Overview

overview

10

Static

static

3ba29ae0c9...57.exe

windows7-x64

10

3ba29ae0c9...57.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/10/2022, 17:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    3ba29ae0c99bfe252f680e14ffc4ecefc5458b8b5330be880823f06e4c0e9c57.exe

  • Size

    655KB

  • MD5

    0aaabeaa98bd37a50b351fcccb882764

  • SHA1

    1cc9c579dad9204ed0b64a1fc60ee39a9aecfe7d

  • SHA256

    3ba29ae0c99bfe252f680e14ffc4ecefc5458b8b5330be880823f06e4c0e9c57

  • SHA512

    fbee5685db1d234859e11d5ba8c97e69d6541cbca070efb079afaebac0d7318f053898547d97854d8654614d250f9322eb1343512b90c15667651cb010b4f2f2

  • SSDEEP

    12288:/ESqJwbBEE+tOirc2xwlqXs4zUmvycM6xgNyJ6DsZuhEP60dIIFazZyun23:/EdYj+jrc21lz/VnxgAJxuOCciZzE

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 9 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ba29ae0c99bfe252f680e14ffc4ecefc5458b8b5330be880823f06e4c0e9c57.exe
    "C:\Users\Admin\AppData\Local\Temp\3ba29ae0c99bfe252f680e14ffc4ecefc5458b8b5330be880823f06e4c0e9c57.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\3ba29ae0c99bfe252f680e14ffc4ecefc5458b8b5330be880823f06e4c0e9c57.exe
      3ba29ae0c99bfe252f680e14ffc4ecefc5458b8b5330be880823f06e4c0e9c57.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4508
      • C:\Users\Admin\R07924.exe
        C:\Users\Admin\R07924.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Checks computer location settings
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4680
        • C:\Users\Admin\taoon.exe
          "C:\Users\Admin\taoon.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1892
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del R07924.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4232
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1700
      • C:\Users\Admin\aehost.exe
        C:\Users\Admin\aehost.exe
        3⤵
        • Executes dropped EXE
        PID:1112
      • C:\Users\Admin\behost.exe
        C:\Users\Admin\behost.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3372
        • C:\Users\Admin\behost.exe
          C:\Users\Admin\behost.exe startC:\Users\Admin\AppData\Roaming\BF29A\FAED3.exe%C:\Users\Admin\AppData\Roaming\BF29A
          4⤵
          • Executes dropped EXE
          PID:1064
        • C:\Users\Admin\behost.exe
          C:\Users\Admin\behost.exe startC:\Program Files (x86)\9A32F\lvvm.exe%C:\Program Files (x86)\9A32F
          4⤵
          • Executes dropped EXE
          PID:2296
        • C:\Program Files (x86)\LP\D3FB\531C.tmp
          "C:\Program Files (x86)\LP\D3FB\531C.tmp"
          4⤵
          • Executes dropped EXE
          PID:1116
      • C:\Users\Admin\cehost.exe
        C:\Users\Admin\cehost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4296
        • C:\Windows\explorer.exe
          00000204*
          4⤵
            PID:3668
        • C:\Users\Admin\dehost.exe
          C:\Users\Admin\dehost.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4112
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del 3ba29ae0c99bfe252f680e14ffc4ecefc5458b8b5330be880823f06e4c0e9c57.exe
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2380
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:3228
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:816
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1740
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4092
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1436

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\LP\D3FB\531C.tmp
            Filesize

            104KB

            MD5

            0cb09d0443d2eda312058ae1a2fa83c2

            SHA1

            1888844fcab4269a5c08b5cf122b100e8abb3cb0

            SHA256

            50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a

            SHA512

            93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c

            Download Submit

          • C:\Program Files (x86)\LP\D3FB\531C.tmp
            Filesize

            104KB

            MD5

            0cb09d0443d2eda312058ae1a2fa83c2

            SHA1

            1888844fcab4269a5c08b5cf122b100e8abb3cb0

            SHA256

            50a9af2fe05dd06d6ff825bcf2106b64385e7fdf9a06a0a18ac187c4a057503a

            SHA512

            93bfdc4d14a7ba7cce25d0a83faa29e0efa7932f3024aa82fcc1d606cb9a65e0ebd91942ad9992ce787f639df1748fde9599cb9b676245a17a8198064df2e24c

