Overview

overview

10

Static

static

8

Trojan-Ran...er.exe

windows7-x64

10

Trojan-Ran...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07-11-2022 04:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Blocker.exe

  • Size

    1.9MB

  • MD5

    3ee9728994509cd6be061b8d6f286679

  • SHA1

    83c510f90d298b604009b8450e79f1d37db9a9b1

  • SHA256

    f649ceecc8a9cfea24145894cf29ba7646be86e4b8deeac1744697fbe62afdc7

  • SHA512

    128ea8da8e09d86af126673be3c8e13be30421d1399021a5489612214113902c41f6668a62451cc9eb27a7c0470f4435dca4590620a791da62afd88f11c00875

  • SSDEEP

    1536:+EfFNvtgmAl7z5dKY6yuJPW8K43w9NXOM1aRl/i6JWT0S9yXnBibnouy8gHn2JX:+YLmGO4W849NXO9RlK6gOxiDouto2N

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 14 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 61 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Modifies system certificate store
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1592
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:524
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:524 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1996

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    2KB

    MD5

    0774dce1dca53ce5c4f06846dc34a01a

    SHA1

    b66a92ae7ae2abc81921ed83fea0886c908b14b3

    SHA256

    653df1e7ee6eb78011d131d41eebad55a6b11e14073ac204587960c404d2300f

    SHA512

    43582562e20238142d801d97dee6efff1213d38506dc8e21001517d799e52c5157a0ce814e29045fb267200878e964f04d05bb209ac738d510b48ebd689b82e2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8F
    Filesize

    7KB

    MD5

    e05c8e3fef20f66dd342fe5e9d198b1f

    SHA1

    86acd21bd9c3635f175b39303a17f433c645f396

    SHA256

    c7db70e85662fdb5c28c2f27d1b4718786e98380d7d6dde821dbf4774aae521f

    SHA512

    581395edb3a300a7076f3b2a3066079c5d137efcf020c00d9569fd50cdf7a3674ca32f7ff88e07ce53f059e257e0a193a6a5438baf7922af1fa6f1c0ce1deec6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    61KB

    MD5

    3dcf580a93972319e82cafbc047d34d5

    SHA1

    8528d2a1363e5de77dc3b1142850e51ead0f4b6b

    SHA256

    40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

    SHA512

    98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    1KB

    MD5

    be2b5211e42eb9225d21358e7eb3f78f

    SHA1

    35b1ab3adde0a5f3cad8862897f1ea7a86946349

    SHA256

    3185aa19aba785efc822b72e3f2959e07343c1935f8f2b46a4438060763c9111

    SHA512

    9b20c8dceb160aad20de302c2589b86fae64f7842b370812fd8baba3e8154a357c0a1c282ea95fbc5406ab093593637929edaf83c42e19c7b6a011d286b06b6a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
    Filesize

    472B

    MD5

    348f6c5d513404b3c3c6c27f3de2dfdf

    SHA1

    acb18df838bf8ddb2667e944a82b2930bdecfad8

    SHA256

    a46606d9bc72c7330fff6849e1caa6c773c79d66236549408380362d28d892a1

    SHA512

    79dd389bc9a05312290bf69386faa56fd5a6515a0efd7685249831732f6a7c948ac41f288e038a65929e1b56f8fc615db12b7d3955a5e3279ebc8895fd150cab

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    Filesize

    488B

    MD5

    007874ad274640d9a14824408580dcce

    SHA1

    a5606657a7fa94455d52cfec336d72d9f7f17f6a

    SHA256

    341ecd8851e012559f97887c46ed51fd19dd7c127b12d82e8d3a904ca15479b5

    SHA512

    820fa34138c467e934dedc1be26504e8a0c6477ff2a5b18770aaaac8bfca5e8c2fd918a4890f3e14f3b6c89b1f35c2fba291b18ace2816b9c4d753031032a7d3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8F
    Filesize

    232B

    MD5

    7b40cb53026c84bff3eeffebd7fac15b

    SHA1

    a99cf27e6a5b9a03dac9b1f9422fd519e1ef3617

    SHA256

    861a29b8acc728449045c010b007b3785825556c204022a15750ebfc7fe47b1a

    SHA512

    7f11643e8319496da9e8eed90514a7bf1ed8104934ca21ae658b501214fbe989309a0a2429537bed1e35662388f5e9403a78a8e882fccba94214db2c294cf703

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    2017484b4465375d4edd3962554e8f48

    SHA1

    fbecf68a4a7dd5b6d705ffb9df4cddb2e633c50f

    SHA256

    649b8d48208e4265275d2f0ad9d44a808d4091de37f918f0eba4a180f2098a58

    SHA512

    f08bf0b2652995b1223b1eaed2699585ee66954447bd826564df81037075ab727e971793a70d2a18be264f4e7ebc1f479564c7aa6cfe7c9f73441fd45e783869

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    Filesize

    482B

    MD5

    9d69e8a28dab729811650f87de2ee11c

    SHA1

    a3b1e7283c5d0a755fee06e6d9a3799c6b4d79f3

    SHA256

    4ef955dcda3ef30843bf51aa29c5357160bd16177d1c17eab1cbee1d18b8522d

    SHA512

    a928b54423c8ed02d833e53da79ef05766639bfd4d68664afa1dbafc74717a32c2d7a2dee33baf7e3ae234cfc8e959d7f2c66370dbc907ede116259d0cb0ec71

