Overview

overview

10

Static

static

8

0a57537805...74.exe

windows7-x64

10

0a57537805...74.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 18:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a5753780529888e1728113c86a8970fbaffb4a9a7f52377028a7f63f92d0e74.exe

  • Size

    222KB

  • MD5

    84e95345ec269c444dcdd98ef38f6a50

  • SHA1

    bbefa0bc6ef240eb5a360012347aa90d2bc26777

  • SHA256

    0a5753780529888e1728113c86a8970fbaffb4a9a7f52377028a7f63f92d0e74

  • SHA512

    dccce9f713680470ca2bce9da096eb0fe9c55215c9c59b9f686f63cf5a3ca4a812fcb191f98daa636e49440eee31c69a6e999df68d81396518d34e90ad1a4175

  • SSDEEP

    3072:K5jsqRqkJXJ0/7Xn5Aer05Gas9NhOyLPCA7OF+6aLK2IJqi6uS+gkDstXKJVICsR:aYJkJXJea5QNhtL6VJVICY+

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Launches sc.exe 7 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a5753780529888e1728113c86a8970fbaffb4a9a7f52377028a7f63f92d0e74.exe
    "C:\Users\Admin\AppData\Local\Temp\0a5753780529888e1728113c86a8970fbaffb4a9a7f52377028a7f63f92d0e74.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Windows\SysWOW64\system.exe
      C:\Windows\system32\system.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Windows\SysWOW64\Rundll32.exe
        Rundll32 C:\Windows\system32\psliifaa.dll Exbcute
        3⤵
        • Checks computer location settings
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Windows\SysWOW64\net.exe
          net stop WinDefend
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3848
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop WinDefend
            5⤵
              PID:4404
          • C:\Windows\SysWOW64\net.exe
            net stop MpsSvc
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3860
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop MpsSvc
              5⤵
                PID:1988
            • C:\Windows\SysWOW64\sc.exe
              sc config WinDefend start= disabled
              4⤵
              • Launches sc.exe
              PID:3568
            • C:\Windows\SysWOW64\sc.exe
              sc config MpsSvc start= disabled
              4⤵
              • Launches sc.exe
              PID:1972
            • C:\Windows\SysWOW64\sc.exe
              sc stop ZhuDongFangYu
              4⤵
              • Launches sc.exe
              PID:224
            • C:\Windows\SysWOW64\sc.exe
              sc delete ZhuDongFangYu
              4⤵
              • Launches sc.exe
              PID:4856
            • C:\Windows\SysWOW64\sc.exe
              sc stop 360rp
              4⤵
              • Launches sc.exe
              PID:4860
            • C:\Windows\SysWOW64\sc.exe
              sc delete 360rp
              4⤵
              • Launches sc.exe
              PID:4632
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" stop PolicyAgent
              4⤵
              • Launches sc.exe
              PID:5036
          • C:\Windows\SysWOW64\Rundll32.exe
            Rundll32 C:\Windows\system32\kuxjifaa.dll Exbcute
            3⤵
            • Loads dropped DLL
            • Adds Run key to start application
            • Enumerates connected drives
            • Suspicious behavior: EnumeratesProcesses
            PID:4380
        • C:\Users\Admin\AppData\Local\Temp\0a5753780529888e1728113c86a8970fbaffb4a9a7f52377028a7f63f92d0e74.exe
          C:\Users\Admin\AppData\Local\Temp\0a5753780529888e1728113c86a8970fbaffb4a9a7f52377028a7f63f92d0e74.exe
          2⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
          • C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe
            "C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"
            3⤵
            • Modifies system executable filetype association
            • Modifies visiblity of hidden/system files in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Loads dropped DLL
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:3276

