Analysis

  • max time kernel
    4294211s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20220311-en
  • submitted
    04-04-2022 03:42

General

  • Target

    Service.exe

  • Size

    385KB

  • MD5

    45abb1bedf83daf1f2ebbac86e2fa151

  • SHA1

    7d9ccba675478ab65707a28fd277a189450fc477

  • SHA256

    611479c78035c912dd69e3cfdadbf74649bb1fce6241b7573cfb0c7a2fc2fb2f

  • SHA512

    6bf1f7e0800a90666206206c026eadfc7f3d71764d088e2da9ca60bf5a63de92bd90515342e936d02060e1d5f7c92ddec8b0bcc85adfd8a8f4df29bd6f12c25c

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Service.exe
    "C:\Users\Admin\AppData\Local\Temp\Service.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe
      "C:\Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Users\Admin\Pictures\Adobe Films\xhHdjGYIwFulfOaZIwhO9BKf.exe
        "C:\Users\Admin\Pictures\Adobe Films\xhHdjGYIwFulfOaZIwhO9BKf.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1548
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1248 -s 364
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:700
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:1520
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:392

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    81180798f4d48d852ec031c3eed10781

    SHA1

    b66bbc8d7a8e5e0c65b0d9c624f2c13e6bfe8c61

    SHA256

    f901a508db08da3d9cc47b3eade0ddc2bbb273b92cccecfe26df7a6df9f9e4bc

    SHA512

    4de8e91721ce37693c410a38ee5fb73ca260b8006904916fbb1892114918b2ced1bfb1d5a4195e666d94ae1fdfbef4932c128b5c2e8e76036869ea11a1a31c58

  • C:\Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe

    Filesize

    232KB

    MD5

    5546c1ab6768292b78c746d9ea627f4a

    SHA1

    be3bf3f21b6101099bcfd7203a179829aea4b435

    SHA256

    93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15

    SHA512

    90d341f42f80c99558b9659e6cc39f7211acaf4010234c51f7cc66d729102f25b50bf29688ee29b8a4031b4f35d4666617a278ba1754c96c26aa6759027f601f

  • C:\Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe

    Filesize

    232KB

    MD5

    5546c1ab6768292b78c746d9ea627f4a

    SHA1

    be3bf3f21b6101099bcfd7203a179829aea4b435

    SHA256

    93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15

    SHA512

    90d341f42f80c99558b9659e6cc39f7211acaf4010234c51f7cc66d729102f25b50bf29688ee29b8a4031b4f35d4666617a278ba1754c96c26aa6759027f601f

  • C:\Users\Admin\Pictures\Adobe Films\xhHdjGYIwFulfOaZIwhO9BKf.exe

    Filesize

    318KB

    MD5

    3f22bd82ee1b38f439e6354c60126d6d

    SHA1

    63b57d818f86ea64ebc8566faeb0c977839defde

    SHA256

    265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

    SHA512

    b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

  • \Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe

    Filesize

    232KB

    MD5

    5546c1ab6768292b78c746d9ea627f4a

    SHA1

    be3bf3f21b6101099bcfd7203a179829aea4b435

    SHA256

    93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15

    SHA512

    90d341f42f80c99558b9659e6cc39f7211acaf4010234c51f7cc66d729102f25b50bf29688ee29b8a4031b4f35d4666617a278ba1754c96c26aa6759027f601f

  • \Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe

    Filesize

    232KB

    MD5

    5546c1ab6768292b78c746d9ea627f4a

    SHA1

    be3bf3f21b6101099bcfd7203a179829aea4b435

    SHA256

    93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15

    SHA512

    90d341f42f80c99558b9659e6cc39f7211acaf4010234c51f7cc66d729102f25b50bf29688ee29b8a4031b4f35d4666617a278ba1754c96c26aa6759027f601f

  • \Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe

    Filesize

    232KB

    MD5

    5546c1ab6768292b78c746d9ea627f4a

    SHA1

    be3bf3f21b6101099bcfd7203a179829aea4b435

    SHA256

    93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15

    SHA512

    90d341f42f80c99558b9659e6cc39f7211acaf4010234c51f7cc66d729102f25b50bf29688ee29b8a4031b4f35d4666617a278ba1754c96c26aa6759027f601f

  • \Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe

    Filesize

    232KB

    MD5

    5546c1ab6768292b78c746d9ea627f4a

    SHA1

    be3bf3f21b6101099bcfd7203a179829aea4b435

    SHA256

    93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15

    SHA512

    90d341f42f80c99558b9659e6cc39f7211acaf4010234c51f7cc66d729102f25b50bf29688ee29b8a4031b4f35d4666617a278ba1754c96c26aa6759027f601f

  • \Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe

    Filesize

    232KB

    MD5

    5546c1ab6768292b78c746d9ea627f4a

    SHA1

    be3bf3f21b6101099bcfd7203a179829aea4b435

    SHA256

    93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15

    SHA512

    90d341f42f80c99558b9659e6cc39f7211acaf4010234c51f7cc66d729102f25b50bf29688ee29b8a4031b4f35d4666617a278ba1754c96c26aa6759027f601f

  • \Users\Admin\Documents\jm235Pg5NufPS8T2Br5Niylp.exe

    Filesize

    232KB

    MD5

    5546c1ab6768292b78c746d9ea627f4a

    SHA1

    be3bf3f21b6101099bcfd7203a179829aea4b435

    SHA256

    93708ec7bc1f9f7581cc2e1310a46000ad38128e19eb1e92db88e59d425b3e15

    SHA512

    90d341f42f80c99558b9659e6cc39f7211acaf4010234c51f7cc66d729102f25b50bf29688ee29b8a4031b4f35d4666617a278ba1754c96c26aa6759027f601f

  • \Users\Admin\Pictures\Adobe Films\xhHdjGYIwFulfOaZIwhO9BKf.exe

    Filesize

    318KB

    MD5

    3f22bd82ee1b38f439e6354c60126d6d

    SHA1

    63b57d818f86ea64ebc8566faeb0c977839defde

    SHA256

    265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a

    SHA512

    b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f

  • memory/1220-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

    Filesize

    8KB

  • memory/1248-63-0x0000000003F10000-0x00000000040CF000-memory.dmp

    Filesize

    1.7MB