9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a

Analysis

max time kernel
150s
max time network
135s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16-10-2022 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
Size

10.8MB
MD5

a7d7ffc4fd259a1ce33b40148031559f
SHA1

dbb9ffc3511f0b84d2ad9ef6698d859b198d7f5b
SHA256

9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a
SHA512

84134d3d8c6ea0bba8105c6daf3a5a322ac493ed133190141cc415fbc398ed5cf6a77189d29121deed067601534f02b698ab53a59a67aa96557d9d1c97d2fb78
SSDEEP

196608:pIVc7gnXKldqdlxUfGfTY9MxhkoGIb/QrxVe0tx8dj7K5NPDX5PKVYVzWuwnV2:pI8gnXK3qNTY9MEoGgQ9VLVXDX5PiYRE

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1920	wlltweak.exe
2000	CMDtool.tmp

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0006000000014c95-61.dat	upx
behavioral1/files/0x0006000000014c95-62.dat	upx
behavioral1/files/0x0006000000014c95-64.dat	upx
behavioral1/memory/2000-66-0x0000000000400000-0x00000000004C0000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
1952	cmd.exe

Enumerates connected drives 3 TTPs 51 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	wlltweak.exe
File opened (read-only)	\??\o:	wlltweak.exe
File opened (read-only)	\??\x:	wlltweak.exe
File opened (read-only)	\??\y:	wlltweak.exe
File opened (read-only)	\??\j:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\p:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\z:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\b:	wlltweak.exe
File opened (read-only)	\??\n:	wlltweak.exe
File opened (read-only)	\??\b:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\d:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\e:	wlltweak.exe
File opened (read-only)	\??\g:	wlltweak.exe
File opened (read-only)	\??\l:	wlltweak.exe
File opened (read-only)	\??\p:	wlltweak.exe
File opened (read-only)	\??\r:	wlltweak.exe
File opened (read-only)	\??\u:	wlltweak.exe
File opened (read-only)	\??\e:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\i:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\h:	wlltweak.exe
File opened (read-only)	\??\t:	wlltweak.exe
File opened (read-only)	\??\v:	wlltweak.exe
File opened (read-only)	\??\w:	wlltweak.exe
File opened (read-only)	\??\d:	wlltweak.exe
File opened (read-only)	\??\f:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\m:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\r:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\v:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\s:	wlltweak.exe
File opened (read-only)	\??\a:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\l:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\a:	wlltweak.exe
File opened (read-only)	\??\z:	wlltweak.exe
File opened (read-only)	\??\o:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\q:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\k:	wlltweak.exe
File opened (read-only)	\??\E:	wlltweak.exe
File opened (read-only)	\??\h:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\t:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\u:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\x:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\f:	wlltweak.exe
File opened (read-only)	\??\i:	wlltweak.exe
File opened (read-only)	\??\j:	wlltweak.exe
File opened (read-only)	\??\q:	wlltweak.exe
File opened (read-only)	\??\g:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\k:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\n:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\s:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\w:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened (read-only)	\??\y:	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0006000000014bad-55.dat	autoit_exe
behavioral1/files/0x0006000000014bad-57.dat	autoit_exe
behavioral1/files/0x0006000000014bad-59.dat	autoit_exe
behavioral1/memory/2000-66-0x0000000000400000-0x00000000004C0000-memory.dmp	autoit_exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Bcdedit.dll	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
File opened for modification	C:\Windows\Bcdedit.dll	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\CIMV2	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	wlltweak.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1920	wlltweak.exe
1920	wlltweak.exe
1920	wlltweak.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1920	wlltweak.exe
1920	wlltweak.exe
1920	wlltweak.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1920	900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe	27
PID 900 wrote to memory of 1920	900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe	27
PID 900 wrote to memory of 1920	900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe	27
PID 900 wrote to memory of 1920	900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe	27
PID 900 wrote to memory of 1952	900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe	28
PID 900 wrote to memory of 1952	900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe	28
PID 900 wrote to memory of 1952	900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe	28
PID 900 wrote to memory of 1952	900	9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe	28
PID 1952 wrote to memory of 2000	1952	cmd.exe	30
PID 1952 wrote to memory of 2000	1952	cmd.exe	30
PID 1952 wrote to memory of 2000	1952	cmd.exe	30
PID 1952 wrote to memory of 2000	1952	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe
"C:\Users\Admin\AppData\Local\Temp\9fc97d70363416a4f1d4dc6664e925350029973da8e4b01f849d0ebd4170419a.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies system certificate store
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\wlltweak.exe
  C:\Users\Admin\AppData\Local\Temp\wlltweak.exe -detected C:\Users\Admin\AppData\Local\Temp\runLOG.log
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c CMDtool.tmp SHOW =1 & 0:1
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Users\Admin\AppData\Local\Temp\CMDtool.tmp
    CMDtool.tmp SHOW =1
    3⤵
    - Executes dropped EXE
    PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CMDtool.tmp

