Overview

overview

10

Static

static

8

2eff3a21d1...1a.exe

windows7-x64

10

2eff3a21d1...1a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2022 06:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2eff3a21d1e060daefd86df50bd68f6d2a66ed2f37b97d2d1370e8de5586241a.exe

  • Size

    351KB

  • MD5

    a2d5afadbfb11aed3bbf95fe0cf174d0

  • SHA1

    5219f2faf74d1717a2589c398eed1aec5caca551

  • SHA256

    2eff3a21d1e060daefd86df50bd68f6d2a66ed2f37b97d2d1370e8de5586241a

  • SHA512

    ff986d46123f77e761becc779e22228ac257bc27f56e22791749d58a3e4f3600f00ad693ff37420260f4f01c74c0c6d19e9c889da1313a2aa50c157b365a737c

  • SSDEEP

    6144:rVBU/tylqpk//mRuk//m4k//mRvk//mn:yfW2p2l222

Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops startup file 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2eff3a21d1e060daefd86df50bd68f6d2a66ed2f37b97d2d1370e8de5586241a.exe
    "C:\Users\Admin\AppData\Local\Temp\2eff3a21d1e060daefd86df50bd68f6d2a66ed2f37b97d2d1370e8de5586241a.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe
      "C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"
      2⤵
      • Modifies system executable filetype association
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Sets file execution options in registry
      • Drops startup file
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:1920

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe
    Filesize

    351KB

    MD5

    a2d5afadbfb11aed3bbf95fe0cf174d0

    SHA1

    5219f2faf74d1717a2589c398eed1aec5caca551

    SHA256

    2eff3a21d1e060daefd86df50bd68f6d2a66ed2f37b97d2d1370e8de5586241a

    SHA512

    ff986d46123f77e761becc779e22228ac257bc27f56e22791749d58a3e4f3600f00ad693ff37420260f4f01c74c0c6d19e9c889da1313a2aa50c157b365a737c

    Download Submit

  • C:\Program Files (x86)\Common Files\microsoft shared\explorer.exe
    Filesize

    351KB

    MD5

    a2d5afadbfb11aed3bbf95fe0cf174d0

    SHA1

    5219f2faf74d1717a2589c398eed1aec5caca551

    SHA256

    2eff3a21d1e060daefd86df50bd68f6d2a66ed2f37b97d2d1370e8de5586241a

    SHA512

    ff986d46123f77e761becc779e22228ac257bc27f56e22791749d58a3e4f3600f00ad693ff37420260f4f01c74c0c6d19e9c889da1313a2aa50c157b365a737c

    Download Submit

  • \Program Files (x86)\Common Files\ips888.dll
    Filesize

    17KB

    MD5

    f560174dbba429bc890961608e9eaaf1

    SHA1

    1397fd3d69ba8fd1615ff8fa7e0a187cca06dbaf

    SHA256

    29c4eba9d950a47aaf7e023a3649ed8dbd065a143b0913c11d969f9df9823f5f

    SHA512

    35099289aa8852909b82d5709f2504aa68e7672f2457656d2ebe6c77fea631c9d80585ebf186d7555d281443e56b67abdfb5848dc069a2a2c248a76a95d9a6bf

    Download Submit

  • \Program Files (x86)\Common Files\microsoft shared\explorer.exe
    Filesize

    351KB

    MD5

    a2d5afadbfb11aed3bbf95fe0cf174d0

    SHA1

    5219f2faf74d1717a2589c398eed1aec5caca551

    SHA256

    2eff3a21d1e060daefd86df50bd68f6d2a66ed2f37b97d2d1370e8de5586241a

    SHA512

    ff986d46123f77e761becc779e22228ac257bc27f56e22791749d58a3e4f3600f00ad693ff37420260f4f01c74c0c6d19e9c889da1313a2aa50c157b365a737c

    Download Submit

  • \Program Files (x86)\Common Files\microsoft shared\explorer.exe
    Filesize

    351KB

    MD5

    a2d5afadbfb11aed3bbf95fe0cf174d0

    SHA1

    5219f2faf74d1717a2589c398eed1aec5caca551

    SHA256

    2eff3a21d1e060daefd86df50bd68f6d2a66ed2f37b97d2d1370e8de5586241a

    SHA512

    ff986d46123f77e761becc779e22228ac257bc27f56e22791749d58a3e4f3600f00ad693ff37420260f4f01c74c0c6d19e9c889da1313a2aa50c157b365a737c

    Download Submit

  • memory/1896-54-0x0000000076181000-0x0000000076183000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1896-61-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

    Download

  • memory/1896-62-0x0000000000770000-0x00000000007CA000-memory.dmp

    Filesize

    360KB

    Download

  • memory/1896-65-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

    Download

  • memory/1920-63-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

    Download

  • memory/1920-66-0x0000000000400000-0x000000000045A000-memory.dmp

    Filesize

    360KB

    Download