Overview

overview

10

Static

static

8

04443c70d3...be.exe

windows7_x64

9

04443c70d3...be.exe

windows10_x64

9

05535d72f3...06.exe

windows7_x64

1

05535d72f3...06.exe

windows10_x64

1

1bec139d54...72.exe

windows7_x64

8

1bec139d54...72.exe

windows10_x64

8

1f670ff8cc...55.exe

windows7_x64

1

1f670ff8cc...55.exe

windows10_x64

1

2deaa0ec74...ea.exe

windows7_x64

10

2deaa0ec74...ea.exe

windows10_x64

10

372b929ae9...ef.dll

windows7_x64

9

372b929ae9...ef.dll

windows10_x64

9

38ee6bea62...15.exe

windows7_x64

3

38ee6bea62...15.exe

windows10_x64

3

437d91ce52...8f.exe

windows7_x64

1

437d91ce52...8f.exe

windows10_x64

4

447058c1c6...a8.exe

windows7_x64

9

447058c1c6...a8.exe

windows10_x64

9

5061c0b08d...03.exe

windows7_x64

1

5061c0b08d...03.exe

windows10_x64

1

5ed4b682ef...d4.exe

windows7_x64

8

5ed4b682ef...d4.exe

windows10_x64

8

6970600d21...b5.exe

windows7_x64

1

6970600d21...b5.exe

windows10_x64

1

72f528f9a6...92.exe

windows7_x64

8

72f528f9a6...92.exe

windows10_x64

8

73dcee7abe...99.exe

windows7_x64

1

73dcee7abe...99.exe

windows10_x64

1

7e118b534a...d2.exe

windows7_x64

10

7e118b534a...d2.exe

windows10_x64

10

8034fffb03...3c.exe

windows7_x64

10

8034fffb03...3c.exe

windows10_x64

10

Analysis

  • max time kernel
    55s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-03-2021 09:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe

  • Size

    818KB

  • MD5

    d8e9c7825c9f7c3828ff4a579a965a8a

  • SHA1

    8db1c5dcd2d583a6644f7e7d613837309b0092a5

  • SHA256

    72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592

  • SHA512

    9379b64c348f3b070cdf0a962ccd22f8ff7111fd0bbc7f242feca32cada3cb5ce46b132be1675705983f96e75146051ed2a84d36fe13bc7ac10fe89105a103b3

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 23 IoCs
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe
    "C:\Users\Admin\AppData\Local\Temp\72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:662050 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\72f528f9a6bb7e6ccf45d9e25e77badb6e9fd8533c0fd8dac26a087347ff8592.exe" "__IRCT:2" "__IRTSS:0" "__IRSID:S-1-5-21-293278959-2699126792-324916226-1000"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Users\Admin\AppData\Roaming\WinCtrView\Engin\ProVersion\WinCtrCon.exe
        C:\Users\Admin\AppData\Roaming\WinCtrView\Engin\ProVersion\WinCtrCon.exe /f
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Users\Admin\AppData\Roaming\WinCtrView\Engin\ProVersion\WinCtrProc.exe
          "C:\Users\Admin\AppData\Roaming\WinCtrView\Engin\ProVersion\WinCtrProc.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:800
          • C:\Users\Admin\AppData\Roaming\WinCtrViewer\Engin\ProVersion\WinCtrCon.exe
            C:\Users\Admin\AppData\Roaming\WinCtrViewer\Engin\ProVersion\WinCtrCon.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1892
            • C:\Users\Admin\AppData\Roaming\WinCtrViewer\Engin\ProVersion\WinCtrProc.exe
              "C:\Users\Admin\AppData\Roaming\WinCtrViewer\Engin\ProVersion\WinCtrProc.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Modifies Internet Explorer settings
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              PID:1648

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/436-25-0x000007FEF7160000-0x000007FEF73DA000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/800-48-0x00000000029B0000-0x00000000029B4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/800-47-0x00000000004E0000-0x00000000004E4000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1748-2-0x0000000075EB1000-0x0000000075EB3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1892-53-0x0000000000230000-0x0000000000234000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1892-54-0x0000000002870000-0x0000000002874000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2024-34-0x0000000002670000-0x0000000002674000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2024-33-0x0000000000360000-0x0000000000364000-memory.dmp

    Filesize

    16KB

    Download