Overview

overview

10

Static

static

5a5dd3773d...fc.exe

windows7-x64

10

5a5dd3773d...fc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 12:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc.exe

  • Size

    396KB

  • MD5

    087ce79b77545584708858a544e62078

  • SHA1

    221483cbdb96479942d663638a16658721cd19da

  • SHA256

    5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc

  • SHA512

    59633315af1d11e50a97154d7b4566c70221b5759901cf7b6857470c1eac218a0442d0eaf2a86c67648a2d4ccddc4743805a3b861340e7d6f3878a5f3b4a84d7

  • SSDEEP

    1536:r0HjHkAScR9hXkYQB3k69JusuqdGiA2MvZut+pN5ULmRPYAVPlVDKmQ9x6cp:rWEcWY9HVX2MvktynULsPemGx6

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables taskbar notifications via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 19 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 33 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc.exe
    "C:\Users\Admin\AppData\Local\Temp\5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc.exe
      "C:\Users\Admin\AppData\Local\Temp\5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Users\Admin\11B2713DCCF4DC3D\32B976.exe
        "C:\Users\Admin\11B2713DCCF4DC3D\32B976.exe" 589F459F
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Users\Admin\11B2713DCCF4DC3D\32B976.exe
          589F459F
          4⤵
          • Modifies firewall policy service
          • Modifies security service
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Windows security bypass
          • Disables RegEdit via registry modification
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Sets file execution options in registry
          • Checks computer location settings
          • Drops startup file
          • Windows security modification
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies Internet Explorer start page
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:4592
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1956
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5028

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\11B2713DCCF4DC3D\32B976.exe
            Filesize

            396KB

            MD5

            087ce79b77545584708858a544e62078

            SHA1

            221483cbdb96479942d663638a16658721cd19da

            SHA256

            5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc

            SHA512

            59633315af1d11e50a97154d7b4566c70221b5759901cf7b6857470c1eac218a0442d0eaf2a86c67648a2d4ccddc4743805a3b861340e7d6f3878a5f3b4a84d7

            Download Submit

          • C:\Users\Admin\11B2713DCCF4DC3D\32B976.exe
            Filesize

            396KB

            MD5

            087ce79b77545584708858a544e62078

            SHA1

            221483cbdb96479942d663638a16658721cd19da

            SHA256

            5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc

            SHA512

            59633315af1d11e50a97154d7b4566c70221b5759901cf7b6857470c1eac218a0442d0eaf2a86c67648a2d4ccddc4743805a3b861340e7d6f3878a5f3b4a84d7

            Download Submit

          • C:\Users\Admin\11B2713DCCF4DC3D\32B976.exe
            Filesize

            396KB

            MD5

            087ce79b77545584708858a544e62078

            SHA1

            221483cbdb96479942d663638a16658721cd19da

            SHA256

            5a5dd3773d2b2b3e33e79ac23deabe850b5080e9bd3e190daf78b4719f1bd0fc

            SHA512

            59633315af1d11e50a97154d7b4566c70221b5759901cf7b6857470c1eac218a0442d0eaf2a86c67648a2d4ccddc4743805a3b861340e7d6f3878a5f3b4a84d7

            Download Submit

          • memory/2168-133-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

            Download

          • memory/2168-135-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

            Download

          • memory/2168-136-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

            Download

          • memory/2168-146-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

            Download

          • memory/4592-151-0x0000000000400000-0x0000000000446000-memory.dmp

            Filesize

            280KB

            Download