Static Analysis MALICIOUS
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
The submitted file f9c1199f4097dbb42aeef223a98e88e8d1acfb9210bc2795e782abc191d60da5 is a RANSOMWARE |
| SHA256 | f9c1199f4097dbb42aeef223a98e88e8d1acfb9210bc2795e782abc191d60da5 |
| File Name | f9c1199f4097dbb42aeef223a98e88e8d1acfb9210bc2795e782abc191d60da5 |
| File Type | Win32 EXE |
| Environment | Windows10 |
| Analysis Start Time | 2023-05-09 17:06:45 (UTC) |
| Analysis End Time | 2023-05-09 17:12:19 (UTC) | Tags |
Static Analysis MALICIOUS
Network Analysis MALICIOUS
Dynamic Analysis MALICIOUS
File Analysis NO THREATS
|
|
|
| — -c -s 0 -f 0 -t Empty -m Empty -a 0 -u Empty |
| — nsadgiuubsdeg.exe |
| — icacls "C:\Users\Administrator\AppData\Local\9c7ab2be-12da-4e48-afaa-ca63dbd71ca0" /deny *S-1-1-0:(OI)(CI)(DE,DC) |
| — nsadgiuubsdeg.exe --Admin IsNotAutoStart IsNotTask |
| — build3.exe |
| — C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe" |
| — conhost.exe 0xffffffff -ForceV1 |
| — WINWORD.exe /n "C:\Windows\System32\Tasks\Time Trigger Task" |
| — NSADGI~1.EXE |
| — mstsca.exe |
| — WINWORD.exe /n "C:\Windows\System32\Tasks\Azure-Update-Task" |
| — WINWORD.EXE /Automation -Embedding |
| — svchost.exe -k netsvcs -p -s wuauserv |
| — wmiadap.exe /F /T /R |
| — SecurityHealthService.exe |
| — svchost.exe -k LocalService -p -s CDPSvc |
| — C:\Users\Administrator\AppData\Local\9c7ab2be-12da-4e48-afaa-ca63dbd71ca0\NSADGI~1.EXE |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\AWDN3N2Z\get[1].htm |
| — C:\Users\Administrator\AppData\Local\bowsakkdestx.txt |
| — C:\Users\Administrator\AppData\Local\Microsoft\Windows\INetCache\IE\AWDN3N2Z\build3[1].exe |
| — C:\Users\Administrator\AppData\Local\a4db965c-ff2a-46f5-b653-2d5a7106aa60\build3.exe |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Network\mstsca.exe |
| — C:\Users\Administrator\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| — C:\Users\Administrator\AppData\Local\8b05d66e-de49-403a-8325-c3f14a5e4c7c\build3.exe |
| — C:\Windows\System32\perfc009.dat |
| — C:\Windows\System32\perfh009.dat |
| — C:\Windows\INF\WmiApRpl\WmiApRpl.h |
| — C:\Windows\INF\WmiApRpl\WmiApRpl.ini |
| — C:\Windows\INF\WmiApRpl\0009 |
| — C:\Windows\System32\PerfStringBackup.INI |
| — HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL |
| Registry | Value |
|---|---|
| HKU\S-1-5-21-4024204036-1465485123-3602351515-500\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper | "C:\Users\Administrator\AppData\Local\9c7ab2be-12da-4e48-afaa-ca63dbd71ca0\NSADGI~1.EXE" --AutoStart |
| HKLM\System\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-4024204036-1465485123-3602351515-500\\Device\HarddiskVolume2\Windows\System32\conhost.exe | Binary Data |
| HKU\S-1-5-21-4024204036-1465485123-3602351515-500\SOFTWARE\Microsoft\Office\14.0\Word\Security\Trusted Documents\LastPurgeTime | DWORD (0x01ac2aa7) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\PerfIniFile | WmiApRpl.ini |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Last Counter | DWORD (0x000029be) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Last Help | DWORD (0x000029bf) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\First Counter | DWORD (0x00002918) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\First Help | DWORD (0x00002919) |