Filesize
397KB

MD5
9a780d1b152df074cac11b04a54aea83

SHA1
0694abda0ca5d755326fb4c65d5c7a023947627a

SHA256
5aee8653aab0adb4106f32a6d753b39d17df9a96a2d391066248e4a4a1479b2d

SHA512
239c77772e1690bbabf99aa129d0183fd5bc5d5d343cfadf1099fe40ed207247c67aaaadc193b4154b718cdcfcd14258d33c8c5a1b1bfbdb6d99fbaa76e14079

Download Submit
C:\Users\Admin\AppData\Local\Temp\CMDtool.tmp

Filesize
397KB

MD5
9a780d1b152df074cac11b04a54aea83

SHA1
0694abda0ca5d755326fb4c65d5c7a023947627a

SHA256
5aee8653aab0adb4106f32a6d753b39d17df9a96a2d391066248e4a4a1479b2d

SHA512
239c77772e1690bbabf99aa129d0183fd5bc5d5d343cfadf1099fe40ed207247c67aaaadc193b4154b718cdcfcd14258d33c8c5a1b1bfbdb6d99fbaa76e14079

Download Submit
C:\Users\Admin\AppData\Local\Temp\wlltweak.exe

Filesize
1.1MB

MD5
f010c7b0371649e6dac5834c4270950f

SHA1
669ac013c71f5f60500571fd10c2cea532714ad4

SHA256
ba37f8ee0a66066a29204c3bf48fe0141495d443fbcf559b3de0304d2267d970

SHA512
82e09dd24dc131876f91dabb026c372ccfbb62189e4a3384b8c478af545956df2b30e777a9908350a56dacf8b66a30290b05788b30cecb75ff0da1b8a1758c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\wlltweak.exe

Filesize
1.1MB

MD5
f010c7b0371649e6dac5834c4270950f

SHA1
669ac013c71f5f60500571fd10c2cea532714ad4

SHA256
ba37f8ee0a66066a29204c3bf48fe0141495d443fbcf559b3de0304d2267d970

SHA512
82e09dd24dc131876f91dabb026c372ccfbb62189e4a3384b8c478af545956df2b30e777a9908350a56dacf8b66a30290b05788b30cecb75ff0da1b8a1758c9c

Download Submit
\Users\Admin\AppData\Local\Temp\CMDtool.tmp

Filesize
397KB

MD5
9a780d1b152df074cac11b04a54aea83

SHA1
0694abda0ca5d755326fb4c65d5c7a023947627a

SHA256
5aee8653aab0adb4106f32a6d753b39d17df9a96a2d391066248e4a4a1479b2d

SHA512
239c77772e1690bbabf99aa129d0183fd5bc5d5d343cfadf1099fe40ed207247c67aaaadc193b4154b718cdcfcd14258d33c8c5a1b1bfbdb6d99fbaa76e14079

Download Submit
\Users\Admin\AppData\Local\Temp\wlltweak.exe

Filesize
1.1MB

MD5
f010c7b0371649e6dac5834c4270950f

SHA1
669ac013c71f5f60500571fd10c2cea532714ad4

SHA256
ba37f8ee0a66066a29204c3bf48fe0141495d443fbcf559b3de0304d2267d970

SHA512
82e09dd24dc131876f91dabb026c372ccfbb62189e4a3384b8c478af545956df2b30e777a9908350a56dacf8b66a30290b05788b30cecb75ff0da1b8a1758c9c

Download Submit
memory/900-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1920-56-0x0000000000000000-mapping.dmp

Download
memory/1952-60-0x0000000000000000-mapping.dmp

Download
memory/1952-67-0x0000000000420000-0x00000000004E0000-memory.dmp

Filesize
768KB

Download
memory/2000-63-0x0000000000000000-mapping.dmp

Download
memory/2000-66-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads