Overview

overview

10

Static

static

b98c93cac7...a2.exe

windows7-x64

10

b98c93cac7...a2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    164s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2.exe

  • Size

    808KB

  • MD5

    0f8e4ffcdbc6b449fbb6bf1948e68dd5

  • SHA1

    ac10fbb6c54473ad7c49c3bd4a0855018745bcec

  • SHA256

    b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2

  • SHA512

    9b568dab1333f275534410694b17d3fea30a4ab676f722444b93577bdf7a34feb6607fdaacc171a6cc10fb22cd85f44444ea6bc3efad207618a76fe84139e9e6

  • SSDEEP

    12288:kcyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:kc2+ms5pavs+NpM9nXg79CU

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 55 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2556
      • C:\Users\Admin\AppData\Local\Temp\b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2.exe
        "C:\Users\Admin\AppData\Local\Temp\b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Users\Admin\x276Ht.exe
          C:\Users\Admin\x276Ht.exe
          3⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4848
          • C:\Users\Admin\xoaafu.exe
            "C:\Users\Admin\xoaafu.exe"
            4⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4616
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del x276Ht.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1776
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:4136
        • C:\Users\Admin\2xiv.exe
          C:\Users\Admin\2xiv.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5060
          • C:\Users\Admin\2xiv.exe
            "C:\Users\Admin\2xiv.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4632
        • C:\Users\Admin\3xiv.exe
          C:\Users\Admin\3xiv.exe
          3⤵
          • Modifies security service
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4332
          • C:\Users\Admin\3xiv.exe
            C:\Users\Admin\3xiv.exe startC:\Users\Admin\AppData\Roaming\51B81\2795C.exe%C:\Users\Admin\AppData\Roaming\51B81
            4⤵
            • Executes dropped EXE
            PID:760
          • C:\Program Files (x86)\LP\5C75\EA7F.tmp
            "C:\Program Files (x86)\LP\5C75\EA7F.tmp"
            4⤵
            • Executes dropped EXE
            PID:3384
          • C:\Users\Admin\3xiv.exe
            C:\Users\Admin\3xiv.exe startC:\Program Files (x86)\81518\lvvm.exe%C:\Program Files (x86)\81518
            4⤵
            • Executes dropped EXE
            PID:4272
        • C:\Users\Admin\4xiv.exe
          C:\Users\Admin\4xiv.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3120
          • C:\Users\Admin\AppData\Local\2aebb42b\X
            *0*bc*bb4eac20*31.193.3.240:53
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3544
        • C:\Users\Admin\5xiv.exe
          C:\Users\Admin\5xiv.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1104
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2.exe
          3⤵
            PID:4720
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:704
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:544
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1508
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4916
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1656

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\LP\5C75\EA7F.tmp
              Filesize

