Static Analysis MALICIOUS
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
The submitted file dd12f3e0ffb28d4154befe052109a0c295c07c326156aa4d1c44a9d69201eade is a RANSOMWARE |
| SHA256 | dd12f3e0ffb28d4154befe052109a0c295c07c326156aa4d1c44a9d69201eade |
| File Name | dd12f3e0ffb28d4154befe052109a0c295c07c326156aa4d1c44a9d69201eade |
| File Type | Win32 EXE |
| Environment | Windows10 |
| Analysis Start Time | 2023-05-08 09:55:21 (UTC) |
| Analysis End Time | 2023-05-08 10:00:58 (UTC) | Tags |
Static Analysis MALICIOUS
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
|
|
| — -c -s 0 -f 0 -t Empty -m Empty -a 0 -u Empty |
| — dd12f3e0ffb28d4154befe052109a0c295c07c326156aa4d1c44a9d69201eade.exe |
| — icacls "C:\Users\Administrator\AppData\Local\4884d36a-082c-4e90-893a-f575debea3e2" /deny *S-1-1-0:(OI)(CI)(DE,DC) |
| — dd12f3e0ffb28d4154befe052109a0c295c07c326156aa4d1c44a9d69201eade.exe --Admin IsNotAutoStart IsNotTask |
| — build2.exe |
| — build3.exe |
| — C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe" |
| — conhost.exe 0xffffffff -ForceV1 |
| — WINWORD.exe /n "C:\Windows\System32\Tasks\Time Trigger Task" |
| — DD12F3~1.EXE |
| — WINWORD.exe /n "C:\Windows\System32\Tasks\Azure-Update-Task" |
| — mstsca.exe |
| — WINWORD.EXE /Automation -Embedding |
| — svchost.exe -k netsvcs -p -s wuauserv |
| — wmiadap.exe /F /T /R |
| — SecurityHealthService.exe |
| — svchost.exe -k LocalService -p -s CDPSvc |
| — C:\Users\Administrator\AppData\Local\4884d36a-082c-4e90-893a-f575debea3e2\DD12F3~1.EXE |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\AWDN3N2Z\build2[1].exe |
| — C:\Users\Administrator\AppData\Local\e4f3d978-026f-4896-b819-638c4ce50cec\build2.exe |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\AWDN3N2Z\get[1].htm |
| — C:\Users\Administrator\AppData\Local\bowsakkdestx.txt |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\AWDN3N2Z\build3[1].exe |
| — C:\Users\Administrator\AppData\Local\e4f3d978-026f-4896-b819-638c4ce50cec\build3.exe |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe |
| — C:\Users\Administrator\AppData\Local\141a00be-2a3e-45b6-86f7-d7d21d15c085\build2.exe |
| — C:\Users\Administrator\AppData\Local\141a00be-2a3e-45b6-86f7-d7d21d15c085\build3.exe |
| — C:\Windows\System32\perfc009.dat |
| — C:\Windows\System32\perfh009.dat |
| — C:\Windows\INF\WmiApRpl\WmiApRpl.h |
| — C:\Windows\INF\WmiApRpl\WmiApRpl.ini |
| — C:\Windows\INF\WmiApRpl\0009 |
| — C:\Windows\System32\PerfStringBackup.INI |
| — HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL |
| Registry | Value |
|---|---|
| HKU\S-1-5-21-4024204036-1465485123-3602351515-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper | "C:\Users\Administrator\AppData\Local\4884d36a-082c-4e90-893a-f575debea3e2\DD12F3~1.EXE" --AutoStart |
| HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-4024204036-1465485123-3602351515-500\\Device\HarddiskVolume2\Windows\System32\conhost.exe | Binary Data |
| HKU\S-1-5-21-4024204036-1465485123-3602351515-500\SOFTWARE\Microsoft\Office\14.0\Word\Security\Trusted Documents\LastPurgeTime | DWORD (0x01ac2358) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\PerfIniFile | WmiApRpl.ini |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Last Counter | DWORD (0x000029be) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Last Help | DWORD (0x000029bf) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\First Counter | DWORD (0x00002918) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\First Help | DWORD (0x00002919) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Object List | 10520 10526 10536 10546 10566 10610 10620 10658 10664 10680 |
| Type | Indicator | Reputation |
|---|---|---|
| IP Address | 190[.]140[.]140[.]75 | Malicious |
| IP Address | 187[.]245[.]185[.]123 | Malicious |
| IP Address | 222[.]236[.]49[.]123 | Malicious |
| IP Address | 187[.]212[.]183[.]201 | Malicious |
| IP Address | 58[.]235[.]189[.]192 | Malicious |
