Overview

overview

8

Static

static

7c65733155...41.exe

windows7-x64

8

7c65733155...41.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    162s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 22:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7c657331556aeb226567989c3dcb31f343fbf13629ac5eb9965c4384683f8541.exe

  • Size

    20KB

  • MD5

    6d48427fb1c409ef55c6998a85b1a7f0

  • SHA1

    00cc5a6aa742b992be2754d44d60b09d3941a279

  • SHA256

    7c657331556aeb226567989c3dcb31f343fbf13629ac5eb9965c4384683f8541

  • SHA512

    b87a76b981765cb17c8f2fde05c2ed02117daa28b21065efe5127e43c1fd47cbf2b9b6bc913d94d8d6e7b2ffcd4c16b3cf9df6fae67cb60eb602c86fd9e17066

  • SSDEEP

    192:1l5E3krTuntKy0peHDfCpHfBv+I4QwXt9V+jqu0G5KDJBJUv:1M3PnQoHDCpHf4I4Qwdc0G5KDJG

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Drops desktop.ini file(s) 3 IoCs
  • Drops autorun.inf file 1 TTPs 27 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
    adwarespyware
  • Modifies registry class 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7c657331556aeb226567989c3dcb31f343fbf13629ac5eb9965c4384683f8541.exe
    "C:\Users\Admin\AppData\Local\Temp\7c657331556aeb226567989c3dcb31f343fbf13629ac5eb9965c4384683f8541.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\AE 0124 BE.gif
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3200
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3200 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4512
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Checks computer location settings
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:2424
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4832

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          471B

          MD5

          fd70739fca5345a28f924f9102ae10ee

          SHA1

          6ce3f92183544f3bf52cb76364591589cb940a19

          SHA256

          f238404cc643efddef8ff430f128cdc8ec1513969eaac24b5e5bce81248a91e7

          SHA512

          a787d3a2bceeaed2f2a29f357df6ae17d5b9f66a3c561550d5f83c308ad26a1ddf876488151ff5e51ce93bfb9d0c7b8ca812d595e8d3ebdda7d805707ac1b278

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          404B

          MD5

          0e57c1b97945e7377c45145cbf656420

          SHA1

          0ac26308353c9d13bb8fac6c8382a5c788a941b0

          SHA256

          74a8d30b8875e67c75f4a514c5f4eb74a8ad9c07868dc8b57e75daff4a82d530

          SHA512

          49d68c223932dd0d58e9e2d58708c7a4146daa315db959adfe84f66e6dcd4aafeb64912862dd12fd958170eff5e6e02873929bbd933899bb3dd6750e28d9183c

          Download Submit

        • C:\Windows\AE 0124 BE.exe
          Filesize

          40KB

          MD5

          13a5065c1debaf8cad4cd679f0a15c04

          SHA1

          07d8194a203684508423317d50b3dd11ce293524

          SHA256

          21dd9f003d9e7a6fc8cab1895335fd8544b6e71a65d0b21390c5472640593b35

          SHA512

          19d2fc4dcdb4014f3be616c5c8d445c64d263cee3f53d906da55553397d7c4ea1ec1f7367e7847a9f5b85c171308ff663a0719b9c68e498ee83c564be0b5f02b

          Download Submit

        • C:\Windows\AE 0124 BE.exe
          Filesize

          40KB

          MD5

          13a5065c1debaf8cad4cd679f0a15c04

          SHA1

          07d8194a203684508423317d50b3dd11ce293524

          SHA256

          21dd9f003d9e7a6fc8cab1895335fd8544b6e71a65d0b21390c5472640593b35

          SHA512

          19d2fc4dcdb4014f3be616c5c8d445c64d263cee3f53d906da55553397d7c4ea1ec1f7367e7847a9f5b85c171308ff663a0719b9c68e498ee83c564be0b5f02b

          Download Submit

        • C:\Windows\AE 0124 BE.gif
          Filesize

          20KB

          MD5

          cc462d81762cb3d3ce3578f799e310b3

          SHA1

          70397dbfb8f95458e5c8cf0e1fbfe77fe900d9fa

          SHA256

          0ae758990a8843c96ed3a943604db84e919f4f7e5290c68767606574f8fa9fe2

          SHA512

          a2b47ecdd5e8c1742f73afdb5a92a0144c8de66203ae528f09a78906f168edc5d4ea5735d5ee342389428d59e6f87e29886df216e706936c094cefcc9a3420e1

          Download Submit

        • C:\Windows\AE 0124 BE.gif
          Filesize

          40KB

          MD5

          dd74ec71061a4ceb3675499bda1b27ac

          SHA1

          20a29eafe445578b6d8f487793c3a2ba04647908

          SHA256

          8c44741a094b44267adaa2d6f2031861965a6972513ecb92fd872b6def103059

          SHA512

          93b4037125586cd03a19c4c27762cb90fca98d4b18329a56305187d2cfbc3c05e7c63e352729c61ac04c13d8a03aa58371637bf32d176e71582b58e09483f612

          Download Submit

        • C:\Windows\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\MSVBVM60.DLL
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          40KB

          MD5

          13a5065c1debaf8cad4cd679f0a15c04

          SHA1

          07d8194a203684508423317d50b3dd11ce293524

          SHA256

          21dd9f003d9e7a6fc8cab1895335fd8544b6e71a65d0b21390c5472640593b35

          SHA512

          19d2fc4dcdb4014f3be616c5c8d445c64d263cee3f53d906da55553397d7c4ea1ec1f7367e7847a9f5b85c171308ff663a0719b9c68e498ee83c564be0b5f02b

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          40KB

          MD5

          13a5065c1debaf8cad4cd679f0a15c04

          SHA1

          07d8194a203684508423317d50b3dd11ce293524

          SHA256

          21dd9f003d9e7a6fc8cab1895335fd8544b6e71a65d0b21390c5472640593b35

          SHA512

          19d2fc4dcdb4014f3be616c5c8d445c64d263cee3f53d906da55553397d7c4ea1ec1f7367e7847a9f5b85c171308ff663a0719b9c68e498ee83c564be0b5f02b

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          40KB

          MD5

          13a5065c1debaf8cad4cd679f0a15c04

          SHA1

          07d8194a203684508423317d50b3dd11ce293524

          SHA256

          21dd9f003d9e7a6fc8cab1895335fd8544b6e71a65d0b21390c5472640593b35

          SHA512

          19d2fc4dcdb4014f3be616c5c8d445c64d263cee3f53d906da55553397d7c4ea1ec1f7367e7847a9f5b85c171308ff663a0719b9c68e498ee83c564be0b5f02b

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          40KB

          MD5

          13a5065c1debaf8cad4cd679f0a15c04

          SHA1

          07d8194a203684508423317d50b3dd11ce293524

          SHA256

          21dd9f003d9e7a6fc8cab1895335fd8544b6e71a65d0b21390c5472640593b35

          SHA512

          19d2fc4dcdb4014f3be616c5c8d445c64d263cee3f53d906da55553397d7c4ea1ec1f7367e7847a9f5b85c171308ff663a0719b9c68e498ee83c564be0b5f02b

          Download Submit

        • \??\c:\B1uv3nth3x1.diz
          Filesize

          25B

          MD5

          589b6886a49054d03b739309a1de9fcc

          SHA1

          0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

          SHA256

          564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

          SHA512

          4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

          Download Submit

        • \??\c:\B1uv3nth3x1.diz
          Filesize

          25B

          MD5

          589b6886a49054d03b739309a1de9fcc

          SHA1

          0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

          SHA256

          564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

          SHA512

          4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

          Download Submit