Overview

overview

10

Static

static

8

b87fbd32c5...4d.exe

windows7-x64

10

b87fbd32c5...4d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    177s
  • max time network
    210s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2022 02:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d.exe

  • Size

    396KB

  • MD5

    072a28b74ed14adeaef039fd9777a53f

  • SHA1

    199db3560a2fffe1b349eb11354ef7f9dbf127a6

  • SHA256

    b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d

  • SHA512

    687f16ab3808e69bb71adbaf6819e3c3f873d41d255c2f52cfd3c8db990868dcba783ab3501ab14e048c81fdd3d88604f50173350cef010daf165b0b665b474b

  • SSDEEP

    3072:YnUGoV4VMcmYAYjPzcfYf5Ard2EorYDk+Wcht:YS2fzDzc2rEorgk+W

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables taskbar notifications via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 55 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d.exe
    "C:\Users\Admin\AppData\Local\Temp\b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4112
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      2⤵
        PID:960
      • C:\Users\Admin\AppData\Local\Temp\b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d.exe
        2⤵
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5016
        • C:\Users\Admin\E696D64614\winlogon.exe
          "C:\Users\Admin\E696D64614\winlogon.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4840
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\system32\svchost.exe
            4⤵
              PID:4764
            • C:\Users\Admin\E696D64614\winlogon.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3532
              • C:\Users\Admin\E696D64614\winlogon.exe
                "C:\Users\Admin\E696D64614\winlogon.exe"
                5⤵
                • Modifies firewall policy service
                • Modifies security service
                • Modifies visibility of file extensions in Explorer
                • Modifies visiblity of hidden/system files in Explorer
                • UAC bypass
                • Windows security bypass
                • Disables RegEdit via registry modification
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Sets file execution options in registry
                • Drops startup file
                • Windows security modification
                • Adds Run key to start application
                • Checks whether UAC is enabled
                • Modifies Control Panel
                • Modifies Internet Explorer settings
                • Modifies Internet Explorer start page
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3656
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        1⤵
          PID:2128
        • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
          "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
          1⤵
            PID:3520
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3416
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3416 CREDAT:17410 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:1280
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3416 CREDAT:82950 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2660

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
            Filesize

            1KB

            MD5

            c3524ebb4f559c6d3f8fd09a4a51e6e3

            SHA1

            9a746c6eeef8a53d112779637db97132cd27bd5f

            SHA256

            97ea352465170638cf52e43ccb4615069a85bbfd9f187d48ec4d870ee1967f1c

            SHA512

            06048b89cd2839945b17adc399c06eef8f82344e363ba5513bd62749f10c714097013b5c2fb14cd4ff0bd8211d6b00e23ff28e267441f71ab84b400427d6b1bc

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
            Filesize

            1KB

            MD5

            6769483b05d9dc54fce4e7518d0c0ed9

            SHA1

            1577b4b90099ea2aeda0114f34b4104f9d20c9d8

            SHA256

            9e7c3ff8633da3a8e78f40be3c8382fdda0c2c9ac8f08d519f4dce14509fe779

            SHA512

            dfb7b040e13ba7f00bbf7c34383061d364ffbf27b51dc32c67939a250143303e2235503f2a1911737b4e51a11601119c9a903e8fb1b5440061e82406a1056813

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
            Filesize

            1KB

            MD5

            3ba36e8cda4753ac6042753f316abdfc

            SHA1

            fc74803343254d7aae737a21dd78250ecb8b6cf3

            SHA256

            ebc09e9247b88bb94512af3141fb704d38aaffedf7dc062f8498580ee6986f67

            SHA512

            12a26afdb40ea1a26ea6e86f3213aad619e66f00c58130d5228db619eb6c72a433733fa18fc3b9264e04844f9471452e6c0b12a316c691fedcbb5110f9001e36

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
            Filesize

            724B

            MD5

            f569e1d183b84e8078dc456192127536

            SHA1

            30c537463eed902925300dd07a87d820a713753f

            SHA256

            287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

            SHA512

            49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_543B7BD726970BD166CFFC3B32EE7089
            Filesize

            472B

            MD5

            bf55a5e3b388533c18f4eed310ed28b9

            SHA1

            3d9564cad00a8349f63a5c72118b0776524d0eb7

            SHA256

            97c32c42968f5f4acf571408533a411b992720182a1477dc95fd792eedbcc624

            SHA512

            2c6adb06291a54bdecc02c07e715292acf957d544c40e6726e661da6ce20619e9d6c39069a4a9c6d9464746ec09ccbc278a70bf0cba6130195c666b4a9c768dd

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
            Filesize

            410B

            MD5

            321926a8dac86ee815aedec453887ce3

            SHA1

            656a4af0cce814532cfbf505b96aee6b6572ec78

            SHA256

            3aafbf7400c4ecdff0aa1ed72e4eacb9909958418088cdf46fa9901080b6d137

            SHA512

            2a6d834192c435bad487d10a01ab1d50c2fe78b156861387cd387e227534e328fac71b35595c75bc5962ec8c353070d9d15157eba8a4cf1ba0ccbfaf0427a67b

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\84AFE219AEC53B0C9251F5E19EF019BD_2C9D5E6D83DF507CBE6C15521D5D3562
            Filesize

            466B

            MD5

            316a31a927dc1d84553b2eebf621c41b

            SHA1

            ec448f14c00a498392d39dccb812206813b08645

            SHA256

            8e2c5772bcade1fe46945b5307a9a7b5694bd88417f4c3d036ea5420b1a85e2d

            SHA512

            75ee2c5e286d0e7c33b70bc7ed145bcf45b4dfc7223ce8e4d3f4561f5f81e826e7a54ed57e9b759d3657288dec5441ddc65541e9fac9708c882b87beb0d3129d

