Overview

overview

8

Static

static

8

9a977973f1...72.exe

windows7-x64

8

9a977973f1...72.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    177s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 22:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe

  • Size

    454KB

  • MD5

    1c47243eaae673a0777df97c43974f10

  • SHA1

    58787798b2f1b2d359da52875fb22b45a0c976ac

  • SHA256

    9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272

  • SHA512

    db2ed4451ea39480dd22ef6b6398914883667ddd33460b4b330ab470db2d1735ef07ddbf593155f33d15c71dcedcc381b55793061477267659a62d46affe6194

  • SSDEEP

    12288:lhrCbb9ucMu5aCQ+8Wy5VtogPXFCzeuWgvayZBzoS:lhc9uBCQ+8Wyxy/vd

Score
8/10
bootkitpersistencespywarestealerupx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe
    "C:\Users\Admin\AppData\Local\Temp\9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe.BYFX0\dis.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2264
      • C:\Windows\SysWOW64\net.exe
        net stop "PolicyAgent"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "PolicyAgent"
          4⤵
            PID:1904
        • C:\Windows\SysWOW64\sc.exe
          sc config PolicyAgent start= disabled
          3⤵
          • Launches sc.exe
          PID:3504

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\9a977973f10d2ba4738a1ac39e6180e1df31ba25e2d69dfb979f358939339272.exe.BYFX0\dis.bat
            Filesize

            63B

            MD5

            070f1025dc93f20d1b28896c8ab01ff3

            SHA1

            3a646f02dbf445ea75f331d1128e711ea2463d64

            SHA256

            e6374bfc2301536dc06ce5e26b299fad2c630cde8a47548cd31edd86deed38b3

            SHA512

            c5017b2ad1b76b55ad49c41ea06decf71b5ee00934c583d919c489e6d4da506174dd7be62b36af6c3b77c6ae0fd6825fe3fbe86e881ef47bc1749e2c86c6edef

            Download Submit

          • memory/4840-133-0x0000000000400000-0x000000000054A000-memory.dmp

            Filesize

            1.3MB

            Download

          • memory/4840-138-0x0000000000400000-0x000000000054A000-memory.dmp

            Filesize

            1.3MB

            Download