Analysis

  • max time kernel
    6s
  • max time network
    171s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2022, 17:21

General

  • Target

    5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe

  • Size

    234KB

  • MD5

    7c417476aa335db03433180a3276e5ae

  • SHA1

    40068932a90e2128299dcf23d82ae20cdaf69689

  • SHA256

    5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51

  • SHA512

    cb26b9212b00860567eb78da735ee7932ab524b732489d788dd3366de769c7c3f2db3757d9b4edc88172265c02a1651dcdc5430519d20f2eda9c48b708e48b3e

  • SSDEEP

    6144:2xV8dI3bxRETtXaz/OJepymej5viyT5O/q9DUGEyoSW:2n8dI3b7ETtKKepymejF5aeDUGNoSW

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe
    "C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe
      "C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /renew
        3⤵
        • Gathers network information
        PID:1012
    • C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe
      "C:\Users\Admin\AppData\Local\Temp\5bef6ef243cebc4f0a25044c631e9d633dc2dbd8af113538f88ea9a377bdbc51.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe
        "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe
          "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:392
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /renew
            5⤵
            • Gathers network information
            PID:1044
        • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe
          "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:568
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\XYBLR.bat" "
            5⤵
              PID:1128
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SkipeTurns" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /f
                6⤵
                  PID:1088
            • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe
              "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1760
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                5⤵
                  PID:1000
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                    6⤵
                    • Modifies registry key
                    PID:1936
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe:*:Enabled:Windows Messanger" /f
                  5⤵
                    PID:1112
                    • C:\Windows\SysWOW64\reg.exe
                      REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SkipeTurns.exe:*:Enabled:Windows Messanger" /f
                      6⤵
                      • Modifies registry key
                      PID:1464
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                    5⤵
                      PID:1512
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                        6⤵
                        • Modifies registry key
                        PID:1480
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DarkEye2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DarkEye2.exe:*:Enabled:Windows Messanger" /f
                      5⤵
                        PID:556
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DarkEye2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DarkEye2.exe:*:Enabled:Windows Messanger" /f
                          6⤵
                          • Modifies registry key
                          PID:1552

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\XYBLR.bat

                Filesize

                142B

                MD5

                7aab82a958be0bdc325ec075c874ca64

                SHA1

                f4ab3d6776f6ffc569a878a003df9a4f0a331eb6

                SHA256

                446e766a1c4c57cf38c3b70b1152a5c1216cc86388fefe5d7d39522458436144

                SHA512

                1737e41a539341737e4fc5c22f13c10b34e5054b2e1b44e604490c4faaf943442c596581fb28b0c967935cfd92c5fd4e7331fb72ae2d4f6ef1b8acc64b46f240

              • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • C:\Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • \Users\Admin\AppData\Roaming\SkipeTurns.exe

                Filesize

                234KB

                MD5

                9482d1301879ae497a45c22ea38008d2

                SHA1

                c9a2a143a40007bb4d800cf70247b3eba993fffe

                SHA256

                9537951719a91b7bd8cb90f0b6ba6a583032a7bd371f19583656c0c53a703a30

                SHA512

                990a6b41aa9a7e3e02cbdb4fcb73b3c401434dd19d68f701df1bcadf0a48f2be8fd3ab81cc711c54a94bb5b7e773a58818b3edc393a68030a2c411b1c5e24f14

              • memory/392-136-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/392-156-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/568-157-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/568-137-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/808-71-0x0000000002670000-0x000000000274F000-memory.dmp

                Filesize

                892KB

              • memory/808-76-0x0000000000400000-0x00000000004DF000-memory.dmp

                Filesize

                892KB

              • memory/808-69-0x0000000000400000-0x00000000004DF000-memory.dmp

                Filesize

                892KB

              • memory/1012-82-0x0000000075B41000-0x0000000075B43000-memory.dmp

                Filesize

                8KB

              • memory/1076-77-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/1076-83-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/1076-78-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/1076-63-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/1076-65-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/1076-131-0x0000000002AD0000-0x0000000002BAF000-memory.dmp

                Filesize

                892KB

              • memory/1076-67-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/1076-139-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/1076-134-0x0000000002AD0000-0x0000000002BAF000-memory.dmp

                Filesize

                892KB

              • memory/1076-70-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

              • memory/1224-133-0x0000000000400000-0x00000000004DF000-memory.dmp

                Filesize

                892KB

              • memory/1292-60-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/1292-68-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/1292-154-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/1292-59-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/1292-57-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/1292-64-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/1292-56-0x0000000000400000-0x000000000040C000-memory.dmp

                Filesize

                48KB

              • memory/1760-138-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/1760-128-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/1760-125-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/1760-112-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/1760-113-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/1760-116-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/1760-155-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB

              • memory/1760-117-0x0000000000400000-0x000000000047B000-memory.dmp

                Filesize

                492KB