Overview

overview

10

Static

static

7f69518232...3d.exe

windows7-x64

10

7f69518232...3d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2022, 14:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f69518232a44c6087ecb7d73e556ccf832b937a83ec14037fb2d138f0b3003d.exe

  • Size

    1.1MB

  • MD5

    a20c7b589559ec84f168d023155a769f

  • SHA1

    736071856685df1d37b211832170b3160b37d624

  • SHA256

    7f69518232a44c6087ecb7d73e556ccf832b937a83ec14037fb2d138f0b3003d

  • SHA512

    5c30dd95758a68a72078f4ad0277a7815904df271dc3c13cc324f02bb1897f405e8a049b55845aab5e9c955746c9621d6edbe38897998552f99d2bf1b6c529bb

  • SSDEEP

    3072:CYsgk+ruvdasTt9NHhayrHlbGAP1Qm02B545g4FuB3bBo6P6We0VyOjUout:Vr/oS

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 57 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f69518232a44c6087ecb7d73e556ccf832b937a83ec14037fb2d138f0b3003d.exe
    "C:\Users\Admin\AppData\Local\Temp\7f69518232a44c6087ecb7d73e556ccf832b937a83ec14037fb2d138f0b3003d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4196
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Drops startup file
        • Windows security modification
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:3444
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:2692
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5056 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4356

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      2KB

      MD5

      006c98bc42ac1d15f0ec70e3488783c5

      SHA1

      a8c8302826468c903b511e206d6d058e2c3acdaa

      SHA256

      e24883740fbed2781e4df4e5387cd95c3345ec9944edeeb36babd2c10135fa00

      SHA512

      e0caea17f99a18483e0195c5311942c195ef42532f1868bfb5c64b3f6cb72cc0fc58414176a9bfc66452e11d17c2058eafb483a41890f502ec76dc3a6807f2f4

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9
      Filesize

      506B

      MD5

      3dedd6595b7b507b8242fb5cfe804cb5

      SHA1

      d48a6b2cb019d7f5db1ca81a87ce14df9f852edf

      SHA256

      e5c7c3f6255cfc11ad9566d58e6c3e69b406afd83c605b4623bf27795507e317

      SHA512

      525aa772382929b6a14ea29335c75917fa83f46703696539862b2df80e0fdddf66a797d4eb883434bcd0b47f1441ac64fe6e19cf61c95bf3c740d91e1760aabd

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      d3ff0edeee7d1ea5754d8a290ae01189

      SHA1

      253ee24a4776d30bac0aedd7ea213adea6acb6f9

      SHA256

      e2e542a3681c428c021d38e608dffa43da666f6f3c53f623c21dc184639b222b

      SHA512

      ab14449059ae31856026e8d8cb0ec0b4158da0fd19f2a73940a159574a9084ce6a09ac05fb80ef3ab11cd9b1395dce021872215baced48f9e8a0bf7311000db7

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
      Filesize

      472B

      MD5

      347503e74934f40d7336fdb0c0e05eda

      SHA1

      cd02b0099fecc08c7ea939feb0c0da3b7bf7e826

      SHA256

      e9c5dfb4d72923e26767db1b70aed7ddf5ea0174890825e009a850880f8b0fe4

      SHA512

      4fd29aedc14dceb395a6cadcc24e7519fb974e0e62a9399559e2df3aa7f288d23bd7b5b3b80a76f77b85a21d6b929947e1c84d1b96e801a127c900976881d440

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      488B

      MD5

      d9c74ed1a34e0f1131fe172aa6b851b4

      SHA1

      999e0c69b616d1ffd0bf1c52167bb7c031eecf76

      SHA256

      85600b42b7a18e788a35dc6af1a1a5698c25f7aacb7c4bd8aa28498b730215d3

      SHA512

      dbcb62c2229a42cf45b1b542c4c7df471af10e7f8e4e9cdccc2cadfe9ca7ecb39ad6ee07b2f08abaef75ca650bf008e1a19f768d83bbc1675307c683cc7897fb

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9
      Filesize

      248B

      MD5

      722f178796a6263cd546b89856ebebad

      SHA1

      64d611c279be2c0fe39fd0ef9d1a7f0db665096a

      SHA256

      5dbfbe3ec2bbf682e03bc8aefec71b56ebf25f15ef8523810dea144ed3d00a31

      SHA512

      560e8a074849f371f800831ed11bb3e02cfb00e14c31e5330ce7295b0271e85a3da6fc7eee0287b378c4db1a96c5abd445b11df787320b50f7cf1cd6b7f03f74

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      434B

      MD5

      88d42e61195b872ddf2ec35cf1c6ac7a

      SHA1

      0933559dba9cf7ee0ef25f6b9dc55741d8dc1728

      SHA256

      4ddaa41ff69ac7e507a1512f0f82391fd84e0d796325def47f95ce7fd2591f54

      SHA512

      511c18138c115b5a56383e91022bda957d67f54dc608df97c3d9d0453bc46b16fbbefe155e528538593e98169561e90a0540df75156af7536ab85f843bcce51a

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
      Filesize

      480B

      MD5

      6a6cdfed65ebff3ef3b6bccb6352e7e0

      SHA1

      47b7b48ef51620d52a83e552a9fc422cb2413c4b

      SHA256

      6ea23b3b3f0958df62849a1f15acef14423030ddd10d8ad09aa4fa2cecc1f180

      SHA512

      01fc9fd8da419ffb648a3912dc97d6fdf1eaa7f80ff609aa9afe1ff8434c80d445bc9a2ed9003589fe1e5f7f9be8ff8b60a48c1e41d742f43b18d637b68d9f35

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      1.1MB

      MD5

      a20c7b589559ec84f168d023155a769f

      SHA1

      736071856685df1d37b211832170b3160b37d624

      SHA256

      7f69518232a44c6087ecb7d73e556ccf832b937a83ec14037fb2d138f0b3003d

      SHA512

      5c30dd95758a68a72078f4ad0277a7815904df271dc3c13cc324f02bb1897f405e8a049b55845aab5e9c955746c9621d6edbe38897998552f99d2bf1b6c529bb

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      1.1MB

      MD5

      a20c7b589559ec84f168d023155a769f

      SHA1

      736071856685df1d37b211832170b3160b37d624

      SHA256

      7f69518232a44c6087ecb7d73e556ccf832b937a83ec14037fb2d138f0b3003d

      SHA512

      5c30dd95758a68a72078f4ad0277a7815904df271dc3c13cc324f02bb1897f405e8a049b55845aab5e9c955746c9621d6edbe38897998552f99d2bf1b6c529bb

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      1.1MB

      MD5

      a20c7b589559ec84f168d023155a769f

      SHA1

      736071856685df1d37b211832170b3160b37d624

      SHA256

      7f69518232a44c6087ecb7d73e556ccf832b937a83ec14037fb2d138f0b3003d

      SHA512

      5c30dd95758a68a72078f4ad0277a7815904df271dc3c13cc324f02bb1897f405e8a049b55845aab5e9c955746c9621d6edbe38897998552f99d2bf1b6c529bb

      Download Submit

    • memory/3444-145-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/3444-149-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/3444-146-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/3444-142-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/3628-134-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download

    • memory/4196-140-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

      Download