Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
07-12-2021 05:44
Static task
static1
General
-
Target
5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe
-
Size
5.4MB
-
MD5
fbed9adbc9c2fd72dafa222895e23fa6
-
SHA1
baa0aeb40229192772ea65dffebb721fde3dcf3b
-
SHA256
5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd
-
SHA512
b26405f78c7bfdd241222ff721144746f3819404808a798aa8e81f4a465b708c61140b2b2aca59745292caee9159dca91a74300c83ba850249f247c7268c7234
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Blocklisted process makes network request 1 IoCs
Processes:
WScript.exeflow pid process 32 2432 WScript.exe -
Executes dropped EXE 3 IoCs
Processes:
upslip.exewonnervp.exeDpEditor.exepid process 900 upslip.exe 1288 wonnervp.exe 3644 DpEditor.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
wonnervp.exeDpEditor.exeupslip.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wonnervp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion wonnervp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion DpEditor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DpEditor.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion upslip.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion upslip.exe -
Loads dropped DLL 1 IoCs
Processes:
5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exepid process 4072 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\acmite\upslip.exe themida C:\Users\Admin\AppData\Local\Temp\acmite\upslip.exe themida C:\Users\Admin\AppData\Local\Temp\acmite\wonnervp.exe themida C:\Users\Admin\AppData\Local\Temp\acmite\wonnervp.exe themida behavioral1/memory/900-125-0x00000000003B0000-0x0000000000A8C000-memory.dmp themida behavioral1/memory/900-126-0x00000000003B0000-0x0000000000A8C000-memory.dmp themida behavioral1/memory/1288-127-0x0000000000E40000-0x0000000001521000-memory.dmp themida behavioral1/memory/900-128-0x00000000003B0000-0x0000000000A8C000-memory.dmp themida behavioral1/memory/1288-129-0x0000000000E40000-0x0000000001521000-memory.dmp themida behavioral1/memory/900-130-0x00000000003B0000-0x0000000000A8C000-memory.dmp themida behavioral1/memory/1288-132-0x0000000000E40000-0x0000000001521000-memory.dmp themida behavioral1/memory/1288-134-0x0000000000E40000-0x0000000001521000-memory.dmp themida C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe themida C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe themida behavioral1/memory/3644-140-0x0000000000260000-0x000000000093C000-memory.dmp themida behavioral1/memory/3644-142-0x0000000000260000-0x000000000093C000-memory.dmp themida behavioral1/memory/3644-143-0x0000000000260000-0x000000000093C000-memory.dmp themida behavioral1/memory/3644-144-0x0000000000260000-0x000000000093C000-memory.dmp themida -
Processes:
upslip.exewonnervp.exeDpEditor.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA upslip.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wonnervp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA DpEditor.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
upslip.exewonnervp.exeDpEditor.exepid process 900 upslip.exe 1288 wonnervp.exe 3644 DpEditor.exe -
Drops file in Program Files directory 3 IoCs
Processes:
5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exedescription ioc process File created C:\Program Files (x86)\foler\olader\acppage.dll 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe File created C:\Program Files (x86)\foler\olader\adprovider.dll 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe File created C:\Program Files (x86)\foler\olader\acledit.dll 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wonnervp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wonnervp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wonnervp.exe -
Modifies registry class 1 IoCs
Processes:
wonnervp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings wonnervp.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
DpEditor.exepid process 3644 DpEditor.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
upslip.exewonnervp.exeDpEditor.exepid process 900 upslip.exe 900 upslip.exe 1288 wonnervp.exe 1288 wonnervp.exe 3644 DpEditor.exe 3644 DpEditor.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exewonnervp.exeupslip.exedescription pid process target process PID 4072 wrote to memory of 900 4072 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe upslip.exe PID 4072 wrote to memory of 900 4072 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe upslip.exe PID 4072 wrote to memory of 900 4072 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe upslip.exe PID 4072 wrote to memory of 1288 4072 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe wonnervp.exe PID 4072 wrote to memory of 1288 4072 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe wonnervp.exe PID 4072 wrote to memory of 1288 4072 5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe wonnervp.exe PID 1288 wrote to memory of 996 1288 wonnervp.exe WScript.exe PID 1288 wrote to memory of 996 1288 wonnervp.exe WScript.exe PID 1288 wrote to memory of 996 1288 wonnervp.exe WScript.exe PID 900 wrote to memory of 3644 900 upslip.exe DpEditor.exe PID 900 wrote to memory of 3644 900 upslip.exe DpEditor.exe PID 900 wrote to memory of 3644 900 upslip.exe DpEditor.exe PID 1288 wrote to memory of 2432 1288 wonnervp.exe WScript.exe PID 1288 wrote to memory of 2432 1288 wonnervp.exe WScript.exe PID 1288 wrote to memory of 2432 1288 wonnervp.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe"C:\Users\Admin\AppData\Local\Temp\5d8da3252bf9be54807a015f2718d931077fe49aebaf22a53172a43cf153e0bd.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\acmite\upslip.exe"C:\Users\Admin\AppData\Local\Temp\acmite\upslip.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\acmite\wonnervp.exe"C:\Users\Admin\AppData\Local\Temp\acmite\wonnervp.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\codegkwa.vbs"3⤵PID:996
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\cwrwlnia.vbs"3⤵
- Blocklisted process makes network request
PID:2432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751MD5
1c63a8a1452ce4f1016cf9087b100b0c
SHA1e3d15eed3c134e1cd6ad86369890e91ec91fc5af
SHA256dd706987c754e16967ae68402ee2b1a3a75256d6b6e5f3e61120564873f9e6ef
SHA512863eff5763103fa873b089bd51060ce5591ab4a5eb0303babc35f35323d359a9ad133ba43263ccfa6ed60f2b955713574f56a110cdb89b379176c978a7767288
-
C:\Users\Admin\AppData\Local\Temp\acmite\upslip.exeMD5
24810a567d0f96af01b204b3de8ca798
SHA10b9c1f73d7d6da5fb0b598f64f0b6e33a19f2f87
SHA256390647b6773ea6f3ca9e7d5c38461d22f6a8a27df7d834d5036f8d197f24530c
SHA5124d931032e091d82da556b509f9d1e0819cb2456cb0747fb66a8d32a97d6d1403c32dcb862af8abccef24cbf70cdcb623ced325e091bcb58e54ac8af7ac5f19d6
-
C:\Users\Admin\AppData\Local\Temp\acmite\upslip.exeMD5
24810a567d0f96af01b204b3de8ca798
SHA10b9c1f73d7d6da5fb0b598f64f0b6e33a19f2f87
SHA256390647b6773ea6f3ca9e7d5c38461d22f6a8a27df7d834d5036f8d197f24530c
SHA5124d931032e091d82da556b509f9d1e0819cb2456cb0747fb66a8d32a97d6d1403c32dcb862af8abccef24cbf70cdcb623ced325e091bcb58e54ac8af7ac5f19d6
-
C:\Users\Admin\AppData\Local\Temp\acmite\wonnervp.exeMD5
