Overview

overview

10

Static

static

8

ff9e1c9607...2c.exe

windows7-x64

10

ff9e1c9607...2c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    190s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-10-2022 16:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff9e1c96074354c5448826c8b235ac900f69d29698d112899850f69640a9372c.exe

  • Size

    997KB

  • MD5

    838b7026d2fc8658ad6aa4d09f222675

  • SHA1

    4f8bff1d7a33cf72b653202cb5676a45d7d04b36

  • SHA256

    ff9e1c96074354c5448826c8b235ac900f69d29698d112899850f69640a9372c

  • SHA512

    542dfc5f3e2a0425366fb98271263571d683a859d3f465fadc9a28061bf7cd615071f37712419362e3d60d42a848ad7174bc6ea3b3518a80dc99b45ebdb3fd89

  • SSDEEP

    1536:2fRN2/SWANOttpVxXVIXKL7mxUH1OibPoQT9lnouy8:EOAKnrq6Oxo1OcRJ9out

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 26 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff9e1c96074354c5448826c8b235ac900f69d29698d112899850f69640a9372c.exe
    "C:\Users\Admin\AppData\Local\Temp\ff9e1c96074354c5448826c8b235ac900f69d29698d112899850f69640a9372c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1104
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:4204
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:4280
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4276
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4276 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4324

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      2KB

      MD5

      34feb9279587011e5bd1bc825e7d2943

      SHA1

      d7ad421c0f4c305936e4b6b1ee3b4d73dea0b094

      SHA256

      96b9b67b871e3adbab0a5b0ba635679443636a97c7dd2f19fec1b45a2dd36a5d

      SHA512

      9fd6ff36a966661ab2ccd5e0c2dd0b24661fc87686fe039db97f79eecbb1504ac9735462b16d8657ef900e3bc405c149ff98c32aa1c682b83d2ffd2382b5f285

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9
      Filesize

      506B

      MD5

      3d7b0627fee097a430d320bd8c68fe18

      SHA1

      0a87d13d3cf959c0766823a0a3b9ba915d78d451

      SHA256

      daacc20224c99d0f6de9d92e9c1c28a4d66cd085c2c4c38c4122a1202fe70d75

      SHA512

      31e37df96c288532b16fa7a2f182226888b4a3b63410f0df2a08daeaa9d66ef910f469e16978cced9aaa202853031eb0385653c6680af0646828ea1cc1b64c28

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      a66314123c8c72372bcb8583a5400a95

      SHA1

      fc3e45060463c37775da0bd4a8920296d222753d

      SHA256

      657c92d95798fc5dad4272f3d6d71776737ac0bcdce4ac6864ca5532f2ccf34d

      SHA512

      d9f5c243b04d7b3fbbcb37c68c583db672390644500cfa4d58280048d9fde52c668fd67e84ecd6ace20b2813eefb756627adbd04a6f19719f6e907aa3fffe4f1

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
      Filesize

      472B

      MD5

      2dab1f757cc31050f6d69fdd4fa19758

      SHA1

      b33d0a0c447289ba292b1c72c0a32e941956dfc9

      SHA256

      4776d094340d32dcc2708c743cf0c2af2db8713cce715e1e2e3245990e45e1df

      SHA512

      3d4474d34fb57079406ccf8380a5c82d4a06bb415a3b397764dfa6c813b492e3003aa308d5cdb807b67c42197732d6efb5196b092cf5431be31ab52e799f08d1

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      488B

      MD5

      eb8a30c3253e0e0471f222fb33ffa1b3

      SHA1

      7ef5daae4b9d700e88e360758e1a2ca58054c27e

      SHA256

      45e9fa4bd1a1ddaf2cb6df9602306131431eaef76c28332f9edf0769e5d61466

      SHA512

      c060ef66827f2aa0161ad5df966d3d1536aeb6c328570270dedf3a957184d4264a2add048236220fcf96d0074584cc9af3dcacfa63519e0df3d9b49ccae22e01

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9
      Filesize

      248B

      MD5

      388065cacc80d9041aa4e0370cf61fb7

      SHA1

      7008a0a105c127473ed1a6f88a439ef6ebdf994b

      SHA256

      87b56f9995a9142b694fdc6946d6b020c01b21e710c21ad3b6f5dc0f053a1dee

      SHA512

      0547b4d272c08c0606949d004df3849e4e670a54cc781b5b9cab432dd53a91396dee8404793058f7be7d388e44a4a7a98d90d7f43efae0ba495c2d07e650c02e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      434B

      MD5

      42f03a2bd832ec5368b5f8c88c4009a3

      SHA1

      ade50945885b51619fd39f8c87e79507a2692506

      SHA256

      736e534c8c8e9c52db6e5f3e7bc06c70777e36958f200b5921f82f184ce8f775

      SHA512

      5add4d22972fea45b2fa3b3b162dc981c8e1775be303b1523b6f4998bdd8f0769b5d58cd4044c58a21b48886462ff8d1a2d0eac1f44c07aa08b52adf82afccb3

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
      Filesize

      480B

      MD5

      d3e8b29876e64bfd674e594c097fd181

      SHA1

      b091e5b42cd16c8861e984f8fdaa06bd35884c3d

      SHA256

      9c70210633b77ed1dc370439866200a484fb46bed78448138d7c7d5e3f55efb5

      SHA512

      68baf2c9745ab8bfc92625b09e4a7370f9a18b91346dabe2c625085ab7e194d68ba8db2fcf403b833014f1c628538fe5fcfb6a144c4c9aeeeb81a4c09d1b81c3

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      997KB

      MD5

      838b7026d2fc8658ad6aa4d09f222675

      SHA1

      4f8bff1d7a33cf72b653202cb5676a45d7d04b36

      SHA256

      ff9e1c96074354c5448826c8b235ac900f69d29698d112899850f69640a9372c

      SHA512

      542dfc5f3e2a0425366fb98271263571d683a859d3f465fadc9a28061bf7cd615071f37712419362e3d60d42a848ad7174bc6ea3b3518a80dc99b45ebdb3fd89

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      997KB

      MD5

      838b7026d2fc8658ad6aa4d09f222675

      SHA1

      4f8bff1d7a33cf72b653202cb5676a45d7d04b36

      SHA256

      ff9e1c96074354c5448826c8b235ac900f69d29698d112899850f69640a9372c

      SHA512

      542dfc5f3e2a0425366fb98271263571d683a859d3f465fadc9a28061bf7cd615071f37712419362e3d60d42a848ad7174bc6ea3b3518a80dc99b45ebdb3fd89

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      997KB

      MD5

      838b7026d2fc8658ad6aa4d09f222675

      SHA1

      4f8bff1d7a33cf72b653202cb5676a45d7d04b36

      SHA256

      ff9e1c96074354c5448826c8b235ac900f69d29698d112899850f69640a9372c

      SHA512

      542dfc5f3e2a0425366fb98271263571d683a859d3f465fadc9a28061bf7cd615071f37712419362e3d60d42a848ad7174bc6ea3b3518a80dc99b45ebdb3fd89

      Download Submit

    • memory/1104-141-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/1104-135-0x0000000000000000-mapping.dmp

      Download

    • memory/2400-134-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/2400-138-0x0000000000400000-0x0000000000446000-memory.dmp

      Filesize

      280KB

      Download

    • memory/4204-147-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/4204-146-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/4204-143-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/4204-142-0x0000000000000000-mapping.dmp

      Download

    • memory/4204-156-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/4204-157-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download