Overview

overview

8

Static

static

8

45659c8b8a...3e.exe

windows7_x64

8

45659c8b8a...3e.exe

windows10_x64

8

Resubmissions

30-08-2022 13:11

220830-qeyfnsaha8 8

22-01-2021 10:07

210122-7vwcckmmtj 8

Analysis

  • max time kernel
    149s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    22-01-2021 10:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe

  • Size

    149KB

  • MD5

    fdbd0ccb8d0bea52f95cedb51c3de9e9

  • SHA1

    d6fa30eeb170c70fc3892429df2872372b3cef48

  • SHA256

    45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e

  • SHA512

    3457221f4ef4e0e79f694f89b30c36fe731037f1565aae49d9b0bb151c6e50fb0523c0f7a82ba333726bd2f9822561e3ee794bacc1e8f052ea9a3a7d5bcbe3d0

Score
8/10
persistenceransomwarespywareupx

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Drops desktop.ini file(s) 72 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Drops file in Program Files directory 22364 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Control Panel 5 IoCs
    evasion
  • Modifies registry class 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 26 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe
    "C:\Users\Admin\AppData\Local\Temp\45659c8b8a21158dbad3a15a174a42f923c6c179d9dcc3168d64f89cd9f1433e.exe"
    1⤵
    • Modifies extensions of user files
    • Drops startup file
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Drops file in Windows directory
    PID:812
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3048 -s 5992
    1⤵
    • Program crash
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4060
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:188
  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2328
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
    "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
    1⤵
    • Modifies Control Panel
    • Suspicious use of SetWindowsHookEx
    PID:2908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

4
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1985363256-3005190890-1182679451-1000\desktop.ini
    MD5

    ce5ceabf941e1385c18777a78f973bd5

    SHA1

    4d45077e753e9feea95f03c7a13b6cf47672e6b9

    SHA256

    4bd07a0c12fd2e6f554262807da51bf03ced8c9862452512c9520a496155ef15

    SHA512

    669543fc5e67eab47ac379cf751a5be811ff418fcbf7d9217a6ed99cdbddfea1b7f3dad1b4ff100a49dc5e279cc6f59e34bb42923ddfd0aa3459f4b863d13f4b

    Download Submit
  • C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.cnh
    MD5

    9001dd272796751d4ddac16be3ff2720

    SHA1

    2e5a1001b7f759732402d62a7ae29c0a3a70c5da

    SHA256

    2803124944125a7f958a3b67bea714945aca3ab5483322cd2e2d7df39496a709

    SHA512

    b39a6503ed20ffcc054bc9197a39019d56f08f9f546cc5c31e31dfbfa6ad2f9a93e47a4a59349947d4e39db890701c1cb87d5864de24f0bf6ad29dace9b88f3d

    Download Submit
  • C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.cnh
    MD5

    97c3772eb741b6f823a9963ca0625583

    SHA1

    56e3be4291030e2488d6733869dbaf18a5774655

    SHA256

    795606cc0991c0345abb7db320f539ae2aed644fceaad41d5eed4edac73d89b1

    SHA512

    f25cf278736f11622a5d9207d0707a54f968d9dd50fe421108b8c01bbbf6416f767e080b8968c18210b41c5ab4f58e15b29d236ddda68705f331d2d5daa25f13

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000001d.db.cnh
    MD5

    07a2be451af1be4647fcd7d5d08f7d60

    SHA1

    5bfab77fba2ef65cef7bea12f723e0d437d751aa

    SHA256

    caba1560a25b0824c1c9f7a01e602ee8007a4fac6d35f10345835523509e09d4

    SHA512

    449b98e08cb5ccf590738eb99a6c225985da4cb27cd6dee4a79602e2e4d1e2bc0395169b7fff38f4bedc0261bf538e10ba83e0b705e9d162d83a0b9b02b997fc

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\counters2.dat
    MD5

    df54d5feaa636740073fa3fd9c44ea99

    SHA1

    d91f9cd4b5620575a3e97cd171ef2af03e10dd32

    SHA256

    572c6a17f53ef4dfc478ff1a1d9f8f39724657adbd661f2fbc7c5fe27dcdcb45

    SHA512

    80cd481f31f301efa5a90a3a7653187a2e5c5239e724db6aeea2437b0f4b8090f6640bde4817ba0f9c08f87d8ecfe6558646df2a667eef9f0daf7ece2cbddfe9

    Download Submit
  • memory/812-2-0x00007FF6D8A40000-0x00007FF6D8AAD000-memory.dmp
    Filesize

    436KB

    Download
  • memory/4060-4-0x0000027781400000-0x0000027781401000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4060-5-0x0000027781400000-0x0000027781401000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4060-6-0x0000027781400000-0x0000027781401000-memory.dmp
    Filesize

    4KB

    Download