| IP Address | 211[.]171[.]233[.]126 | Malicious |
| IP Address | 186[.]182[.]55[.]44 | Malicious |
| IP Address | 211[.]40[.]39[.]251 | Malicious |
| IP Address | 200[.]124[.]17[.]88 | Malicious |
| IP Address | 187[.]156[.]90[.]178 | Malicious |
| IP Address | 175[.]120[.]254[.]9 | Malicious |
| IP Address | 84[.]224[.]34[.]240 | Malicious |
| IP Address | 183[.]100[.]39[.]157 | Malicious |
| IP Address | 211[.]104[.]254[.]139 | Malicious |
| IP Address | 211[.]119[.]84[.]112 | Malicious |
| IP Address | 211[.]171[.]233[.]129 | Malicious |
| IP Address | 49[.]12[.]34[.]6 | Malicious |
| Domain | zexeq[.]com | Malicious |
| Domain | colisumy[.]com | Malicious |
| URL | hxxp://zexeq[.]com/test1/get[.]php?pid=***&first=*** | Malicious |
| URL | hxxp://zexeq[.]com/files/1/build3[.]exe | Malicious |
| URL | hxxp://colisumy[.]com/dl/build2[.]exe | Malicious |
| URL | hxxp://49[.]12[.]34[.]6/drivers[.]zip | Malicious |
| Sha256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | Anomalous Activity |
| Sha256 | 810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f | Anomalous Activity |
| Method | URL | IP | HTTP Status |
|---|---|---|---|
| GET | hxxp://49[.]12[.]34[.]6/drivers[.]zip | 49[.]12[.]34[.]6 | 200 |
| POST | hxxp://49[.]12[.]34[.]6/ | 49[.]12[.]34[.]6 | 200 |
| GET | hxxp://49[.]12[.]34[.]6/31c7719b5ee962fbde376b75e771360d | 49[.]12[.]34[.]6 | 200 |
| GET | hxxp://www[.]msftconnecttest[.]com/connecttest[.]txt | 13[.]107[.]4[.]52 | 200 |
| GET | hxxp://zexeq[.]com/files/1/build3[.]exe | 190[.]140[.]140[.]75 | 200 |
| GET | hxxp://colisumy[.]com/dl/build2[.]exe | 187[.]245[.]185[.]123 | 200 |
| GET | hxxp://zexeq[.]com/test1/get[.]php?pid=***&first=*** | 190[.]140[.]140[.]75 | 200 |
| Domain | IP |
|---|---|
| api[.]2ip[.]ua | 162[.]0[.]217[.]254 |
| r[.]bing[.]com | 104[.]86[.]188[.]184 104[.]86[.]188[.]224 104[.]86[.]188[.]145 104[.]86[.]188[.]200 104[.]86[.]188[.]154 |
| colisumy[.]com | 187[.]245[.]185[.]123 175[.]120[.]254[.]9 186[.]182[.]55[.]44 187[.]156[.]90[.]178 187[.]212[.]183[.]201 84[.]224[.]34[.]240 183[.]100[.]39[.]157 211[.]104[.]254[.]139 211[.]119[.]84[.]112 211[.]171[.]233[.]129 |
| www[.]msftconnecttest[.]com | 13[.]107[.]4[.]52 |
| t[.]me | 149[.]154[.]167[.]99 |
| zexeq[.]com | 190[.]140[.]140[.]75 187[.]245[.]185[.]123 222[.]236[.]49[.]123 187[.]212[.]183[.]201 58[.]235[.]189[.]192 211[.]171[.]233[.]126 186[.]182[.]55[.]44 211[.]40[.]39[.]251 200[.]124[.]17[.]88 187[.]156[.]90[.]178 |
| JA3S | Domain |
|---|---|
| 098e26e2609212ac1bfac552fbe04127 | t[.]me |
| 61be9ce3d068c08ff99a857f62352f9d | api[.]2ip[.]ua |
| c8d5b17a0fd5b4ee799ca8bd692fee69 | r[.]bing[.]com |
| Sha256 | FileType |
|---|---|
| ff038d77cbb35d0329a60c945508eca9d2e0f395b50cbd628296399cbe0690b9 | application/zip |
| 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df | text/plain |
| 2486be4ac1743c86a950ce88fa3e96a6f71f76fea22e6980b973e9e15e332562 | text/plain |
| 5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61 | text/plain |
| 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | application/x-dosexec |
| 810be76ae3ecc5ab7f019f91979ac9ebf76ed220a7b42c2254a21ec660f8289f | application/x-dosexec |
| d8d2ad3bf7ac898ac658ae85641788321a8c669dad97bfc852d5087d1d55ee84 | text/plain |
| Connections | IP |
|---|---|
| UDP | 40[.]81[.]94[.]65 |
| TCP | 149[.]154[.]167[.]99 184[.]25[.]160[.]170 204[.]79[.]197[.]200 187[.]245[.]185[.]123 192[.]229[.]232[.]240 20[.]198[.]188[.]157 20[.]106[.]86[.]13 20[.]3[.]187[.]198 20[.]190[.]145[.]141 13[.]107[.]4[.]52 13[.]71[.]55[.]58 20[.]231[.]121[.]79 13[.]78[.]111[.]199 184[.]25[.]241[.]250 162[.]0[.]217[.]254 51[.]104[.]15[.]253 184[.]50[.]18[.]95 190[.]140[.]140[.]75 142[.]250[.]195[.]234 52[.]165[.]165[.]26 20[.]195[.]114[.]44 192[.]16[.]49[.]85 20[.]190[.]146[.]37 23[.]207[.]152[.]32 142[.]250[.]196[.]10 20[.]189[.]173[.]15 52[.]168[.]117[.]173 152[.]195[.]38[.]76 49[.]12[.]34[.]6 184[.]25[.]242[.]90 104[.]86[.]188[.]184 142[.]250[.]76[.]42 |