            Download Submit

          • C:\Users\Admin\R07924.exe
            Filesize

            188KB

            MD5

            4f9c5823c5d1255ded151b01c0a58e15

            SHA1

            2f7018a9211472ddfa5d2f09629bf90adce4676c

            SHA256

            e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

            SHA512

            b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

            Download Submit

          • C:\Users\Admin\R07924.exe
            Filesize

            188KB

            MD5

            4f9c5823c5d1255ded151b01c0a58e15

            SHA1

            2f7018a9211472ddfa5d2f09629bf90adce4676c

            SHA256

            e38564871dc5952e2d1d22d51e312e3064cf84df95c0420021153cb5c264adcf

            SHA512

            b5518effbf476d9486a5ddaa65c937e97b10470d533f8e0c9af30956868c032f6bdb524d13a004e4a0d19e9a88b5f3f11ee82e5602b1175092fb36a9959d40ca

            Download Submit

          • C:\Users\Admin\aehost.exe
            Filesize

            129KB

            MD5

            e2b1704acdf48221cd9be91bae3546c5

            SHA1

            f53a59b62276f58cf8689768f747e16f53dbd341

            SHA256

            8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

            SHA512

            1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

            Download Submit

          • C:\Users\Admin\aehost.exe
            Filesize

            129KB

            MD5

            e2b1704acdf48221cd9be91bae3546c5

            SHA1

            f53a59b62276f58cf8689768f747e16f53dbd341

            SHA256

            8b1c13bb2e95f71ed75d8fca7aeefc556ecd377d5d4f6c544d77ac8f74255ca5

            SHA512

            1b3d8baa981851a79c4f12f3ea2a4d197b3439e76ca723acd578acabd731310d6eeb3a4567a10d48f45192ae9c4cd732eca04c0a7fffa636e7bd364ed1357b53

            Download Submit

          • C:\Users\Admin\behost.exe
            Filesize

            279KB

            MD5

            2a583120a51178ee5f8bc2727faaa73e

            SHA1

            91296d42eeddb285aeea28f5139cadda10f21df7

            SHA256

            b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

            SHA512

            003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

            Download Submit

          • C:\Users\Admin\behost.exe
            Filesize

            279KB

            MD5

            2a583120a51178ee5f8bc2727faaa73e

            SHA1

            91296d42eeddb285aeea28f5139cadda10f21df7

            SHA256

            b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

            SHA512

            003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

            Download Submit

          • C:\Users\Admin\behost.exe
            Filesize

            279KB

            MD5

            2a583120a51178ee5f8bc2727faaa73e

            SHA1

            91296d42eeddb285aeea28f5139cadda10f21df7

            SHA256

            b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

            SHA512

            003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

            Download Submit

          • C:\Users\Admin\behost.exe
            Filesize

            279KB

            MD5

            2a583120a51178ee5f8bc2727faaa73e

            SHA1

            91296d42eeddb285aeea28f5139cadda10f21df7

            SHA256

            b315e97fff3561563da4dcf7283636f42eef9ebaf422506e01f03716d4877b02

            SHA512

            003e11b916256091486311881a06286d532a9940d75977a44afa3c116277a0f490505e9b4053f56846fb6d1d7584d7748f622bc9cae088af93820452027dac8b

            Download Submit

          • C:\Users\Admin\cehost.exe
            Filesize

            145KB

            MD5

            56be9270582de0986c72139ea218e121

            SHA1

            d33b8a2127ccf6b6f42a0c0f266136a376def18c

            SHA256

            8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257

            SHA512

            dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023

            Download Submit

          • C:\Users\Admin\cehost.exe
            Filesize

            145KB

            MD5

            56be9270582de0986c72139ea218e121

            SHA1

            d33b8a2127ccf6b6f42a0c0f266136a376def18c

            SHA256

            8b40a882fde5ef3df2ec3112142b654c949adf7f559bc1912ad9d08ebb17c257

            SHA512

            dcee7d3d16e19e5a36a386d097c171ed7761ad4fc626b5d523b9c33f952fa24da733c56fcb8ff440894c3672c468d04cecc001ae9a680a9607347a5f517e6023

            Download Submit

          • C:\Users\Admin\dehost.exe
            Filesize

            24KB

            MD5

            7cda5863b933988b7bd1d0c8035dafd9

            SHA1

            68c64d655d0df1c9974587d12b3b88f5ce1f4cac

            SHA256

            400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216

            SHA512

            978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea

            Download Submit

          • C:\Users\Admin\dehost.exe
            Filesize

            24KB

            MD5

            7cda5863b933988b7bd1d0c8035dafd9

            SHA1

            68c64d655d0df1c9974587d12b3b88f5ce1f4cac

            SHA256

            400cb530f1489c46ada1dedc35b51cb53e8174f5cdda0d086ef593c135e0f216

            SHA512

            978440c09b70b695fdc171c6e2a7c064aa078d4a300db7f297afde5e3c1cfdf513da01dae967a9a8c524c185432ef87bf922a5cc97a9c8a6d1fd9cc3155e0aea