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe
        Filesize

        74KB

        MD5

        2fa48a277ed630e0c2d76b7b47c3a935

        SHA1

        eed41134ce8a069c1b678839117fac1f091555c5

        SHA256

        a3a1a141d6fe200cdc61162bd30158e19b43b1273df135db9a37256b158f995d

        SHA512

        e5f7a422eea7354cba7cbaff844e00dac2a01aaa7f40cacca25e4c893e094ab4673277934ad231a108412fe0a6813365db5ff94846bb423bb7f72fb11d5f2a7c

        Download Submit

      • C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe
        Filesize

        74KB

        MD5

        2fa48a277ed630e0c2d76b7b47c3a935

        SHA1

        eed41134ce8a069c1b678839117fac1f091555c5

        SHA256

        a3a1a141d6fe200cdc61162bd30158e19b43b1273df135db9a37256b158f995d

        SHA512

        e5f7a422eea7354cba7cbaff844e00dac2a01aaa7f40cacca25e4c893e094ab4673277934ad231a108412fe0a6813365db5ff94846bb423bb7f72fb11d5f2a7c

        Download Submit

      • C:\Program Files (x86)\Common Files\ips888.dll
        Filesize

        17KB

        MD5

        44361213f431c9b1827531d5513c83a1

        SHA1

        b4d6580083610a98cec70d0ee35b71bc9da5f1ae

        SHA256

        37affa117a089f4a31c83b41a2e562f65333fcf2b3f91461f2b311bc29bc5319

        SHA512

        19b38703f1cd4aff9461b8cdc1bcf149315059685babfa02c4960e41cb1498918729353e317d580f090ac1f4db3d794e83e0c913c8dd8b531274ad8b3d4940ed

        Download Submit

      • C:\Program Files (x86)\Common Files\ips888.dll
        Filesize

        17KB

        MD5

        44361213f431c9b1827531d5513c83a1

        SHA1

        b4d6580083610a98cec70d0ee35b71bc9da5f1ae

        SHA256

        37affa117a089f4a31c83b41a2e562f65333fcf2b3f91461f2b311bc29bc5319

        SHA512

        19b38703f1cd4aff9461b8cdc1bcf149315059685babfa02c4960e41cb1498918729353e317d580f090ac1f4db3d794e83e0c913c8dd8b531274ad8b3d4940ed

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\0a5753780529888e1728113c86a8970fbaffb4a9a7f52377028a7f63f92d0e74.exe
        Filesize

        74KB

        MD5

        2fa48a277ed630e0c2d76b7b47c3a935

        SHA1

        eed41134ce8a069c1b678839117fac1f091555c5

        SHA256

        a3a1a141d6fe200cdc61162bd30158e19b43b1273df135db9a37256b158f995d

        SHA512

        e5f7a422eea7354cba7cbaff844e00dac2a01aaa7f40cacca25e4c893e094ab4673277934ad231a108412fe0a6813365db5ff94846bb423bb7f72fb11d5f2a7c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\0a5753780529888e1728113c86a8970fbaffb4a9a7f52377028a7f63f92d0e74.exe
        Filesize

        74KB

        MD5

        2fa48a277ed630e0c2d76b7b47c3a935

        SHA1

        eed41134ce8a069c1b678839117fac1f091555c5

        SHA256

        a3a1a141d6fe200cdc61162bd30158e19b43b1273df135db9a37256b158f995d

        SHA512

        e5f7a422eea7354cba7cbaff844e00dac2a01aaa7f40cacca25e4c893e094ab4673277934ad231a108412fe0a6813365db5ff94846bb423bb7f72fb11d5f2a7c

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ADF8.tmp
        Filesize

        4.3MB

        MD5

        6c7cdd25c2cb0073306eb22aebfc663f

        SHA1

        a1eba8ab49272b9852fe6a543677e8af36271248

        SHA256

        58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705

        SHA512

        17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6

        Download Submit

      • C:\Windows\SysWOW64\kuxjifaa.dll
        Filesize

        24KB

        MD5

        9e60343a051d990b2ecd83d8419e0971

        SHA1

        5dcbf8abb0d20bcd49782328bd36cecb098d6fc5

        SHA256

        01ac2c504e860f7f17fae7d6520a5b073dbdafe790e206314d7951e25b3a8de8

        SHA512

        0f6c685d3d2417b20b1603b3d5349339ee176e51287fba9cac9371d459023d62731327ccc728898df5d0cdc4370600eaad0629e6ba6770855343f19cb1e0d1f4

