Overview

overview

8

Static

static

863620b853...93.exe

windows7-x64

8

863620b853...93.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2022 02:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    863620b853965c943aefbc327c33f6d3f0e86f9991468b7786317f8fc8df7093.exe

  • Size

    20KB

  • MD5

    2cf43ad8c96711f7f08cf3e9db900840

  • SHA1

    03c4692a882a7aa6ff3b36f8f79fdec5fb642f68

  • SHA256

    863620b853965c943aefbc327c33f6d3f0e86f9991468b7786317f8fc8df7093

  • SHA512

    6d80b66babe83a649a6ca313e92e4d89dceec2fd88b77dc57b38b370a8f99a9813a308caacce46c79b116c9566a1eef48f61e434ff332644727a253f87df2923

  • SSDEEP

    192:1l5E3krTuntKy0peHDfCpHfBv+I4QwXt9V+jqu0G5KDJBl:1M3PnQoHDCpHf4I4Qwdc0G5KDJH

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 17 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Drops desktop.ini file(s) 26 IoCs
  • Drops autorun.inf file 1 TTPs 27 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\863620b853965c943aefbc327c33f6d3f0e86f9991468b7786317f8fc8df7093.exe
    "C:\Users\Admin\AppData\Local\Temp\863620b853965c943aefbc327c33f6d3f0e86f9991468b7786317f8fc8df7093.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Windows\AE 0124 BE.wav"
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4440
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Checks computer location settings
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:364
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3172
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3628
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x394 0x384
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2292

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\AE 0124 BE.exe
    Filesize

    40KB

    MD5

    9d1c5169476e6be7bb046eab56999425

    SHA1

    e7b09787094f9278fedd3f3c032802a230aae70a

    SHA256

    b01bdbf6cc839b409a592dc9c7d618b9bd1383c7640850d2379d9c34c0bdfe03

    SHA512

    9edfdd77c379ed47431a91a1821645f866f80c78f12bfe7d0ecbb4b0dd5e660fa345f70326c9103c41660ed637685f521437c9d48c4f14c5c3774a48021f9251

    Download Submit

  • C:\Windows\AE 0124 BE.exe
    Filesize

    40KB

    MD5

    9d1c5169476e6be7bb046eab56999425

    SHA1

    e7b09787094f9278fedd3f3c032802a230aae70a

    SHA256

    b01bdbf6cc839b409a592dc9c7d618b9bd1383c7640850d2379d9c34c0bdfe03

    SHA512

    9edfdd77c379ed47431a91a1821645f866f80c78f12bfe7d0ecbb4b0dd5e660fa345f70326c9103c41660ed637685f521437c9d48c4f14c5c3774a48021f9251

    Download Submit

  • C:\Windows\AE 0124 BE.wav
    Filesize

    20KB

    MD5

    4964c47d082ae4c8513a1c98e3e068bf

    SHA1

    17eacc0e9e242d2f3c3e2038f0386486a70c1cc1

    SHA256

    a59026dd12fd8fdd986ede2478207ad35350b228657079bc11178cff60ae2576

    SHA512

    c73312a2dea18ca6f30232e51ae98f8321d391f1c1da4560683ea3269538c6a02b64779b2cbb6f9f3911d9304874a2d9db84e5f0d9644674d2e327dc5c3a7c90

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\MSVBVM60.DLL
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    40KB

    MD5

    9d1c5169476e6be7bb046eab56999425

    SHA1

    e7b09787094f9278fedd3f3c032802a230aae70a

    SHA256

    b01bdbf6cc839b409a592dc9c7d618b9bd1383c7640850d2379d9c34c0bdfe03

    SHA512

    9edfdd77c379ed47431a91a1821645f866f80c78f12bfe7d0ecbb4b0dd5e660fa345f70326c9103c41660ed637685f521437c9d48c4f14c5c3774a48021f9251

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    40KB

    MD5

    9d1c5169476e6be7bb046eab56999425

    SHA1

    e7b09787094f9278fedd3f3c032802a230aae70a

    SHA256

    b01bdbf6cc839b409a592dc9c7d618b9bd1383c7640850d2379d9c34c0bdfe03

    SHA512

    9edfdd77c379ed47431a91a1821645f866f80c78f12bfe7d0ecbb4b0dd5e660fa345f70326c9103c41660ed637685f521437c9d48c4f14c5c3774a48021f9251

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    40KB

    MD5

    9d1c5169476e6be7bb046eab56999425

    SHA1

    e7b09787094f9278fedd3f3c032802a230aae70a

    SHA256

    b01bdbf6cc839b409a592dc9c7d618b9bd1383c7640850d2379d9c34c0bdfe03

    SHA512

    9edfdd77c379ed47431a91a1821645f866f80c78f12bfe7d0ecbb4b0dd5e660fa345f70326c9103c41660ed637685f521437c9d48c4f14c5c3774a48021f9251

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    40KB

    MD5

    9d1c5169476e6be7bb046eab56999425

    SHA1

    e7b09787094f9278fedd3f3c032802a230aae70a

    SHA256

    b01bdbf6cc839b409a592dc9c7d618b9bd1383c7640850d2379d9c34c0bdfe03

    SHA512

    9edfdd77c379ed47431a91a1821645f866f80c78f12bfe7d0ecbb4b0dd5e660fa345f70326c9103c41660ed637685f521437c9d48c4f14c5c3774a48021f9251

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    25B

    MD5

    589b6886a49054d03b739309a1de9fcc

    SHA1

    0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

    SHA256

    564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

    SHA512

    4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    25B

    MD5

    589b6886a49054d03b739309a1de9fcc

    SHA1

    0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

    SHA256

    564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

    SHA512

    4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

    Download Submit

  • memory/364-136-0x0000000000000000-mapping.dmp

    Download

  • memory/1436-141-0x0000000000000000-mapping.dmp

    Download

  • memory/3172-155-0x0000000000000000-mapping.dmp

    Download

  • memory/3628-148-0x0000000000000000-mapping.dmp

    Download

  • memory/4440-134-0x0000000000000000-mapping.dmp

    Download