Overview

overview

8

Static

static

0788aaea24...d6.exe

windows7_x64

8

0788aaea24...d6.exe

windows10_x64

8

Resubmissions

12/01/2021, 11:18

210112-grlybxw2l6 8

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    12/01/2021, 11:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe

  • Size

    1.5MB

  • MD5

    50a5e891da27e63d54e68511e48aa026

  • SHA1

    87073d85a7ba420b15c8bb9a9e4adc64db2bcfef

  • SHA256

    0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6

  • SHA512

    6df8811e3e1f6a4110ca3b7c498af13898b46962a30888879180b2f11dda24344a1de4807663d46dd86f7ea11855d08137980cc85fe71e688d082f2f79994909

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 9 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • JavaScript code in executable 5 IoCs
  • Drops file in System32 directory 21 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Checks SCSI registry key(s) 3 TTPs 30 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 333 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 72 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe
    "C:\Users\Admin\AppData\Local\Temp\0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C START "" "C:\Users\Admin\AppData\Local\Temp\interface.lnk"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2616
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\interface.cmd" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:200
        • C:\Windows\SysWOW64\mode.com
          MODE CON: COLS=76 LINES=15
          4⤵
            PID:3700
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" VER "
            4⤵
              PID:500
            • C:\Windows\SysWOW64\findstr.exe
              FINDSTR /I /R /C:"version 5\.[0-1]\."
              4⤵
                PID:1112
              • C:\Windows\SysWOW64\waitfor.exe
                WAITFOR unlock
                4⤵
                  PID:2260
                • C:\Windows\SysWOW64\waitfor.exe
                  WAITFOR unlock
                  4⤵
                    PID:1248
                  • C:\Windows\SysWOW64\waitfor.exe
                    WAITFOR unlock
                    4⤵
                      PID:1540
                    • C:\Windows\SysWOW64\waitfor.exe
                      WAITFOR unlock
                      4⤵
                        PID:3564
                  • C:\Users\Admin\AppData\Local\Temp\detection.exe
                    "C:\Users\Admin\AppData\Local\Temp\detection.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2656
                    • C:\Users\Admin\AppData\Local\Temp\curl_x64.exe
                      "C:\Users\Admin\AppData\Local\Temp\curl_x64.exe" --connect-timeout 5 --max-time 20 --fail --silent --request GET "https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4"
                      3⤵
                      • Executes dropped EXE
                      PID:3888
                    • C:\Windows\SysWOW64\WAITFOR.exe
                      WAITFOR /S MKLUFVRL /SI unlock
                      3⤵
                        PID:3164
                      • C:\Windows\SysWOW64\SC.exe
                        SC query Winmgmt
                        3⤵
                          PID:2172
                        • C:\Windows\SysWOW64\WAITFOR.exe
                          WAITFOR /S MKLUFVRL /SI unlock
                          3⤵
                            PID:2644
                          • C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
                            "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" driverfiles 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
                            3⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Drops file in Windows directory
                            • Checks SCSI registry key(s)
                            PID:2832
                          • C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
                            "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" hwids 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
                            3⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:3024
                          • C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
                            "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" stack 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
                            3⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:1292
                          • C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
                            "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" drivernodes 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
                            3⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Checks SCSI registry key(s)
                            PID:2332
                          • C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
                            "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" status 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
                            3⤵
                            • Executes dropped EXE
                            • Checks SCSI registry key(s)
                            PID:2132
                          • C:\Windows\SysWOW64\WAITFOR.exe
                            WAITFOR /S MKLUFVRL /SI unlock
                            3⤵
                              PID:2052
                            • C:\Users\Admin\AppData\Local\Temp\aes_x64.exe
                              "C:\Users\Admin\AppData\Local\Temp\aes_x64.exe" -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o "C:\Users\Admin\AppData\Local\Temp\sfYYbR2iS0eeR2rU\sfYYbR2iS0eeR2rU" -
                              3⤵
                              • Executes dropped EXE
                              PID:1340
                            • C:\Users\Admin\AppData\Local\Temp\curl_x64.exe
                              "C:\Users\Admin\AppData\Local\Temp\curl_x64.exe" --connect-timeout 5 --max-time 20 --fail --silent --request POST --form "v_configuration=<C:\Users\Admin\AppData\Local\Temp\sfYYbR2iS0eeR2rU\sfYYbR2iS0eeR2rU" "https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=sfYYbR2iS0eeR2rU&v_version=3.0.4"
                              3⤵
                              • Executes dropped EXE
                              PID:2736
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C START "" "http://www.touslesdrivers.com/index.php?v_page=31&v_id=sfYYbR2iS0eeR2rU"
                              3⤵
                              • Checks computer location settings
                              PID:2036
                            • C:\Windows\SysWOW64\WAITFOR.exe
                              WAITFOR /S MKLUFVRL /SI unlock
                              3⤵
                                PID:1676
                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                            1⤵
                            • Drops file in Windows directory
                            • Modifies Control Panel
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetWindowsHookEx
                            PID:1536
                          • C:\Windows\system32\browser_broker.exe
                            C:\Windows\system32\browser_broker.exe -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            PID:1468
                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetWindowsHookEx
                            PID:4232
                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4296
                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4736
                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                            1⤵
                            • Modifies registry class
                            PID:4892
                          • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                            "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                            1⤵
                            • Modifies registry class
                            PID:4988

                          Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads