Overview
overview
10Static
static
10001.exe
windows7_x64
10001.exe
windows10-2004_x64
101488.exe
windows7_x64
101488.exe
windows10-2004_x64
11_cr.exe
windows7_x64
51_cr.exe
windows10-2004_x64
41cr.exe
windows7_x64
101cr.exe
windows10-2004_x64
41fc2d.exe
windows7_x64
101fc2d.exe
windows10-2004_x64
106e7_2021-0...04.exe
windows7_x64
106e7_2021-0...04.exe
windows10-2004_x64
10Abjects.exe
windows7_x64
1Abjects.exe
windows10-2004_x64
4BattleText.exe
windows7_x64
10BattleText.exe
windows10-2004_x64
1HANS.exe
windows7_x64
3HANS.exe
windows10-2004_x64
1Hulu.exe
windows7_x64
8Hulu.exe
windows10-2004_x64
8IntelFIVE.exe
windows7_x64
3IntelFIVE.exe
windows10-2004_x64
7IntelFOUR.exe
windows7_x64
3IntelFOUR.exe
windows10-2004_x64
7IntelONE.exe
windows7_x64
3IntelONE.exe
windows10-2004_x64
7IntelTHREE.exe
windows7_x64
3IntelTHREE.exe
windows10-2004_x64
7IntelTWO.exe
windows7_x64
3IntelTWO.exe
windows10-2004_x64
7Lucky_Fixed.exe
windows7_x64
3Lucky_Fixed.exe
windows10-2004_x64
10Resubmissions
07-02-2022 00:34
220207-aw81qsdce2 10Analysis
-
max time kernel
210s -
max time network
237s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
07-02-2022 00:34
Behavioral task
behavioral1
Sample
001.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral2
Sample
001.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral3
Sample
1488.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral4
Sample
1488.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral5
Sample
1_cr.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral6
Sample
1_cr.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral7
Sample
1cr.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral8
Sample
1cr.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral9
Sample
1fc2d.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral10
Sample
1fc2d.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral11
Sample
6e7_2021-01-19_18-04.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral12
Sample
6e7_2021-01-19_18-04.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral13
Sample
Abjects.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral14
Sample
Abjects.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral15
Sample
BattleText.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral16
Sample
BattleText.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral17
Sample
HANS.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral18
Sample
HANS.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral19
Sample
Hulu.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral20
Sample
Hulu.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral21
Sample
IntelFIVE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral22
Sample
IntelFIVE.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral23
Sample
IntelFOUR.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral24
Sample
IntelFOUR.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral25
Sample
IntelONE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral26
Sample
IntelONE.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral27
Sample
IntelTHREE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral28
Sample
IntelTHREE.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral29
Sample
IntelTWO.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral30
Sample
IntelTWO.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral31
Sample
Lucky_Fixed.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral32
Sample
Lucky_Fixed.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
General
-
Target
1fc2d.exe
-
Size
3.5MB
-
MD5
8f94297c9a87de5c84a3c6b2d43a3809
-
SHA1
611cb3591c6a428f01f82c08c4bea4972635445f
-
SHA256
e1eda5c9ef3158ecc5dabc82b244def26c0a938c797a1c97752ff32505b0f048
-
SHA512
033e87be95251798d567dc80d2582880126372668dc021bd008be439d73768b94340301e1ceee3ed2833f73cc35fafc5b522147ddd25a3b685508cd3c363e4a5
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer Payload 2 IoCs
resource yara_rule behavioral10/memory/4060-136-0x0000000000400000-0x0000000000470000-memory.dmp shurk_stealer behavioral10/memory/4060-137-0x0000000000400000-0x0000000000470000-memory.dmp shurk_stealer -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 1132 created 3712 1132 WerFault.exe 54 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 1fc2d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
pid Process 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3712 set thread context of 4060 3712 1fc2d.exe 64 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2132 3712 WerFault.exe 54 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1696 timeout.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 47 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4016" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132888443247637905" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3864" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.658534" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3712 1fc2d.exe 3712 1fc2d.exe 3712 1fc2d.exe 4060 1fc2d.exe 4060 1fc2d.exe 2132 WerFault.exe 2132 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3712 1fc2d.exe Token: SeRestorePrivilege 2132 WerFault.exe Token: SeBackupPrivilege 2132 WerFault.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3712 wrote to memory of 3508 3712 1fc2d.exe 61 PID 3712 wrote to memory of 3508 3712 1fc2d.exe 61 PID 3712 wrote to memory of 3508 3712 1fc2d.exe 61 PID 3508 wrote to memory of 1696 3508 cmd.exe 63 PID 3508 wrote to memory of 1696 3508 cmd.exe 63 PID 3508 wrote to memory of 1696 3508 cmd.exe 63 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 3712 wrote to memory of 4060 3712 1fc2d.exe 64 PID 1132 wrote to memory of 3712 1132 WerFault.exe 54 PID 1132 wrote to memory of 3712 1132 WerFault.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc2d.exe"C:\Users\Admin\AppData\Local\Temp\1fc2d.exe"1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
PID:1696
-
-
-
C:\Users\Admin\AppData\Local\Temp\1fc2d.exe"C:\Users\Admin\AppData\Local\Temp\1fc2d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3712 -s 16162⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3712 -ip 37121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1132