Overview

overview

10

Static

static

5512ad06b4...17.exe

windows7-x64

10

5512ad06b4...17.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11-10-2022 02:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317.exe

  • Size

    1.3MB

  • MD5

    7c68c5320e98e8d617fca8e6cf142a40

  • SHA1

    84815db970023be773fd096c17828a7daef2f4eb

  • SHA256

    5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317

  • SHA512

    8943f0f13838ffdf834e87be87a12d44fc65c84816e34bde6bf47a391fefa38a74d0d85b32fc1a0f9c9d08d041545988381e5b25b498008f3ac05563ccf7936d

  • SSDEEP

    3072:fN5q0LwrHmp4hJo4SaW4A1nx3gCBTAIYVXcJfT8Keout:fNKoS

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 14 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317.exe
    "C:\Users\Admin\AppData\Local\Temp\5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Drops startup file
        • Windows security modification
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1688
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    2KB

    MD5

    6f59ed058aa06aaf5ec6213b955aabd4

    SHA1

    baf7b828a563b8fb6111e4ce35e0055575ad80b4

    SHA256

    2d82e2629fa2e08f28b43b15da43dff56c7f4b23b39d66109c7c61998e35b4d5

    SHA512

    6b0f041dafb98b9eaf70ac0d20a98c56e1c42231c4a4ae6e11582b20d20bf8f96dfd7747739a10d77368994441adb0e181b356f8569697b1f22ab4fe931170ce

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    60KB

    MD5

    d15aaa7c9be910a9898260767e2490e1

    SHA1

    2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

    SHA256

    f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

    SHA512

    7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    1KB

    MD5

    0698dbc93ba7b6bef73ba316695f8317

    SHA1

    a444078ff1eb7c88f52cb4e324365926b491ed47

    SHA256

    263292040d77903899257c1d21201dc64d6f8d6b5a1d945cd5b28d0124d7906c

    SHA512

    ebacaa7009aebb88199cd70fd0bb3afe69ed300318cb633edd1c0404e42aef829617f589bcbad6cb7ab4bd0a8ae87f7df1435c786184ecc5de61c8fc6950a900

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    488B

    MD5

    57f3c111c4eaa5b152e2f741c575e8aa

    SHA1

    2f80edf285c633778911e2e9d93d51fe62948138

    SHA256

    2404cdc5c88d40e59f2c59573b35054a14fe7e6b2447c8c7b322844faae76d43

    SHA512

    0ffc0ff3a375178d9f5a3ceeab1236857a8520d4a082564d8624da1a244931c27f9a52be924560fb92e0b631198363738bfc59e4cc730753e30926230a9e322f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    81a2edda7a77b9d4fc7a71b55fc08972

    SHA1

    6c36369f54486bf679e28931ebc85f98c464af59

    SHA256

    909bb9c822c90ad5e712d3056436355f80f0a524bf0928cc91b6b3b88b8551d6

    SHA512

    80ff47c2bbdc6d7f05e13f9ec905ca49e649856fa495a7d6c853bac06ea525964e0e0bbfbb025986196309d4b052313d78fe92bbd2a495d6985dca4a6b3458ca

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c34efa00ea32da2335483581e8fa2cf1

    SHA1

    649727fb7e5c69a1e84e8e9bfc153a63197b1958

    SHA256

    9a4de344cec7ba318b2a62a6d86ff6442f22bf65fff1bc36e55ff298eaa2654a

    SHA512

    ea5f1777a352021b147a3a8a313d1c666eaf5d935c1169e76fa2b6134789df4dfcbe64171e219c6d67599cd61f684b0d20ecec31468f4c23fcf56f6216512a66

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f7cbd01a39fe040bd222279be73cd05d

    SHA1

    3f2e82ddb3419780f3bf606357467e1d6e064f79

    SHA256

    aff091927048f611978ff7943eca0337fdbef08fe18290799f3317c73b3a2140

    SHA512

    8d0811a6512a5544891eb8e7d36752f72eb21d5e80814ff5aeb5b711bf7a4a9b3fa2a8a9e5e55e7c8c65fe6a891100a183856391faac582a3291965cc935fd48

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f7cbd01a39fe040bd222279be73cd05d

    SHA1

    3f2e82ddb3419780f3bf606357467e1d6e064f79

    SHA256

    aff091927048f611978ff7943eca0337fdbef08fe18290799f3317c73b3a2140

    SHA512

    8d0811a6512a5544891eb8e7d36752f72eb21d5e80814ff5aeb5b711bf7a4a9b3fa2a8a9e5e55e7c8c65fe6a891100a183856391faac582a3291965cc935fd48

