Overview

overview

10

Static

static

10

payload.bin.exe

windows10_x64

10

Resubmissions

24-08-2021 11:16

210824-cr7ejlmq52 10

24-08-2021 11:10

210824-h5xzl36re6 10

24-08-2021 10:57

210824-r8ta8bdd7n 10

Analysis

  • max time kernel
    597s
  • max time network
    385s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    24-08-2021 11:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    payload.bin.exe

  • Size

    472KB

  • MD5

    a89b5a1a3c1a93488c80c0068fa16109

  • SHA1

    adeb69a80fe2bf50fd4ce269cc061a92b7ea7314

  • SHA256

    6cdefe842611b0f9fea4571bc07ff0de77740f440115852436f4afd1324e981a

  • SHA512

    c9ad3935a82af2c10c7db9e2a5b83e498de7fa8864b81db33798b629aeff72ce8a5b0dcd66ddf595c608bd87e0b9a94f70fef53f58d506095dbdcb4a8416061e

Score
10/10
shurkevasioninfostealerpersistencespywarestealer

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs
    evasion
  • Shurk

    Shurk is an infostealer, written in C++ which appeared in 2021.

    infostealershurk
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 45 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\payload.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\payload.bin.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:1492
  • C:\Windows\system32\werfault.exe
    werfault.exe /h /shared Global\2aeec9187d09448d863638beece28256 /t 4000 /p 3036
    1⤵
      PID:184
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Users\Admin\AppData\Local\Temp\payload.bin.exe
        "C:\Users\Admin\AppData\Local\Temp\payload.bin.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4080
    • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
      "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3628
    • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:996
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4084
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3340
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\DMI8FD7.tmp
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:3348
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\wct5EF5.tmp
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:1664

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2752-114-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

        Filesize

        4KB

        Download