        Download Submit

      • C:\Windows\SysWOW64\kuxjifaa.dll
        Filesize

        24KB

        MD5

        9e60343a051d990b2ecd83d8419e0971

        SHA1

        5dcbf8abb0d20bcd49782328bd36cecb098d6fc5

        SHA256

        01ac2c504e860f7f17fae7d6520a5b073dbdafe790e206314d7951e25b3a8de8

        SHA512

        0f6c685d3d2417b20b1603b3d5349339ee176e51287fba9cac9371d459023d62731327ccc728898df5d0cdc4370600eaad0629e6ba6770855343f19cb1e0d1f4

        Download Submit

      • C:\Windows\SysWOW64\psliifaa.dll
        Filesize

        75KB

        MD5

        366ef5e42971e4f1c35147799054a7dd

        SHA1

        b2b4a81c226565d35ffc1874eec45b1dc6bb4a7c

        SHA256

        70fd5d7b2459a0c730149ba7e408339d2ff52640238a2accf63f82219e775f99

        SHA512

        f8e3e29be97b1af52c47f6ff57e988bbafc6f76d9144f8510d045e74259843e318e7e8aed5ea80e3ab7a57a00d9c5e753e9bc2a4b848d480f71ce5090498c05c

        Download Submit

      • C:\Windows\SysWOW64\psliifaa.dll
        Filesize

        75KB

        MD5

        366ef5e42971e4f1c35147799054a7dd

        SHA1

        b2b4a81c226565d35ffc1874eec45b1dc6bb4a7c

        SHA256

        70fd5d7b2459a0c730149ba7e408339d2ff52640238a2accf63f82219e775f99

        SHA512

        f8e3e29be97b1af52c47f6ff57e988bbafc6f76d9144f8510d045e74259843e318e7e8aed5ea80e3ab7a57a00d9c5e753e9bc2a4b848d480f71ce5090498c05c

        Download Submit

      • C:\Windows\SysWOW64\system.exe
        Filesize

        144KB

        MD5

        9479b46d4a1d2a9ed447701fd1c169db

        SHA1

        1d1b8de38ce4c660baa6c3825044c6046f930725

        SHA256

        ae390e56ced75c9ed48b57d09e7b26608423a991c7c447171c8c2bf8ef31972d

        SHA512

        877a6d1dc13613b1aa40ab0abb13d145827b6540d15006cc0ae3f298a255b636d64c53b7b211455e6c74820cb13489949492af4e556aebca427930c84c55247d

        Download Submit

      • C:\Windows\SysWOW64\system.exe
        Filesize

        144KB

        MD5

        9479b46d4a1d2a9ed447701fd1c169db

        SHA1

        1d1b8de38ce4c660baa6c3825044c6046f930725

        SHA256

        ae390e56ced75c9ed48b57d09e7b26608423a991c7c447171c8c2bf8ef31972d

        SHA512

        877a6d1dc13613b1aa40ab0abb13d145827b6540d15006cc0ae3f298a255b636d64c53b7b211455e6c74820cb13489949492af4e556aebca427930c84c55247d

        Download Submit

      • memory/2328-165-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

        Download

      • memory/2328-160-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

        Download

      • memory/3276-166-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

        Download

      • memory/3276-164-0x00000000005C1000-0x00000000005C5000-memory.dmp

        Filesize

        16KB

        Download

      • memory/3276-161-0x0000000000400000-0x0000000000457000-memory.dmp

        Filesize

        348KB

        Download

      • memory/4844-132-0x0000000000400000-0x000000000047D000-memory.dmp

        Filesize

        500KB

        Download