bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd

Analysis

max time kernel
189s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe
Size

722KB
MD5

63518f651efd1062d40dbfc3c124c267
SHA1

bfbca0a83d5b15db721b2c07ea3f7c6d51ed763e
SHA256

bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd
SHA512

7b34b3134b54bc3dea9e7b5d93abbab206c56e1f633aa5b88ae601b65f52b101508776cafbb3e40a1f55b406cfb44e79d9f5ac5d3ddb87f90391605a3985d61f
SSDEEP

12288:9Up3EQ6T6jpV3KVMeHf2Jl84yfFr+3p8rkKQr6MCNVkgQpNaQ4ppFJN9IJaXSO:9KTV0TfkOYK1NkgQ3+mJaCO

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Falaheye.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Falaheye.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Java\uninstall.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
3064	uninstall.exe
112	uninstall.exe
2416	uninstall.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
	upx
behavioral2/memory/2200-134-0x0000000000400000-0x000000000065E000-memory.dmp	upx
behavioral2/files/0x0003000000000733-139.dat	upx
behavioral2/files/0x0003000000000733-140.dat	upx
behavioral2/memory/2200-141-0x0000000000400000-0x000000000065E000-memory.dmp	upx
behavioral2/memory/112-145-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/files/0x0003000000000733-146.dat	upx
behavioral2/memory/112-148-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/112-151-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/files/0x0003000000000733-152.dat	upx
behavioral2/memory/2416-150-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2416-155-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/2416-157-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3064-158-0x0000000000400000-0x000000000065E000-memory.dmp	upx
behavioral2/memory/2416-162-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/112-161-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/112-172-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/2416-173-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java(TM) Platform SE Auto Updator 2.1 = "C:\\Users\\Admin\\AppData\\Roaming\\Java\\uninstall.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 112	3064	uninstall.exe	88
PID 3064 set thread context of 2416	3064	uninstall.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
764	reg.exe
616	reg.exe
760	reg.exe
4040	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	uninstall.exe
Token: 1	112	uninstall.exe
Token: SeCreateTokenPrivilege	112	uninstall.exe
Token: SeAssignPrimaryTokenPrivilege	112	uninstall.exe
Token: SeLockMemoryPrivilege	112	uninstall.exe
Token: SeIncreaseQuotaPrivilege	112	uninstall.exe
Token: SeMachineAccountPrivilege	112	uninstall.exe
Token: SeTcbPrivilege	112	uninstall.exe
Token: SeSecurityPrivilege	112	uninstall.exe
Token: SeTakeOwnershipPrivilege	112	uninstall.exe
Token: SeLoadDriverPrivilege	112	uninstall.exe
Token: SeSystemProfilePrivilege	112	uninstall.exe
Token: SeSystemtimePrivilege	112	uninstall.exe
Token: SeProfSingleProcessPrivilege	112	uninstall.exe
Token: SeIncBasePriorityPrivilege	112	uninstall.exe
Token: SeCreatePagefilePrivilege	112	uninstall.exe
Token: SeCreatePermanentPrivilege	112	uninstall.exe
Token: SeBackupPrivilege	112	uninstall.exe
Token: SeRestorePrivilege	112	uninstall.exe
Token: SeShutdownPrivilege	112	uninstall.exe
Token: SeDebugPrivilege	112	uninstall.exe
Token: SeAuditPrivilege	112	uninstall.exe
Token: SeSystemEnvironmentPrivilege	112	uninstall.exe
Token: SeChangeNotifyPrivilege	112	uninstall.exe
Token: SeRemoteShutdownPrivilege	112	uninstall.exe
Token: SeUndockPrivilege	112	uninstall.exe
Token: SeSyncAgentPrivilege	112	uninstall.exe
Token: SeEnableDelegationPrivilege	112	uninstall.exe
Token: SeManageVolumePrivilege	112	uninstall.exe
Token: SeImpersonatePrivilege	112	uninstall.exe
Token: SeCreateGlobalPrivilege	112	uninstall.exe
Token: 31	112	uninstall.exe
Token: 32	112	uninstall.exe
Token: 33	112	uninstall.exe
Token: 34	112	uninstall.exe
Token: 35	112	uninstall.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2200	bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe
3064	uninstall.exe
112	uninstall.exe
2416	uninstall.exe
112	uninstall.exe
112	uninstall.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 4260	2200	bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe	83
PID 2200 wrote to memory of 4260	2200	bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe	83
PID 2200 wrote to memory of 4260	2200	bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe	83
PID 4260 wrote to memory of 5060	4260	cmd.exe	86
PID 4260 wrote to memory of 5060	4260	cmd.exe	86
PID 4260 wrote to memory of 5060	4260	cmd.exe	86
PID 2200 wrote to memory of 3064	2200	bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe	87
PID 2200 wrote to memory of 3064	2200	bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe	87
PID 2200 wrote to memory of 3064	2200	bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe	87
PID 3064 wrote to memory of 112	3064	uninstall.exe	88
PID 3064 wrote to memory of 112	3064	uninstall.exe	88
PID 3064 wrote to memory of 112	3064	uninstall.exe	88
PID 3064 wrote to memory of 112	3064	uninstall.exe	88
PID 3064 wrote to memory of 112	3064	uninstall.exe	88
PID 3064 wrote to memory of 112	3064	uninstall.exe	88
PID 3064 wrote to memory of 112	3064	uninstall.exe	88
PID 3064 wrote to memory of 112	3064	uninstall.exe	88
PID 3064 wrote to memory of 2416	3064	uninstall.exe	89
PID 3064 wrote to memory of 2416	3064	uninstall.exe	89
PID 3064 wrote to memory of 2416	3064	uninstall.exe	89
PID 3064 wrote to memory of 2416	3064	uninstall.exe	89
PID 3064 wrote to memory of 2416	3064	uninstall.exe	89
PID 3064 wrote to memory of 2416	3064	uninstall.exe	89
PID 3064 wrote to memory of 2416	3064	uninstall.exe	89
PID 3064 wrote to memory of 2416	3064	uninstall.exe	89
PID 112 wrote to memory of 4824	112	uninstall.exe	90
PID 112 wrote to memory of 4824	112	uninstall.exe	90
PID 112 wrote to memory of 4824	112	uninstall.exe	90
PID 112 wrote to memory of 3512	112	uninstall.exe	92
PID 112 wrote to memory of 3512	112	uninstall.exe	92
PID 112 wrote to memory of 3512	112	uninstall.exe	92
PID 112 wrote to memory of 3860	112	uninstall.exe	93
PID 112 wrote to memory of 3860	112	uninstall.exe	93
PID 112 wrote to memory of 3860	112	uninstall.exe	93
PID 112 wrote to memory of 3364	112	uninstall.exe	95
PID 112 wrote to memory of 3364	112	uninstall.exe	95
PID 112 wrote to memory of 3364	112	uninstall.exe	95
PID 4824 wrote to memory of 764	4824	cmd.exe	98
PID 4824 wrote to memory of 764	4824	cmd.exe	98
PID 4824 wrote to memory of 764	4824	cmd.exe	98
PID 3512 wrote to memory of 616	3512	cmd.exe	99
PID 3512 wrote to memory of 616	3512	cmd.exe	99
PID 3512 wrote to memory of 616	3512	cmd.exe	99
PID 3860 wrote to memory of 760	3860	cmd.exe	100
PID 3860 wrote to memory of 760	3860	cmd.exe	100
PID 3860 wrote to memory of 760	3860	cmd.exe	100
PID 3364 wrote to memory of 4040	3364	cmd.exe	101
PID 3364 wrote to memory of 4040	3364	cmd.exe	101
PID 3364 wrote to memory of 4040	3364	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe
"C:\Users\Admin\AppData\Local\Temp\bce9cf26477f047fa38cd71a227559248bd218679ce7c7b07530e16b4aa54dcd.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BPqgp.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f
    3⤵
    - Adds Run key to start application
    PID:5060
- C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
  "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
    C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:112
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:764
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3512
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:616
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3860
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:760
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:4040
- - C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
    C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BPqgp.bat

