Overview

overview

10

Static

static

8

42af7afa3e...fc.exe

windows7-x64

10

42af7afa3e...fc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2022, 21:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    42af7afa3e4fdb77b23e43f2019e8203e146ce08482e705c027d4456122f22fc.exe

  • Size

    914KB

  • MD5

    e9f336c6f932a1621f283e9c998e7495

  • SHA1

    14e1d1a7ebac436749af2b4738d92e2ac375c09d

  • SHA256

    42af7afa3e4fdb77b23e43f2019e8203e146ce08482e705c027d4456122f22fc

  • SHA512

    4b7e06485c34a8433462a38fc3c605ae82542614de8cc461772d2700409b1c9bfc2f839fd1cb2ea17e589fe6f1c37a197f4781214c285962e712ea059e88f6a0

  • SSDEEP

    1536:+EfFNvtgmAl7z5dKY6yuJPW8K43w9NXOM1aRl/i6JWT0S9yXnBibnouy8gHn2JX:+YLmGO4W849NXO9RlK6gOxiDouto2N

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\42af7afa3e4fdb77b23e43f2019e8203e146ce08482e705c027d4456122f22fc.exe
    "C:\Users\Admin\AppData\Local\Temp\42af7afa3e4fdb77b23e43f2019e8203e146ce08482e705c027d4456122f22fc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2316
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:3864
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2908
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2908 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4912

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
            Filesize

            2KB

            MD5

            1c626eac6241b02b0082a76f150a3a8a

            SHA1

            b7c0c6ae1d3d5a2beaf4c4f3744cac6285f04858

            SHA256

            412116af67c3a894bee8821158ee91447ca6cfe0d5b43d0524e6c5af5defaf69

            SHA512

            8550f0ec9a9c5f152a3b5eb49a91084d3201589373b8d381233926f1ac34bd0c276fa1e3c9da75bd8297f417d9f566f4bf6b882107c7255522f745e6d446802a

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            1KB

            MD5

            48e98893438d04fa64bb49bbdafbf960

            SHA1

            e28578281fc80cb97275a94aa0e9da0db8285b87

            SHA256

            2ad261d743636a48688f1d3a1a9def925c6a7642db3dea12b8c23e5aac46719d

            SHA512

            9eb1160e51ce79e0a7055a053ac5f25d2ff8d7277f8af146c188a1bd24deddd12df219aeb410f072b26ccaa114b88d7680d474c86736a0ab3187ec7ee08c73b0

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
            Filesize

            488B

            MD5

            ad77b553459e3844a3a1893e22587275

            SHA1

            513767a33bb82eeeb577a1d6f2940034d1a6e0ba

            SHA256

            96d4a38d4e023dd7231b31606fd62941d10a23d3c40a67c19cbf3a5019e6099e

            SHA512

            238d82692f02e200914e9f63ac76e8363f570988ff4ed008094a545d93169d2c881d21eb4d73b23ac78fe942054aec32cfa279e3cf1743fa1276a5160e6a8366

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
            Filesize

            482B

            MD5

            3080f213eca12f4808e02ab6591eebea

            SHA1

            cfb845c79721d0ffe74dde942b41abfc7c5ef64a

            SHA256

            b04bba394316486de99590b30b11e0c18e3ba907fc75fe6c984bd80f6166271b

            SHA512

            39831bab6e337d518da80b87cf0da128efa2ed16d6eeb8a344c40728adfb5e88d9ec91d4ab3bda3a99087553a3dcffd05d990080a52da84287a21b0f8a2c0a62

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml
            Filesize

            15KB

            MD5

            1a545d0052b581fbb2ab4c52133846bc

            SHA1

            62f3266a9b9925cd6d98658b92adec673cbe3dd3

            SHA256

            557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

            SHA512

            bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            914KB

            MD5

            e9f336c6f932a1621f283e9c998e7495

            SHA1

            14e1d1a7ebac436749af2b4738d92e2ac375c09d

            SHA256

            42af7afa3e4fdb77b23e43f2019e8203e146ce08482e705c027d4456122f22fc

            SHA512

            4b7e06485c34a8433462a38fc3c605ae82542614de8cc461772d2700409b1c9bfc2f839fd1cb2ea17e589fe6f1c37a197f4781214c285962e712ea059e88f6a0

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            914KB

            MD5

            e9f336c6f932a1621f283e9c998e7495

            SHA1

            14e1d1a7ebac436749af2b4738d92e2ac375c09d

            SHA256

            42af7afa3e4fdb77b23e43f2019e8203e146ce08482e705c027d4456122f22fc

            SHA512

            4b7e06485c34a8433462a38fc3c605ae82542614de8cc461772d2700409b1c9bfc2f839fd1cb2ea17e589fe6f1c37a197f4781214c285962e712ea059e88f6a0

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            914KB

            MD5

            e9f336c6f932a1621f283e9c998e7495

            SHA1

            14e1d1a7ebac436749af2b4738d92e2ac375c09d

            SHA256

            42af7afa3e4fdb77b23e43f2019e8203e146ce08482e705c027d4456122f22fc

            SHA512

            4b7e06485c34a8433462a38fc3c605ae82542614de8cc461772d2700409b1c9bfc2f839fd1cb2ea17e589fe6f1c37a197f4781214c285962e712ea059e88f6a0

            Download Submit

          • memory/2316-145-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/2316-146-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/2316-142-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/2316-153-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/2316-155-0x0000000000400000-0x000000000043F000-memory.dmp

            Filesize

            252KB

            Download

          • memory/4248-137-0x0000000000400000-0x0000000000447000-memory.dmp

            Filesize

            284KB

            Download

          • memory/5108-140-0x0000000000400000-0x0000000000447000-memory.dmp

            Filesize

            284KB

            Download

          • memory/5108-154-0x0000000000400000-0x0000000000447000-memory.dmp

            Filesize

            284KB

            Download