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
    Filesize

    480B

    MD5

    3f0d04e0fe45ebbb0c751e423e0fcbd5

    SHA1

    9cb0831e201625993c58a6fdf55938fad59e4087

    SHA256

    ab23e36bca9e791769ab6ddcba6f693c5bcec474b7f422175b9af3213f27189c

    SHA512

    9ba337a9844dfdea10f983936f0042efe72e2f8e4cbc625df2f23bb6cbedc7dd0415f02806eb1b0a2f91a8c72e1efdd139d95af61294286b5434e1dc64e48a16

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\M4UIBO3M.txt
    Filesize

    117B

    MD5

    5fbbc62ae256fcbe779e33f52a9ee1c5

    SHA1

    08fdb3f624803050a43ee73dacde6ff6c656f868

    SHA256

    6128fd3a4d7c91101b08cd56d31947ce2a5372412d074973cafbf00c5ddf1609

    SHA512

    d67dd3ae08340b5894a08f6494e7b6fd30f9216c7b2315652ae0b6a8507427f71833ba3c826504e8bc1f1593a49bd8aa8b753ddb6774da5c3909dc47f3064e28

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QSBNUI3R.txt
    Filesize

    96B

    MD5

    7a58a0281c80fe0c4e2b66b3b2d2accd

    SHA1

    9058b098d963a4e48f54a2fc40e06aefecac876c

    SHA256

    10ddaff6ee80a97301e607b418797519c9323bd6bb10938db76cb9ac548c5505

    SHA512

    19d7e856a8fc53e99064ac55e2ba61b115d8d8d958a4a529a213c2c377f2bc075fe7c62905359b52b61a1834bcb533ca8265390d567a94180d1c39bddfce5fc9

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WVR0OWH1.txt
    Filesize

    606B

    MD5

    a432bd728deb1bcc67356084e1c88709

    SHA1

    c8d508bac7049116ab87d1b701e1257156f5a1ab

    SHA256

    e6d67a2ebff9df47b030bf5e9d1302ca4072a5199e017938be2eb63fa8191e57

    SHA512

    7ef925eb19342200adc0979c01e0b5c30ca7ebccac25880bc87358351b70954888ca993e497ca17880cc2c32a016d27eb3784aca01f48d54cea3751e4bc441b2

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.9MB

    MD5

    3ee9728994509cd6be061b8d6f286679

    SHA1

    83c510f90d298b604009b8450e79f1d37db9a9b1

    SHA256

    f649ceecc8a9cfea24145894cf29ba7646be86e4b8deeac1744697fbe62afdc7

    SHA512

    128ea8da8e09d86af126673be3c8e13be30421d1399021a5489612214113902c41f6668a62451cc9eb27a7c0470f4435dca4590620a791da62afd88f11c00875

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.9MB

    MD5

    3ee9728994509cd6be061b8d6f286679

    SHA1

    83c510f90d298b604009b8450e79f1d37db9a9b1

    SHA256

    f649ceecc8a9cfea24145894cf29ba7646be86e4b8deeac1744697fbe62afdc7

    SHA512

    128ea8da8e09d86af126673be3c8e13be30421d1399021a5489612214113902c41f6668a62451cc9eb27a7c0470f4435dca4590620a791da62afd88f11c00875

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.9MB

    MD5

    3ee9728994509cd6be061b8d6f286679

    SHA1

    83c510f90d298b604009b8450e79f1d37db9a9b1

    SHA256

    f649ceecc8a9cfea24145894cf29ba7646be86e4b8deeac1744697fbe62afdc7

    SHA512

    128ea8da8e09d86af126673be3c8e13be30421d1399021a5489612214113902c41f6668a62451cc9eb27a7c0470f4435dca4590620a791da62afd88f11c00875

    Download Submit

  • \Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.9MB

    MD5

    3ee9728994509cd6be061b8d6f286679

    SHA1

    83c510f90d298b604009b8450e79f1d37db9a9b1

    SHA256

    f649ceecc8a9cfea24145894cf29ba7646be86e4b8deeac1744697fbe62afdc7

    SHA512

    128ea8da8e09d86af126673be3c8e13be30421d1399021a5489612214113902c41f6668a62451cc9eb27a7c0470f4435dca4590620a791da62afd88f11c00875

    Download Submit

  • \Users\Admin\E696D64614\winlogon.exe
    Filesize

    1.9MB

    MD5

    3ee9728994509cd6be061b8d6f286679

    SHA1

    83c510f90d298b604009b8450e79f1d37db9a9b1

    SHA256

    f649ceecc8a9cfea24145894cf29ba7646be86e4b8deeac1744697fbe62afdc7

    SHA512

    128ea8da8e09d86af126673be3c8e13be30421d1399021a5489612214113902c41f6668a62451cc9eb27a7c0470f4435dca4590620a791da62afd88f11c00875

    Download Submit

  • memory/1592-87-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1592-69-0x000000000043C540-mapping.dmp

    Download

  • memory/1592-68-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1592-74-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1592-88-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1592-72-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1592-73-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1984-67-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/1984-60-0x0000000000000000-mapping.dmp

    Download

  • memory/1992-55-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/1992-62-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

    Download

  • memory/1992-57-0x0000000076141000-0x0000000076143000-memory.dmp

    Filesize

    8KB

    Download