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BC2602F5489CFE3E69F81C6328A4C17C_849A9AE095E451B9FFDF6A58F3A98E26
            Filesize

            470B

            MD5

            5f6a73acee8582a91e11fbc2a29392e3

            SHA1

            854bdac704bb370fb0d88340da92a8274849ddda

            SHA256

            d85763b742fcf8c72f8d026215a7f7b4160b42e3ec70548b79f8992b1c88b26f

            SHA512

            f7052be8f34837e078b72694b75d9ee97d6a9d53988a1e0dcc427f0bf7fd4ca44d6e7898af72069ecc98cd93e3ce3da84b0662a44c215d37f2b55c09b4a6613c

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
            Filesize

            392B

            MD5

            62eb84d8d11ebee7803c96238b2fd040

            SHA1

            4238bf84824fcbef01994ede04659bb05e37bafd

            SHA256

            b27865b563a7f2dc86650bb0746eff31a17dea9f5638824a5e7709d95e6bd10f

            SHA512

            67647b5351376ebffe79ebedc665c098914ef1450086b4d7badf2345ba547b5f98a24737c279d33b275b32839d718b49362e93d4327617e2bfd308ed52666a6f

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_543B7BD726970BD166CFFC3B32EE7089
            Filesize

            402B

            MD5

            1fe1067191c6eb04a29aab5ce206890b

            SHA1

            aacab0444f760ec334859215428a9cb010d05426

            SHA256

            00d58651d42980580cb4d65da0b4975d4f2729adbb0fbc725e07b7effc01578f

            SHA512

            8e148958ccce7dc73c7b5562caa32bf845269460e526b878a5138fa691ced48a2ea7b63572e9e407975389f05f88d2178f3ffe1eb76f58067d2b89873675c545

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DU2BEY67\9K47HO2R.htm
            Filesize

            2KB

            MD5

            41f66bb0ac50f2d851236170e7c71341

            SHA1

            59bcec216302151922219b51be8ad8ab6d0b8384

            SHA256

            ec99cca58b612ce268e6ada818dfcec0acc22dd1bbe372487be9abbdd07ce073

            SHA512

            d0d223b93236d62d60974d638d9916901c37c32a4b8ef3faebd336850bc1af8b73ce27ac57205a00d97f38ccdd0ad655c9df7e1d7da6ae89de40b173a8639fa6

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            396KB

            MD5

            072a28b74ed14adeaef039fd9777a53f

            SHA1

            199db3560a2fffe1b349eb11354ef7f9dbf127a6

            SHA256

            b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d

            SHA512

            687f16ab3808e69bb71adbaf6819e3c3f873d41d255c2f52cfd3c8db990868dcba783ab3501ab14e048c81fdd3d88604f50173350cef010daf165b0b665b474b

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            396KB

            MD5

            072a28b74ed14adeaef039fd9777a53f

            SHA1

            199db3560a2fffe1b349eb11354ef7f9dbf127a6

            SHA256

            b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d

            SHA512

            687f16ab3808e69bb71adbaf6819e3c3f873d41d255c2f52cfd3c8db990868dcba783ab3501ab14e048c81fdd3d88604f50173350cef010daf165b0b665b474b

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            396KB

            MD5

            072a28b74ed14adeaef039fd9777a53f

            SHA1

            199db3560a2fffe1b349eb11354ef7f9dbf127a6

            SHA256

            b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d

            SHA512

            687f16ab3808e69bb71adbaf6819e3c3f873d41d255c2f52cfd3c8db990868dcba783ab3501ab14e048c81fdd3d88604f50173350cef010daf165b0b665b474b

            Download Submit

          • C:\Users\Admin\E696D64614\winlogon.exe
            Filesize

            396KB

            MD5

            072a28b74ed14adeaef039fd9777a53f

            SHA1

            199db3560a2fffe1b349eb11354ef7f9dbf127a6

            SHA256

            b87fbd32c51df43ebb8d7c0b2b7a488d8145539ebddb0012b2cdbbc1ab73684d

            SHA512

            687f16ab3808e69bb71adbaf6819e3c3f873d41d255c2f52cfd3c8db990868dcba783ab3501ab14e048c81fdd3d88604f50173350cef010daf165b0b665b474b

            Download Submit

          • memory/3532-167-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/3532-155-0x00000000008C0000-0x00000000008FB000-memory.dmp

            Filesize

            236KB

            Download

          • memory/3656-162-0x0000000000400000-0x0000000000443000-memory.dmp

            Filesize

            268KB

            Download

          • memory/3656-163-0x0000000000400000-0x0000000000443000-memory.dmp

            Filesize

            268KB

            Download

          • memory/3656-166-0x0000000000400000-0x0000000000443000-memory.dmp

            Filesize

            268KB

            Download

          • memory/3656-159-0x0000000000400000-0x0000000000443000-memory.dmp

            Filesize

            268KB

            Download

          • memory/4112-132-0x0000000000840000-0x000000000087B000-memory.dmp

            Filesize

            236KB

            Download

          • memory/4112-137-0x0000000000840000-0x000000000087B000-memory.dmp

            Filesize

            236KB

            Download

          • memory/4840-150-0x00000000008C0000-0x00000000008FB000-memory.dmp

            Filesize

            236KB

            Download

          • memory/5016-142-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/5016-139-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/5016-138-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/5016-135-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download

          • memory/5016-158-0x0000000000400000-0x000000000041C000-memory.dmp

            Filesize

            112KB

            Download