Overview

overview

10

Static

static

1

Anime-Figh...24.exe

windows7_x64

8

Anime-Figh...24.exe

windows7_x64

10

Anime-Figh...24.exe

windows7_x64

10

Anime-Figh...24.exe

windows7_x64

8

Anime-Figh...24.exe

windows11_x64

8

Anime-Figh...24.exe

windows10_x64

10

Anime-Figh...24.exe

windows10_x64

Anime-Figh...24.exe

windows10_x64

10

Anime-Figh...24.exe

windows10_x64

10

Anime-Figh...24.exe

windows10_x64

10

Resubmissions

02-09-2021 19:12

210902-xwla1aeefq 10

02-09-2021 19:09

210902-xtsbjabea9 8

Analysis

  • max time kernel
    73s
  • max time network
    75s
  • platform
    windows10_x64
  • resource
    win10-fr
  • submitted
    02-09-2021 19:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Anime-Fighters-Infin_734316524.exe

  • Size

    3.9MB

  • MD5

    bd2b73492acf20dec004360b1605032d

  • SHA1

    60ddf3c107d94bbeb102a2d7ede945eb5edd2b35

  • SHA256

    12b6272825140a15eabec58f97b49aed3ce5db7816a0b3c2674f6ae8746367ca

  • SHA512

    dae236259e32a9e4b789f020dbd8082b376e3c2b56fd94523a44cf4b5a557f3661aeefc24b5605218ba0479ee1b9a8cb7b5c1df6c103673a99f13bc4210c90da

Score
10/10
discoverysuricataupx

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 17 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 17 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe
    "C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:432
    • C:\Users\Admin\AppData\Local\Temp\is-KEM27.tmp\Anime-Fighters-Infin_734316524.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KEM27.tmp\Anime-Fighters-Infin_734316524.tmp" /SL5="$2011E,3656070,140800,C:\Users\Admin\AppData\Local\Temp\Anime-Fighters-Infin_734316524.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Program Files (x86)\Vel\magnam\Expedita.exe
        "C:\Program Files (x86)\Vel/\magnam\Expedita.exe" 32cb7aca069a0c8bb8d51fccce1d3826
        3⤵
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3332
        • C:\Users\Admin\AppData\Local\Temp\lvY3hDhG\z3zKE.exe
          C:\Users\Admin\AppData\Local\Temp\lvY3hDhG\z3zKE.exe /quiet SILENT=1 AF=606x32cb7aca069a0c8bb8d51fccce1d3826
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4720
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=606x32cb7aca069a0c8bb8d51fccce1d3826 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\lvY3hDhG\z3zKE.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\lvY3hDhG\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1630350493 /quiet SILENT=1 AF=606x32cb7aca069a0c8bb8d51fccce1d3826 " AF="606x32cb7aca069a0c8bb8d51fccce1d3826" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"
            5⤵
              PID:3876
          • C:\Users\Admin\AppData\Local\Temp\fphuXjyc\B7gdH53AO.exe
            C:\Users\Admin\AppData\Local\Temp\fphuXjyc\B7gdH53AO.exe /usthree SUB=32cb7aca069a0c8bb8d51fccce1d3826
            4⤵
            • Executes dropped EXE
            PID:4796
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 652
              5⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              PID:4404
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 668
              5⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              PID:4512
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 768
              5⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              PID:4536
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 808
              5⤵
              • Program crash
              PID:2196
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 884
              5⤵
              • Program crash
              PID:2868
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 904
              5⤵
              • Program crash
              PID:4860
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1152
              5⤵
              • Program crash
              PID:924
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1132
              5⤵
              • Program crash
              PID:5084
          • C:\Users\Admin\AppData\Local\Temp\aEMlrGlz\vpn.exe
            C:\Users\Admin\AppData\Local\Temp\aEMlrGlz\vpn.exe /silent /subid=510x32cb7aca069a0c8bb8d51fccce1d3826
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4852
            • C:\Users\Admin\AppData\Local\Temp\is-V830K.tmp\vpn.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-V830K.tmp\vpn.tmp" /SL5="$2030A,15170975,270336,C:\Users\Admin\AppData\Local\Temp\aEMlrGlz\vpn.exe" /silent /subid=510x32cb7aca069a0c8bb8d51fccce1d3826
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4916
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2200
                • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                  tapinstall.exe remove tap0901
                  7⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  PID:4816
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4636
                • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                  tapinstall.exe install OemVista.inf tap0901
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Checks SCSI registry key(s)
                  • Modifies system certificate store
                  PID:5016
              • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                6⤵
                  PID:4844
                • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                  "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                  6⤵
                    PID:5116
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:864
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4124
            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
              C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
              3⤵
              • Executes dropped EXE
              PID:4388
              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe
                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"
                4⤵
                  PID:4028
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s seclogon
            1⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4360
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:4548
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
              1⤵
                PID:4684
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Enumerates connected drives
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5004
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding C49AADEB894C541E118B022ED9154AD9 C
                  2⤵
                  • Loads dropped DLL
                  PID:4112
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 0BB9A25CA0AD2A8DD6D7274AF0C27038
                  2⤵
                  • Loads dropped DLL
                  PID:4924
              • \??\c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                1⤵
                  PID:4264
                  • C:\Windows\system32\DrvInst.exe
                    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{5173bf23-fc76-274c-9cf4-836926b05f4f}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"
                    2⤵
                      PID:4660
                    • C:\Windows\system32\DrvInst.exe
                      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"
                      2⤵
                        PID:2680
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                      1⤵
                        PID:4512
                      • \??\c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                        1⤵
                          PID:2316
                        • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                          "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                          1⤵
                            PID:4560