| HKLM\System\CurrentControlSet\Services\WmiApRpl\Performance\Object List | 10520 10526 10536 10546 10566 10610 10620 10658 10664 10680 |
| Type | Indicator | Reputation |
|---|---|---|
| IP Address | 84[.]224[.]34[.]240 | Malicious |
| IP Address | 211[.]119[.]84[.]112 | Malicious |
| IP Address | 211[.]59[.]14[.]90 | Malicious |
| IP Address | 58[.]235[.]189[.]192 | Malicious |
| IP Address | 95[.]107[.]163[.]44 | Malicious |
| IP Address | 201[.]103[.]200[.]112 | Malicious |
| IP Address | 109[.]98[.]58[.]98 | Malicious |
| IP Address | 190[.]229[.]19[.]7 | Malicious |
| IP Address | 175[.]119[.]10[.]231 | Malicious |
| IP Address | 211[.]53[.]230[.]67 | Malicious |
| IP Address | 37[.]34[.]248[.]24 | Malicious |
| IP Address | 210[.]182[.]29[.]70 | Malicious |
| IP Address | 222[.]236[.]49[.]124 | Malicious |
| IP Address | 123[.]140[.]161[.]243 | Malicious |
| IP Address | 190[.]140[.]140[.]75 | Malicious |
| IP Address | 222[.]236[.]49[.]123 | Malicious |
| IP Address | 183[.]100[.]39[.]157 | Malicious |
| Domain | zexeq[.]com | Malicious |
| Domain | colisumy[.]com | Malicious |
| URL | hxxp://zexeq[.]com/test1/get[.]php?pid=***&first=*** | Malicious |
| URL | hxxp://colisumy[.]com/dl/build2[.]exe | Malicious |
| URL | hxxp://zexeq[.]com/files/1/build3[.]exe | Malicious |
| Sha256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | Anomalous Activity |
| Method | URL | IP | HTTP Status |
|---|---|---|---|
| GET | hxxp://zexeq[.]com/test1/get[.]php?pid=***&first=*** | 84[.]224[.]34[.]240 | 200 |
| GET | hxxp://zexeq[.]com/files/1/build3[.]exe | 84[.]224[.]34[.]240 | 200 |
| GET | hxxp://colisumy[.]com/dl/build2[.]exe | 37[.]34[.]248[.]24 | 404 |
| GET | hxxp://www[.]msftconnecttest[.]com/connecttest[.]txt | 13[.]107[.]4[.]52 | 200 |
| Domain | IP |
|---|---|
| colisumy[.]com | 37[.]34[.]248[.]24 210[.]182[.]29[.]70 190[.]229[.]19[.]7 211[.]59[.]14[.]90 222[.]236[.]49[.]124 123[.]140[.]161[.]243 190[.]140[.]140[.]75 175[.]119[.]10[.]231 222[.]236[.]49[.]123 183[.]100[.]39[.]157 |
| zexeq[.]com | 84[.]224[.]34[.]240 211[.]119[.]84[.]112 211[.]59[.]14[.]90 58[.]235[.]189[.]192 95[.]107[.]163[.]44 201[.]103[.]200[.]112 109[.]98[.]58[.]98 190[.]229[.]19[.]7 175[.]119[.]10[.]231 211[.]53[.]230[.]67 |
| api[.]2ip[.]ua | 162[.]0[.]217[.]254 |
| www[.]msftconnecttest[.]com | 13[.]107[.]4[.]52 |
| r[.]bing[.]com | 204[.]79[.]197[.]200 13[.]107[.]21[.]200 |
| JA3S | Domain |
|---|---|
| 61be9ce3d068c08ff99a857f62352f9d | api[.]2ip[.]ua |
| Sha256 | FileType |
|---|---|
| d8d2ad3bf7ac898ac658ae85641788321a8c669dad97bfc852d5087d1d55ee84 | text/plain |
| 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 | application/x-dosexec |
| 5e9a7996fe94d7be10595d7133748760bf8348198b71b7a50fd8affaa980ac61 | text/plain |
| Connections | IP |
|---|---|
| UDP | 40[.]81[.]94[.]65 8[.]8[.]4[.]4 |
| TCP | 40[.]126[.]13[.]8 142[.]250[.]195[.]138 204[.]79[.]197[.]200 8[.]247[.]49[.]126 13[.]107[.]4[.]52 23[.]201[.]221[.]186 52[.]178[.]17[.]2 37[.]34[.]248[.]24 20[.]42[.]65[.]92 184[.]25[.]241[.]250 20[.]198[.]213[.]74 162[.]0[.]217[.]254 20[.]166[.]126[.]56 184[.]50[.]18[.]95 40[.]126[.]32[.]72 20[.]195[.]114[.]44 20[.]12[.]23[.]50 104[.]208[.]16[.]94 84[.]224[.]34[.]240 52[.]191[.]219[.]104 20[.]190[.]146[.]32 20[.]189[.]173[.]15 152[.]195[.]38[.]76 142[.]250[.]195[.]202 20[.]231[.]121[.]79 184[.]25[.]242[.]90 13[.]89[.]178[.]26 52[.]137[.]106[.]217 |
