Overview

overview

10

Static

static

8

Trojan-Ran...er.exe

windows7-x64

10

Trojan-Ran...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-11-2022 04:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Trojan-Ransom.Win32.Blocker.exe

  • Size

    715KB

  • MD5

    9922bb2013d45d0131cc27ab65dde265

  • SHA1

    c8a0a3179794a2d444e4417a747029ad2acd9aba

  • SHA256

    b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

  • SHA512

    d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

  • SSDEEP

    1536:+EfFNvtgmAl7z5dKY6yuJPW8K43w9NXOM1aRl/i6JWT0S9yXnBibnouy8gHn2JX:+YLmGO4W849NXO9RlK6gOxiDouto2N

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2100
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:364
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:3568
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1252

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      2KB

      MD5

      0774dce1dca53ce5c4f06846dc34a01a

      SHA1

      b66a92ae7ae2abc81921ed83fea0886c908b14b3

      SHA256

      653df1e7ee6eb78011d131d41eebad55a6b11e14073ac204587960c404d2300f

      SHA512

      43582562e20238142d801d97dee6efff1213d38506dc8e21001517d799e52c5157a0ce814e29045fb267200878e964f04d05bb209ac738d510b48ebd689b82e2

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      471B

      MD5

      0ef90204485649be625ea2be1b9018fb

      SHA1

      28fbc0852140ec51d0c097a4962a160afa4d754b

      SHA256

      c8028acd9a8c8c795b87cf835fc3182d003264608f161baa0ca020711b22bca0

      SHA512

      b8bbba0dcc6cb6f87efb47a605953c93fcf93c5a65520b822ebfee25754632d6bb66c2a946f457e1e40a92556683ddb9d14f2703782833e12d7e37bb3b7fcec5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      1KB

      MD5

      be2b5211e42eb9225d21358e7eb3f78f

      SHA1

      35b1ab3adde0a5f3cad8862897f1ea7a86946349

      SHA256

      3185aa19aba785efc822b72e3f2959e07343c1935f8f2b46a4438060763c9111

      SHA512

      9b20c8dceb160aad20de302c2589b86fae64f7842b370812fd8baba3e8154a357c0a1c282ea95fbc5406ab093593637929edaf83c42e19c7b6a011d286b06b6a

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
      Filesize

      472B

      MD5

      348f6c5d513404b3c3c6c27f3de2dfdf

      SHA1

      acb18df838bf8ddb2667e944a82b2930bdecfad8

      SHA256

      a46606d9bc72c7330fff6849e1caa6c773c79d66236549408380362d28d892a1

      SHA512

      79dd389bc9a05312290bf69386faa56fd5a6515a0efd7685249831732f6a7c948ac41f288e038a65929e1b56f8fc615db12b7d3955a5e3279ebc8895fd150cab

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      Filesize

      488B

      MD5

      ed66a40777cd3d7879f6b140285a83c8

      SHA1

      98b19ff513c6d7e9e6ea69c23c74e74652243e3e

      SHA256

      29fdad445198676d84b3ff7130368ffda476c938c6df0ee33e029e061d2a4b5f

      SHA512

      c819ee784f65783181e3aae2068d409c7532a04161714792fa4102f94a14cc8520efc4e9c6862168184275fb0ac067257cf48a20dc8001937c0193227c2cfc03

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
      Filesize

      434B

      MD5

      4dbf8c878091d8350026428aa94cc555

      SHA1

      4370ee7347f7a5cec59c4cb4b04fb2d64a237346

      SHA256

      f4b18dfe13bfe0d9db1a227fb1e8482f974d3e5e198e60de8236e1ac524df512

      SHA512

      3c402f498a252573fb9f38e175518e4e4a36e649aced5bcdbcd9f4d0f2dcd14fb3fe3bb436e9d6a048275431ec829238161bb26a462372ba026678e4286888dc

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      Filesize

      482B

      MD5

      c273823d1d0eb932c45be18f6646c363

      SHA1

      836ac609ad46834bc50abafcaf640d864d1304d2

      SHA256

      36ea7748fc64ab4f48180dff9f570c85658575af7930fb28cb805c3f2bf38204

      SHA512

      f766eb51f84c9fe77043d8eb0ce42ee00c3a3310381b73e6c5bac666fe638b08126a7010025f6bb927cad56e90be6adba029c7d6de0e69d5b1671bab172af61e

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
      Filesize

      480B

      MD5

      7f247cba63ed255716ef22908dfedc8c

      SHA1

      fe797823cdd471ff25aef3a7939c7eb58d0ca025

      SHA256

      3b55176ccea0e6309c5646a19abee90980a415e6db1248b1409d9d3488f20591

      SHA512

      b2530812b23554bb9911809364781d1212e9682b380a9289f62da036685ee72b029c22cbe135a9b884a9729e94fe72cdb71471718e1d456a8ae97f914b2be591

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      715KB

      MD5

      9922bb2013d45d0131cc27ab65dde265

      SHA1

      c8a0a3179794a2d444e4417a747029ad2acd9aba

      SHA256

      b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

      SHA512

      d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      715KB

      MD5

      9922bb2013d45d0131cc27ab65dde265

      SHA1

      c8a0a3179794a2d444e4417a747029ad2acd9aba

      SHA256

      b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

      SHA512

      d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

      Download Submit

    • C:\Users\Admin\E696D64614\winlogon.exe
      Filesize

      715KB

      MD5

      9922bb2013d45d0131cc27ab65dde265

      SHA1

      c8a0a3179794a2d444e4417a747029ad2acd9aba

      SHA256

      b6e528d6ee93b9ddf32c5b9cb460f9e45b2a1870524579a128f9409541cf35b4

      SHA512

      d3c1707deb82d11806c3dc9cb81673bbeace140407a67f532136d6059dab7965a01a67a2d2165a8d52a3385c8afbe206eea402bca1c63bac2fe14a78e55240e8

      Download Submit

    • memory/364-150-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/364-153-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/364-149-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/364-146-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/364-161-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

      Download

    • memory/2100-144-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/2100-160-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4832-137-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download

    • memory/4832-141-0x0000000000400000-0x0000000000447000-memory.dmp

      Filesize

      284KB

      Download