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/432-119-0x0000000000400000-0x000000000042D000-memory.dmp

                            Filesize

                            180KB

                            Download

                          • memory/2476-120-0x0000000000530000-0x00000000005DE000-memory.dmp

                            Filesize

                            696KB

                            Download

                          • memory/3332-124-0x0000000000400000-0x00000000019C2000-memory.dmp

                            Filesize

                            21.8MB

                            Download

                          • memory/3332-125-0x00000000045B0000-0x00000000045B1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4796-150-0x0000000004650000-0x0000000004698000-memory.dmp

                            Filesize

                            288KB

                            Download

                          • memory/4796-151-0x0000000000400000-0x0000000002B5E000-memory.dmp

                            Filesize

                            39.4MB

                            Download

                          • memory/4844-223-0x00000000017E0000-0x000000000192A000-memory.dmp

                            Filesize

                            1.3MB

                            Download

                          • memory/4844-222-0x0000000000400000-0x00000000015D7000-memory.dmp

                            Filesize

                            17.8MB

                            Download

                          • memory/4844-221-0x0000000001830000-0x0000000001831000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4844-220-0x0000000001820000-0x0000000001821000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4852-145-0x0000000000400000-0x000000000044C000-memory.dmp

                            Filesize

                            304KB

                            Download

                          • memory/4916-161-0x0000000008C60000-0x0000000008C75000-memory.dmp

                            Filesize

                            84KB

                            Download

                          • memory/4916-149-0x0000000006B30000-0x0000000006E10000-memory.dmp

                            Filesize

                            2.9MB

                            Download

                          • memory/4916-158-0x0000000008B50000-0x0000000008B5F000-memory.dmp

                            Filesize

                            60KB

                            Download

                          • memory/4916-208-0x0000000002520000-0x0000000002521000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4916-146-0x0000000000720000-0x0000000000721000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/4916-207-0x0000000008B40000-0x0000000008B41000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5116-226-0x00000000017E0000-0x00000000017E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5116-227-0x00000000017F0000-0x00000000017F1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/5116-228-0x0000000000400000-0x00000000015D7000-memory.dmp

                            Filesize

                            17.8MB

                            Download

                          • memory/5116-229-0x00000000017E0000-0x000000000192A000-memory.dmp

                            Filesize

                            1.3MB

                            Download