d9f2c50b03df5f271c61e12167347a0f
SHA1c96eae2633fb9fbd8f4bedb75f9965dbfabf6bb3
SHA2561a07c48bce1c3057379b10a7c7f536a8adbe62c990afe9d53c65f88b35059b10
SHA51232595c268b0e19be213f62e1c10546560b483951c8e94e567e9df1c1e2988652d9c812f073a3209a320514bdae62b697a24fae2e33b625a8e37bbcf0ee05bd06
-
C:\Users\Admin\AppData\Local\Temp\acmite\wonnervp.exeMD5
d9f2c50b03df5f271c61e12167347a0f
SHA1c96eae2633fb9fbd8f4bedb75f9965dbfabf6bb3
SHA2561a07c48bce1c3057379b10a7c7f536a8adbe62c990afe9d53c65f88b35059b10
SHA51232595c268b0e19be213f62e1c10546560b483951c8e94e567e9df1c1e2988652d9c812f073a3209a320514bdae62b697a24fae2e33b625a8e37bbcf0ee05bd06
-
C:\Users\Admin\AppData\Local\Temp\codegkwa.vbsMD5
e3b3f429d7c5becb9309409860fcdf30
SHA1267664068058c2dd815713ad1c9db431a464831a
SHA2567e748060e04c762474a666ddf76a8d65f4aa1d3cd6967b6d00d652c4549372b1
SHA512884ed9f3c5c16466a94ca3f5ebc5239141ee58847843f4e85e870f8b071611bb9ecbdb53246e20e34b48b58719c923e87535c3b36d2bd75fc28dfe1d028e8cd8
-
C:\Users\Admin\AppData\Local\Temp\cwrwlnia.vbsMD5
d306b46ed885843b79cb3466dc514cfd
SHA19169a46ecb10455fb5ec7eb027080561b55f5d8f
SHA256e14375272ae81b1fe3edf3b4479f9dd011b55a7f43859ba4d69bdda3ca994edc
SHA5128ee7a8e00a0f1479d37239575f09e707f95aace860b27ffe44dafb2773ab9aeab8e5d82a7d14e21104a85e12faabae807b165f821940bc04cf50ea07e8fd2db6
-
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exeMD5
24810a567d0f96af01b204b3de8ca798
SHA10b9c1f73d7d6da5fb0b598f64f0b6e33a19f2f87
SHA256390647b6773ea6f3ca9e7d5c38461d22f6a8a27df7d834d5036f8d197f24530c
SHA5124d931032e091d82da556b509f9d1e0819cb2456cb0747fb66a8d32a97d6d1403c32dcb862af8abccef24cbf70cdcb623ced325e091bcb58e54ac8af7ac5f19d6
-
C:\Users\Admin\AppData\Roaming\NCH Software\DrawPad\DpEditor.exeMD5
24810a567d0f96af01b204b3de8ca798
SHA10b9c1f73d7d6da5fb0b598f64f0b6e33a19f2f87
SHA256390647b6773ea6f3ca9e7d5c38461d22f6a8a27df7d834d5036f8d197f24530c
SHA5124d931032e091d82da556b509f9d1e0819cb2456cb0747fb66a8d32a97d6d1403c32dcb862af8abccef24cbf70cdcb623ced325e091bcb58e54ac8af7ac5f19d6
-
\Users\Admin\AppData\Local\Temp\nsy9925.tmp\UAC.dllMD5
adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
memory/900-125-0x00000000003B0000-0x0000000000A8C000-memory.dmpFilesize
6.9MB
-
memory/900-128-0x00000000003B0000-0x0000000000A8C000-memory.dmpFilesize
6.9MB
-
memory/900-131-0x00000000775E0000-0x000000007776E000-memory.dmpFilesize
1.6MB
-
memory/900-119-0x0000000000000000-mapping.dmp
-
memory/900-126-0x00000000003B0000-0x0000000000A8C000-memory.dmpFilesize
6.9MB
-
memory/900-130-0x00000000003B0000-0x0000000000A8C000-memory.dmpFilesize
6.9MB
-
memory/996-135-0x0000000000000000-mapping.dmp
-
memory/1288-134-0x0000000000E40000-0x0000000001521000-memory.dmpFilesize
6.9MB
-
memory/1288-129-0x0000000000E40000-0x0000000001521000-memory.dmpFilesize
6.9MB
-
memory/1288-127-0x0000000000E40000-0x0000000001521000-memory.dmpFilesize
6.9MB
-
memory/1288-132-0x0000000000E40000-0x0000000001521000-memory.dmpFilesize
6.9MB
-
memory/1288-122-0x0000000000000000-mapping.dmp
-
memory/1288-133-0x00000000775E0000-0x000000007776E000-memory.dmpFilesize
1.6MB
-
memory/2432-145-0x0000000000000000-mapping.dmp
-
memory/3644-137-0x0000000000000000-mapping.dmp
-
memory/3644-140-0x0000000000260000-0x000000000093C000-memory.dmpFilesize
6.9MB
-
memory/3644-141-0x00000000775E0000-0x000000007776E000-memory.dmpFilesize
1.6MB
-
memory/3644-142-0x0000000000260000-0x000000000093C000-memory.dmpFilesize
6.9MB
-
memory/3644-143-0x0000000000260000-0x000000000093C000-memory.dmpFilesize
6.9MB
-
memory/3644-144-0x0000000000260000-0x000000000093C000-memory.dmpFilesize
6.9MB