Filesize
173B

MD5
0f9512ff58185a551abc4fa80ffde3b5

SHA1
eb2df1adbb3504236d2857d8a9c297121c97a95d

SHA256
79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189

SHA512
1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

Download Submit
C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

Filesize
722KB

MD5
dcbaf4e70541040ccc2f743806312f4c

SHA1
ac93e9146b85ff9b776f3dfe87a47a9a6802be4d

SHA256
dac7ad57b1c2f22285798334a1ce6cb6a756c5d4031c862945d0c74d3192ac85

SHA512
4208da7eeab240bd04b13b77fa6cddbb4fc00247a9ac5ef67c9570d028cd105f852059a17e7255ef7a01edd331a87e11033b0b868ad8915508a31eaad04d4c70

Download Submit
C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

Filesize
722KB

MD5
dcbaf4e70541040ccc2f743806312f4c

SHA1
ac93e9146b85ff9b776f3dfe87a47a9a6802be4d

SHA256
dac7ad57b1c2f22285798334a1ce6cb6a756c5d4031c862945d0c74d3192ac85

SHA512
4208da7eeab240bd04b13b77fa6cddbb4fc00247a9ac5ef67c9570d028cd105f852059a17e7255ef7a01edd331a87e11033b0b868ad8915508a31eaad04d4c70

Download Submit
C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

Filesize
722KB

MD5
dcbaf4e70541040ccc2f743806312f4c

SHA1
ac93e9146b85ff9b776f3dfe87a47a9a6802be4d

SHA256
dac7ad57b1c2f22285798334a1ce6cb6a756c5d4031c862945d0c74d3192ac85

SHA512
4208da7eeab240bd04b13b77fa6cddbb4fc00247a9ac5ef67c9570d028cd105f852059a17e7255ef7a01edd331a87e11033b0b868ad8915508a31eaad04d4c70

Download Submit
C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

Filesize
722KB

MD5
dcbaf4e70541040ccc2f743806312f4c

SHA1
ac93e9146b85ff9b776f3dfe87a47a9a6802be4d

SHA256
dac7ad57b1c2f22285798334a1ce6cb6a756c5d4031c862945d0c74d3192ac85

SHA512
4208da7eeab240bd04b13b77fa6cddbb4fc00247a9ac5ef67c9570d028cd105f852059a17e7255ef7a01edd331a87e11033b0b868ad8915508a31eaad04d4c70

Download Submit
memory/112-151-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/112-145-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/112-148-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/112-161-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/112-172-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2200-141-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2200-134-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2416-150-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-173-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-162-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-155-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2416-157-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3064-158-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads