Overview

overview

10

Static

static

8

3ef6b2d149...65.exe

windows7-x64

10

3ef6b2d149...65.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 15:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565.exe

  • Size

    681KB

  • MD5

    96edd876db1309c825a0c71e88d7e019

  • SHA1

    fa7679a9d0ee3413cb16e11796076ff5ca417d46

  • SHA256

    3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565

  • SHA512

    d4d76567d8f5c5d8e8ceadd01e3620a797705a6d1d4a9f38193753680fda74c793c54ff3cf2c4416c51bc6e93c6fbd84d782c132b22353e1fa1a121a4d61ab7b

  • SSDEEP

    1536:sXQoow0ufEpR6YyC0b397NFpz3p57M8TxC6tDTRRiyPAdOdrnouy8:EN3810bN7NFdnJTxColRiy4dUout

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 14 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565.exe
    "C:\Users\Admin\AppData\Local\Temp\3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1424
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:824
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1548

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
          Filesize

          2KB

          MD5

          bc68c4ccb08d2c94eb10c1918865ccae

          SHA1

          8256faeec3f3ec799819d5370195a60f0ec2bdb0

          SHA256

          79313c35e9f5655225ab6d4564a396cf9d473d04909c04db10935c27959f677d

          SHA512

          f6baa632cd93126c31a495e340e8f42e3f9b171b0975877e7a6725677fe57c8b51784be5366cedba022fea273cfe9ecfc5fce8546f2a76e1e6516e5865666933

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          60KB

          MD5

          d15aaa7c9be910a9898260767e2490e1

          SHA1

          2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

          SHA256

          f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

          SHA512

          7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          Filesize

          1KB

          MD5

          ee895cd37d1bbafdf7a736b85dd47348

          SHA1

          5c182ae0d6ffc54c386763ad882256cedd8d0e7c

          SHA256

          939346daba2e0757e14e822fd55350189708ac8d2d782b148e1744ee85c49aa5

          SHA512

          b2f86fa2f14864ab155693804f0d5da4f13e0c9257743eb7376d49a6ce77d950f6e98bbda24030386578c0edb58f4ad3e50eaec2dcc10803a7dd314d703cf740

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
          Filesize

          472B

          MD5

          bc9d91e603826848b7eeca18c58a038b

          SHA1

          d669e8d42a8e7a3e8395efa6229ef0b745253911

          SHA256

          6f704e38d9b114b245d0834c0869ac0eeb930de03f20a5a626efbafdbd0f5517

          SHA512

          75f24db37a299f4326fbeb4a670d8c75cfe77312d69f83879f89a671a5861f9925c53a5e1f4153cc7b0a2b65962ea233c259d6e0e2986ce2ebfee1fdb8ab9763

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
          Filesize

          1KB

          MD5

          a266bb7dcc38a562631361bbf61dd11b

          SHA1

          3b1efd3a66ea28b16697394703a72ca340a05bd5

          SHA256

          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

          SHA512

          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
          Filesize

          488B

          MD5

          748a12e89ff155bd35126b636e465ed4

          SHA1

          2c5c111bd456c244e485cb6248bd99e5ba4d1556

          SHA256

          d6b88de537f3d28f9e9a32031d5a924e2b08c2e9bb8e699a8bed2f16a5c3960a

          SHA512

          17cef3694d1f4e35c8919c614ba87323b6173eb8c9340f5add5ab32fc7f516f4ec831ec05c62b5a42a2f781ae57bd6a948988484fe688c0fddd333b7ff537fb9

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          b4f80615f8b839e6dc98c6cf71811f48

          SHA1

          7e19be926e0966ac2b45549834afff0dcb11fa6d

          SHA256

          47d0dd753746669f2bade71699159cf62fd5557987785575c8cf8beb6c488f51

          SHA512

          cd7bec0045e1effe3190050a01d98af6120a7dfc8b40a383a95ecd13bb8646f4b140c863b580ceac2bb049637d809c829d4db9d00008c6fe235e9b0838e3a70b

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          7faa99e8f9885f94e33a240942b3f569

          SHA1

          10b8bb6a825d687c08a60d285e9b4fcce82513ec

          SHA256

          5a280a5bb41da6a7012d9cbe14a16de980dc7430fdb8a0665fbe83db2cc52c1b

          SHA512

          dfd0f971638bd76d0ab4af9d0e1f7c8754da2e9329b4a1e91b6ba71d3e504db6cf7798541fec6a29fc00645e6267b30a4a423b4a7dead601faf601d7dfef1215

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          5ead25dca564d1a303727d508565049e

          SHA1

          258e0213b67bf8639a45f88f639190bb506f342a

          SHA256

          8f0c1d1c0265fc32b2f613cc7351cfe715ddb29015e3ce91b3d9745eddc8ccb6

          SHA512

          070375ad22d0e87771a14822b547e0197140677e3f82110b7014a4ec4913c1ea45aada5daa3b93dbe8c8f6374b9f5f93803a45937370d9a9a86596710abce47e

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          5ead25dca564d1a303727d508565049e

          SHA1

          258e0213b67bf8639a45f88f639190bb506f342a

          SHA256

          8f0c1d1c0265fc32b2f613cc7351cfe715ddb29015e3ce91b3d9745eddc8ccb6

          SHA512

          070375ad22d0e87771a14822b547e0197140677e3f82110b7014a4ec4913c1ea45aada5daa3b93dbe8c8f6374b9f5f93803a45937370d9a9a86596710abce47e

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
          Filesize

          482B

          MD5

          b971ab9c6713dec916c7e132d603f82b

          SHA1

          6ce887a8b51968bdd9b247d2747264463703d1f6

          SHA256

          9fd67ed6045db80e090b18763672d00a5d6ce88d2004a57cec6d7e168c6b1b85

          SHA512

          6ffd203c09f1de7aba061664682a57b610d70aea8bf2a99ac392b9724e006b8eb6bfbd8d5fcaffbc1670c3a5933993d8c8eed9f23bc42f6380c6784658aeea96

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
          Filesize

          480B

          MD5

          413b10931c85333039b6c19ca2cd4684

          SHA1

          dd7122cb0e965e7cc4846ff518c6888b33f223e8

          SHA256

          0bca08188d73b186e2f63b9cbff1d765469933d3b27cb533d2852f7bfa682f13

          SHA512

          0363d01752ad474843e9327408bf189685f31eaec5919eed9c6c2a7c2664c24e439f72ad0bb14109d67b10313444574755b1b320e7c72e60a464cfc5e4b43eed

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
          Filesize

          242B

          MD5

          d2fb45577843a6d21f089a9781956faf

          SHA1

          703407ef3bfea8c4b7b247203288fba1adbbf0fe

          SHA256

          28ff8c36f6fbd94ab6aa5693e7a6c2d99de3928851604cdcf15543513b191c02

          SHA512

          379ff74893fabe168d3ce668325e89c92a127123aabcec111ff0c7b7e6e90101f0f4260928d82e57456250ce880b5f734d0a7d04b42b14fc0fe3c402f5e103f3

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EBH588EQ.txt
          Filesize

          118B

          MD5

          126c700b63d6922cbbb924becb265826

          SHA1

          0f39e0830e23b98b9f4a3941ef27004df33a4aa7

          SHA256

          66d37ea027ec034f4629f235d23acc177b62bf20246394fe3a45d72528fe05e1

          SHA512

          53e3db1a146f47f01cdc938655340719c547800743af0c8a31ca05fe99c68be876df43ca3afce36288265d079a75d1c545bdbfefc4f87ed59e5a899e26d60e27

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\F0O2HU34.txt
          Filesize

          593B

          MD5

          336beec5d8478bee1cd770dcbc6c4579

          SHA1

          1ca654539c7e2edea1d455da4025cd9f5b32b570

          SHA256

          2cb81f418f80c8ab979bb74558f76a510daa399f871a2dfdc8328ee8a5639a56

          SHA512

          f4e4776b8aaabd1f3b32adea20cb034141dab23d8ed47f403ff0f49f04c74938e743e744c944884cb354e0ac99f6a91a0d0794243cd162aea9a81bf3a4b84d05