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    482B

    MD5

    aa5004cf86dc175092d07f00008d41b9

    SHA1

    337d233a31b49b99039b84869b44fc80023af81c

    SHA256

    3e651f10284e26c12cb5793931368060965d29292660cae7fe2cbac4a3d9ae68

    SHA512

    954635e59c8bc4b73bf2a04c72e2be2a364a98e6bd65f22f51aec48165367c3dcfffa0b5866e664e657ac55fd4d3a9b3a8867b649d1d4ad21cfc7ba6f8f90ce6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    c9e705177ae23261a55b9c8af523ee7b

    SHA1

    9a16e6e7b5753c67ce2597b96c11816ae4e33838

    SHA256

    2d0796d6e7331f972b982e70eb70a94b6d41d79354a5916513cfcdae96772aba

    SHA512

    2b4fe44b4131789b928bbabc269fd29efb9fdc344479091e37dcf896c7a13b3baa8331dcba09a8ad66ed149c3d55c514f9dd60c3670af5a80974a4cb03ff75a5

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\201N6OGA.txt
    Filesize

    96B

    MD5

    f5cb1537f67208aa3e0868575fe0a622

    SHA1

    b62d28add7224d501d471321da42e3993f053874

    SHA256

    236683a4628da4c7788d83732b7b17eeb390fb4315a819c5d50e9c79f150ef2b

    SHA512

    7fd0ced5199be89f6f3ff05fd969b5225b5a4d9697ec0bf3b07774a3a7fdb6a2a788ef6ddb35c24850f529aca365324f9d6b60b036d3d8dfd8c4f170514c75cb

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\C58I1OEI.txt
    Filesize

    606B

    MD5

    7f42daa613696ebea4572afadf1c26d7

    SHA1

    3577dff01159d1ca6f8956f9b533fd9748c0f903

    SHA256

    8d280670d173c0c8d118f756ae6a26ca9a97dbade34742fcd59971789a0758e4

    SHA512

    b0a0fe4a60989921c5869115894b131f0c65a26846a19d78a74667272eaa453067d01017b0ca045399529084fd8f11848d048a108087aa0ce8d9841d7d164c0e

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.3MB

    MD5

    7c68c5320e98e8d617fca8e6cf142a40

    SHA1

    84815db970023be773fd096c17828a7daef2f4eb

    SHA256

    5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317

    SHA512

    8943f0f13838ffdf834e87be87a12d44fc65c84816e34bde6bf47a391fefa38a74d0d85b32fc1a0f9c9d08d041545988381e5b25b498008f3ac05563ccf7936d

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.3MB

    MD5

    7c68c5320e98e8d617fca8e6cf142a40

    SHA1

    84815db970023be773fd096c17828a7daef2f4eb

    SHA256

    5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317

    SHA512

    8943f0f13838ffdf834e87be87a12d44fc65c84816e34bde6bf47a391fefa38a74d0d85b32fc1a0f9c9d08d041545988381e5b25b498008f3ac05563ccf7936d

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.3MB

    MD5

    7c68c5320e98e8d617fca8e6cf142a40

    SHA1

    84815db970023be773fd096c17828a7daef2f4eb

    SHA256

    5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317

    SHA512

    8943f0f13838ffdf834e87be87a12d44fc65c84816e34bde6bf47a391fefa38a74d0d85b32fc1a0f9c9d08d041545988381e5b25b498008f3ac05563ccf7936d

    Download Submit

  • \Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.3MB

    MD5

    7c68c5320e98e8d617fca8e6cf142a40

    SHA1

    84815db970023be773fd096c17828a7daef2f4eb

    SHA256

    5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317

    SHA512

    8943f0f13838ffdf834e87be87a12d44fc65c84816e34bde6bf47a391fefa38a74d0d85b32fc1a0f9c9d08d041545988381e5b25b498008f3ac05563ccf7936d

    Download Submit

  • \Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.3MB

    MD5

    7c68c5320e98e8d617fca8e6cf142a40

    SHA1

    84815db970023be773fd096c17828a7daef2f4eb

    SHA256

    5512ad06b424fd085fceb25b51ac3597f01c2dde7c6c77048e225597ea3d2317

    SHA512

    8943f0f13838ffdf834e87be87a12d44fc65c84816e34bde6bf47a391fefa38a74d0d85b32fc1a0f9c9d08d041545988381e5b25b498008f3ac05563ccf7936d

    Download Submit

  • memory/1432-65-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/1688-73-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1688-72-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1688-84-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1688-85-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1688-68-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/2044-55-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/2044-62-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/2044-57-0x0000000075F81000-0x0000000075F83000-memory.dmp

    Filesize

    8KB

    Download