              101KB

              MD5

              8ddb300fe82a1e8ab0b0c9b704725316

              SHA1

              899ef3abfa492136996ccffd0958e0c607817835

              SHA256

              86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f

              SHA512

              3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321

              Download Submit

            • C:\Program Files (x86)\LP\5C75\EA7F.tmp
              Filesize

              101KB

              MD5

              8ddb300fe82a1e8ab0b0c9b704725316

              SHA1

              899ef3abfa492136996ccffd0958e0c607817835

              SHA256

              86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f

              SHA512

              3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321

              Download Submit

            • C:\Users\Admin\2xiv.exe
              Filesize

              64KB

              MD5

              930ddf5711ff276332bc5e1eec8cded0

              SHA1

              e14b2bdd272fe546c043ab7a2f249955e1820744

              SHA256

              4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d

              SHA512

              3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d

              Download Submit

            • C:\Users\Admin\2xiv.exe
              Filesize

              64KB

              MD5

              930ddf5711ff276332bc5e1eec8cded0

              SHA1

              e14b2bdd272fe546c043ab7a2f249955e1820744

              SHA256

              4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d

              SHA512

              3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d

              Download Submit

            • C:\Users\Admin\2xiv.exe
              Filesize

              64KB

              MD5

              930ddf5711ff276332bc5e1eec8cded0

              SHA1

              e14b2bdd272fe546c043ab7a2f249955e1820744

              SHA256

              4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d

              SHA512

              3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d

              Download Submit

            • C:\Users\Admin\3xiv.exe
              Filesize

              287KB

              MD5

              3d6f651187a05dfab030fd923b218279

              SHA1

              9d0fff6e4d22777a9f3b7c57baea9f34151eca65

              SHA256

              b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

              SHA512

              835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

              Download Submit

            • C:\Users\Admin\3xiv.exe
              Filesize

              287KB

              MD5

              3d6f651187a05dfab030fd923b218279

              SHA1

              9d0fff6e4d22777a9f3b7c57baea9f34151eca65

              SHA256

              b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

              SHA512

              835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

              Download Submit

            • C:\Users\Admin\3xiv.exe
              Filesize

              287KB

              MD5

              3d6f651187a05dfab030fd923b218279

              SHA1

              9d0fff6e4d22777a9f3b7c57baea9f34151eca65

              SHA256

              b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

              SHA512

              835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

              Download Submit

            • C:\Users\Admin\3xiv.exe
              Filesize

              287KB

              MD5

              3d6f651187a05dfab030fd923b218279

              SHA1

              9d0fff6e4d22777a9f3b7c57baea9f34151eca65

              SHA256

              b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e

              SHA512

              835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd

              Download Submit

            • C:\Users\Admin\4xiv.exe
              Filesize

              265KB

              MD5

              45cba518c7a8b41f65690da873e13e3d

              SHA1

              5a787a1f7f7bdd22c72b0f9d26818d902b65da8b

              SHA256

              c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79

              SHA512

              7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7

              Download Submit

            • C:\Users\Admin\4xiv.exe
              Filesize

              265KB

              MD5

              45cba518c7a8b41f65690da873e13e3d

              SHA1

              5a787a1f7f7bdd22c72b0f9d26818d902b65da8b

              SHA256

              c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79

              SHA512

              7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7

              Download Submit

            • C:\Users\Admin\5xiv.exe
              Filesize

              44KB

              MD5

              fd4f97e710556c5769ab1e074a5c02b5

              SHA1

              eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61

              SHA256

              7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18

              SHA512

              6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726

              Download Submit

            • C:\Users\Admin\5xiv.exe
              Filesize

              44KB

              MD5

              fd4f97e710556c5769ab1e074a5c02b5

              SHA1

              eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61

              SHA256

              7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18

              SHA512

              6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726

              Download Submit

            • C:\Users\Admin\AppData\Local\2aebb42b\X
              Filesize

              38KB

              MD5

              72de2dadaf875e2fd7614e100419033c

              SHA1

              5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

              SHA256

              c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

              SHA512

              e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

              Download Submit

            • C:\Users\Admin\AppData\Local\2aebb42b\X
              Filesize

              38KB

              MD5

              72de2dadaf875e2fd7614e100419033c

              SHA1

              5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e

              SHA256

              c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381

              SHA512

              e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3

              Download Submit

            • C:\Users\Admin\x276Ht.exe
              Filesize

              332KB

              MD5

              ad27bc021625bc7692f942a626b3a576

              SHA1

              12d961ecb68e63c2cf3c3590da311a9bd5e521f7

              SHA256

              39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0

              SHA512

              2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb

              Download Submit

            • C:\Users\Admin\x276Ht.exe
              Filesize

              332KB

              MD5

              ad27bc021625bc7692f942a626b3a576

              SHA1

              12d961ecb68e63c2cf3c3590da311a9bd5e521f7

              SHA256

              39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0

              SHA512

              2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb

              Download Submit

            • C:\Users\Admin\xoaafu.exe
              Filesize

              332KB

              MD5

              ff1fc6e43dcafefed2b04e2ad797b576

              SHA1

              7841af9309b3ee76ca7d29188e97ce03c9bcada2

              SHA256

              b8b6960a60c53c05c12bc412cef14dbd893b0c8e16762ec33e85a03931cbd6bb

              SHA512

              3694167f1c1868f693ea8bf6b4595fffd8e3b1bb6d92cd647b6e280ad5fac37e32aae01bbc08908469749bdc1d356f8fad489a44441584b16bb17a9a8021d6b1

              Download Submit

            • C:\Users\Admin\xoaafu.exe
              Filesize

              332KB

              MD5

              ff1fc6e43dcafefed2b04e2ad797b576

              SHA1

              7841af9309b3ee76ca7d29188e97ce03c9bcada2

              SHA256

              b8b6960a60c53c05c12bc412cef14dbd893b0c8e16762ec33e85a03931cbd6bb

              SHA512

              3694167f1c1868f693ea8bf6b4595fffd8e3b1bb6d92cd647b6e280ad5fac37e32aae01bbc08908469749bdc1d356f8fad489a44441584b16bb17a9a8021d6b1

              Download Submit

            • memory/760-179-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/3120-166-0x0000000030670000-0x00000000306BF000-memory.dmp

              Filesize

              316KB

              Download

            • memory/3120-167-0x0000000000733000-0x0000000000768000-memory.dmp

              Filesize

              212KB

              Download

            • memory/3384-183-0x0000000000400000-0x000000000041D000-memory.dmp

              Filesize

              116KB

              Download

            • memory/3384-187-0x0000000000400000-0x000000000041D000-memory.dmp

              Filesize

              116KB

              Download

            • memory/3384-184-0x00000000006AF000-0x00000000006BF000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3384-188-0x00000000006AF000-0x00000000006BF000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4272-200-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/4332-162-0x000000000065F000-0x00000000006A5000-memory.dmp

              Filesize

              280KB

              Download

            • memory/4332-171-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/4332-161-0x0000000000400000-0x000000000046B000-memory.dmp

              Filesize

              428KB

              Download

            • memory/4632-149-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/4632-145-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/4632-148-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download

            • memory/4632-157-0x0000000000400000-0x000000000040E000-memory.dmp

              Filesize

              56KB

              Download