            Download Submit

          • C:\Users\Admin\taoon.exe
            Filesize

            188KB

            MD5

            927a462af78902af5f99ec4653f95635

            SHA1

            c66c0a030181e61b216fafe5b13670156b69498b

            SHA256

            46a0ef97cc4044422d493ab8ff7c6b47a5dbb61d67e52dba5cb1fab2ffa9056e

            SHA512

            513b07cc8504b55901eb61739df1abe4d4f723593d92e075dc1e1b1eade521b4d036ea65a366acebc3304428f5e594ed97a39228b242a8fdcb0fa79bd45796f8

            Download Submit

          • C:\Users\Admin\taoon.exe
            Filesize

            188KB

            MD5

            927a462af78902af5f99ec4653f95635

            SHA1

            c66c0a030181e61b216fafe5b13670156b69498b

            SHA256

            46a0ef97cc4044422d493ab8ff7c6b47a5dbb61d67e52dba5cb1fab2ffa9056e

            SHA512

            513b07cc8504b55901eb61739df1abe4d4f723593d92e075dc1e1b1eade521b4d036ea65a366acebc3304428f5e594ed97a39228b242a8fdcb0fa79bd45796f8

            Download Submit

          • memory/1064-182-0x000000000050F000-0x0000000000556000-memory.dmp

            Filesize

            284KB

            Download

          • memory/1064-180-0x000000000050F000-0x0000000000556000-memory.dmp

            Filesize

            284KB

            Download

          • memory/1064-181-0x0000000000400000-0x0000000000469000-memory.dmp

            Filesize

            420KB

            Download

          • memory/1116-194-0x00000000005ED000-0x00000000005FD000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1116-192-0x00000000005ED000-0x00000000005FD000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1116-193-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

            Download

          • memory/1116-191-0x0000000000400000-0x000000000041D000-memory.dmp

            Filesize

            116KB

            Download

          • memory/2296-185-0x00000000006BF000-0x0000000000706000-memory.dmp

            Filesize

            284KB

            Download

          • memory/2296-207-0x00000000006BF000-0x0000000000706000-memory.dmp

            Filesize

            284KB

            Download

          • memory/2296-186-0x0000000000400000-0x0000000000469000-memory.dmp

            Filesize

            420KB

            Download

          • memory/2296-187-0x00000000006BF000-0x0000000000706000-memory.dmp

            Filesize

            284KB

            Download

          • memory/3372-177-0x000000000078B000-0x00000000007D2000-memory.dmp

            Filesize

            284KB

            Download

          • memory/3372-161-0x000000000078B000-0x00000000007D2000-memory.dmp

            Filesize

            284KB

            Download

          • memory/3372-160-0x0000000000400000-0x0000000000469000-memory.dmp

            Filesize

            420KB

            Download

          • memory/3668-168-0x00000000003D0000-0x00000000003E5000-memory.dmp

            Filesize

            84KB

            Download

          • memory/4296-165-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

            Download

          • memory/4296-167-0x00000000006E0000-0x0000000000722000-memory.dmp

            Filesize

            264KB

            Download

          • memory/4296-170-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

            Download

          • memory/4296-166-0x0000000000400000-0x0000000000442000-memory.dmp

            Filesize

            264KB

            Download

          • memory/4296-171-0x00000000006E0000-0x0000000000722000-memory.dmp

            Filesize

            264KB

            Download

          • memory/4508-138-0x0000000000400000-0x00000000004C9000-memory.dmp

            Filesize

            804KB

            Download

          • memory/4508-137-0x0000000000400000-0x00000000004C9000-memory.dmp

            Filesize

            804KB

            Download

          • memory/4508-134-0x0000000000400000-0x00000000004C9000-memory.dmp

            Filesize

            804KB

            Download

          • memory/4508-133-0x0000000000400000-0x00000000004C9000-memory.dmp

            Filesize

            804KB

            Download

          • memory/4508-196-0x0000000000400000-0x00000000004C9000-memory.dmp

            Filesize

            804KB

            Download

          • memory/4508-156-0x0000000000400000-0x00000000004C9000-memory.dmp

            Filesize

            804KB

            Download