.]com | 190[.]231[.]153[.]132 195[.]158[.]3[.]162 185[.]12[.]79[.]25 77[.]28[.]13[.]168 2[.]180[.]10[.]7 189[.]194[.]9[.]27 220[.]82[.]134[.]215 91[.]140[.]248[.]44 175[.]120[.]254[.]9 211[.]40[.]39[.]251 |
| dual-s-ring[.]msedge[.]net | 52[.]123[.]128[.]254 52[.]123[.]129[.]254 |
| wac-ring[.]msedge[.]net | 52[.]108[.]8[.]254 52[.]108[.]9[.]254 |
| JA3S | Domain |
|---|---|
| 61be9ce3d068c08ff99a857f62352f9d | api[.]2ip[.]ua |
| 895252f3ce80cebf7a8837be83ec8e16 | fp-vs[.]azureedge[.]net |
| 098e26e2609212ac1bfac552fbe04127 | t[.]me |
| Sha256 | FileType |
|---|---|
| 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | application/x-dosexec |
| 6814499e9494897055704c2446eb47d1cfe75a17950633acb505738c2e7e31c0 | application/zip |
| 818986ca66ce45e9326d8d3fd096c39b65d440dbe62ac1fd082bdc1909906517 | text/plain |
| c2c5560cede5fe447363e0d432707fc287312c20e92715b59700888e77eab92d | application/x-dosexec |
| 68cde71acc2bc5fa897c1b61299b0592d777aab4cc45eea7ea7ba7fe8cd52918 | text/plain |
| Connections | IP |
|---|---|
| TCP | 183[.]100[.]39[.]157 116[.]202[.]4[.]61 52[.]123[.]128[.]254 162[.]0[.]217[.]254 52[.]108[.]8[.]254 190[.]231[.]153[.]132 149[.]154[.]167[.]99 117[.]18[.]232[.]200 |
