Overview

overview

10

Static

static

8

52fa119750...98.exe

windows7-x64

10

52fa119750...98.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 03:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    52fa119750136bb728653993890fa73eff227769b42e861656977777a5bada98.exe

  • Size

    966KB

  • MD5

    6771ab57f16fb119e7faad8b5ded4bdc

  • SHA1

    12fdb11ef12990764acb5c7a2c21d7ec0f26092b

  • SHA256

    52fa119750136bb728653993890fa73eff227769b42e861656977777a5bada98

  • SHA512

    b188d3abd664ad83021707b7ba8c752dd475137c9a491ed0c28180229c9fb09666b56c2a8c44ad348c55b50a6dd0d80a07e673f13eaf6973964959a5b848c308

  • SSDEEP

    3072:CNnqDxIGX/9nDiG7t6yCAti1zxGJidD5iYAHg4Cs7lJgxwL0out:CNnxKL0oS

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\52fa119750136bb728653993890fa73eff227769b42e861656977777a5bada98.exe
    "C:\Users\Admin\AppData\Local\Temp\52fa119750136bb728653993890fa73eff227769b42e861656977777a5bada98.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3308
      • C:\Users\Admin\E696D64614\winlogon.exe
        Error 448
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:4860
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:1784
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4484 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3624

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
            Filesize

            2KB

            MD5

            1c626eac6241b02b0082a76f150a3a8a

            SHA1

            b7c0c6ae1d3d5a2beaf4c4f3744cac6285f04858

            SHA256

            412116af67c3a894bee8821158ee91447ca6cfe0d5b43d0524e6c5af5defaf69

            SHA512

            8550f0ec9a9c5f152a3b5eb49a91084d3201589373b8d381233926f1ac34bd0c276fa1e3c9da75bd8297f417d9f566f4bf6b882107c7255522f745e6d446802a

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            Filesize

            471B

            MD5

            1520b1f0e8660cc8553264ce46871efd

            SHA1

            70c43f2c0b7599f782461590f8e1650a2df5dbfe

            SHA256

            8bb8dd5446da57093db31c10b4093a2378a9324f137d3eaa21ab0027e191c09e

            SHA512

            6ad8d5f620738988286981654070c9a4e2542f629f4e5245381143a2a88c98922145759ff8d90546e1a617639a7dd335ddca4aba5435fb216c01c705bc4f0be0

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            1KB

            MD5

            48e98893438d04fa64bb49bbdafbf960

            SHA1

            e28578281fc80cb97275a94aa0e9da0db8285b87

            SHA256

            2ad261d743636a48688f1d3a1a9def925c6a7642db3dea12b8c23e5aac46719d

            SHA512

            9eb1160e51ce79e0a7055a053ac5f25d2ff8d7277f8af146c188a1bd24deddd12df219aeb410f072b26ccaa114b88d7680d474c86736a0ab3187ec7ee08c73b0

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
            Filesize

            488B

            MD5

            62393a34c8499a7b8cf1df0b1fd92947

            SHA1

            0f563483752375b61e6a05d64eb9522604562437

            SHA256

            50b530491bc32fcc6dc6cf528a68e75b5f1aa1dfe4e052b9f8b8cd81690f7e5b

            SHA512

            96a2eb116d59719b1b9d048ce7889207b6ee68f8eb5fd94492df4a165d40260d0e1fa62b9928d2665d6703f97504bcd607ba206d4e6e21f33db78dddb937af42

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            Filesize

            404B

            MD5

            f9e75d5f691cd59b5b841a6b34177b0b

            SHA1

            23e497c64b178c471b6ea4b3784d451df9a02566

            SHA256

            243cfe7b0427358b8ef1cb08354ba4d901b08460a37c3b08b30b6e924ee31b22

            SHA512

            80b9955e5969f8c84827c48c8393f2c8268157d47fe1204fece07d83e90b4f2c87e5009174efcfff1d29e24e2393494ba2eca91942c54595b45ae111930afe87

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            482B

            MD5

            5f81a98c445ad89158f009c7359cd96f

            SHA1

            fcda6b26e09df93d7696a2cc657f7105160132b5

            SHA256

            fd13b28e5e4d31cb199c71d556e84d9ad9d6318a83fc3aa2f9e4f8ae64a4e68f

            SHA512

            08f5a8d687d50e2e831717c78ce8ec2362c4177a28626ad7524c067e95694e66350a5a5a3f1c05d483a112f5b2be936211022065a78034898278fd1eca6ef3b7

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            966KB

            MD5

            6771ab57f16fb119e7faad8b5ded4bdc

            SHA1

            12fdb11ef12990764acb5c7a2c21d7ec0f26092b

            SHA256

            52fa119750136bb728653993890fa73eff227769b42e861656977777a5bada98

            SHA512

            b188d3abd664ad83021707b7ba8c752dd475137c9a491ed0c28180229c9fb09666b56c2a8c44ad348c55b50a6dd0d80a07e673f13eaf6973964959a5b848c308

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            966KB

            MD5

            6771ab57f16fb119e7faad8b5ded4bdc

            SHA1

            12fdb11ef12990764acb5c7a2c21d7ec0f26092b

            SHA256

            52fa119750136bb728653993890fa73eff227769b42e861656977777a5bada98

            SHA512

            b188d3abd664ad83021707b7ba8c752dd475137c9a491ed0c28180229c9fb09666b56c2a8c44ad348c55b50a6dd0d80a07e673f13eaf6973964959a5b848c308

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            966KB

            MD5

            6771ab57f16fb119e7faad8b5ded4bdc

            SHA1

            12fdb11ef12990764acb5c7a2c21d7ec0f26092b

            SHA256

            52fa119750136bb728653993890fa73eff227769b42e861656977777a5bada98

            SHA512

            b188d3abd664ad83021707b7ba8c752dd475137c9a491ed0c28180229c9fb09666b56c2a8c44ad348c55b50a6dd0d80a07e673f13eaf6973964959a5b848c308

            Download Submit

          • memory/3308-140-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

            Download

          • memory/4728-134-0x0000000000400000-0x0000000000448000-memory.dmp

            Filesize

            288KB

            Download

          • memory/4860-149-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4860-145-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4860-146-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4860-142-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4860-154-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download