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X97UH8KH.txt
          Filesize

          97B

          MD5

          bab98b5cff36b6f4c6b61784867f9322

          SHA1

          65bfb0f78f953f56b131a2f69ed68b8b0e3338ed

          SHA256

          e2849a9f5724c8a54c8cb51eb1c575418247aaa88b36165d8ead45c9fbcbfff1

          SHA512

          27ddeee0f4542f1eb17082f360853d13599b9b74673bbcdfd56c68a6ec36031cc72b257d41044e33ea693c44573da5536bcbf83d3cb5dcbdb2be1f1232332dad

          Download Submit

        • C:\Users\Admin\E696D64614\winlogon.exe
          Filesize

          681KB

          MD5

          96edd876db1309c825a0c71e88d7e019

          SHA1

          fa7679a9d0ee3413cb16e11796076ff5ca417d46

          SHA256

          3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565

          SHA512

          d4d76567d8f5c5d8e8ceadd01e3620a797705a6d1d4a9f38193753680fda74c793c54ff3cf2c4416c51bc6e93c6fbd84d782c132b22353e1fa1a121a4d61ab7b

          Download Submit

        • C:\Users\Admin\E696D64614\winlogon.exe
          Filesize

          681KB

          MD5

          96edd876db1309c825a0c71e88d7e019

          SHA1

          fa7679a9d0ee3413cb16e11796076ff5ca417d46

          SHA256

          3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565

          SHA512

          d4d76567d8f5c5d8e8ceadd01e3620a797705a6d1d4a9f38193753680fda74c793c54ff3cf2c4416c51bc6e93c6fbd84d782c132b22353e1fa1a121a4d61ab7b

          Download Submit

        • C:\Users\Admin\E696D64614\winlogon.exe
          Filesize

          681KB

          MD5

          96edd876db1309c825a0c71e88d7e019

          SHA1

          fa7679a9d0ee3413cb16e11796076ff5ca417d46

          SHA256

          3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565

          SHA512

          d4d76567d8f5c5d8e8ceadd01e3620a797705a6d1d4a9f38193753680fda74c793c54ff3cf2c4416c51bc6e93c6fbd84d782c132b22353e1fa1a121a4d61ab7b

          Download Submit

        • \Users\Admin\E696D64614\winlogon.exe
          Filesize

          681KB

          MD5

          96edd876db1309c825a0c71e88d7e019

          SHA1

          fa7679a9d0ee3413cb16e11796076ff5ca417d46

          SHA256

          3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565

          SHA512

          d4d76567d8f5c5d8e8ceadd01e3620a797705a6d1d4a9f38193753680fda74c793c54ff3cf2c4416c51bc6e93c6fbd84d782c132b22353e1fa1a121a4d61ab7b

          Download Submit

        • \Users\Admin\E696D64614\winlogon.exe
          Filesize

          681KB

          MD5

          96edd876db1309c825a0c71e88d7e019

          SHA1

          fa7679a9d0ee3413cb16e11796076ff5ca417d46

          SHA256

          3ef6b2d149e150d9a4ea314a38580a03e7dd020254c887cb248a0d45d9044565

          SHA512

          d4d76567d8f5c5d8e8ceadd01e3620a797705a6d1d4a9f38193753680fda74c793c54ff3cf2c4416c51bc6e93c6fbd84d782c132b22353e1fa1a121a4d61ab7b

          Download Submit

        • memory/824-73-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/824-72-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/824-86-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/824-68-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/824-88-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/1344-67-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

          Download

        • memory/1344-87-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

          Download

        • memory/1424-56-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

          Download

        • memory/1424-62-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

          Download

        • memory/1424-57-0x0000000076151000-0x0000000076153000-memory.dmp

          Filesize

          8KB

          Download