Overview

overview

10

Static

static

b98c93cac7...a2.exe

windows7-x64

10

b98c93cac7...a2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    164s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2.exe
  • Size 808KB
  • Sample221107-ysx13afdf3
  • SHA256 b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 11 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 55 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2556
      • C:\Users\Admin\AppData\Local\Temp\b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2.exe
        "C:\Users\Admin\AppData\Local\Temp\b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4844
        • C:\Users\Admin\x276Ht.exe
          C:\Users\Admin\x276Ht.exe
          3⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Checks computer location settings
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4848
          • C:\Users\Admin\xoaafu.exe
            "C:\Users\Admin\xoaafu.exe"
            4⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4616
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del x276Ht.exe
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1776
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:4136
        • C:\Users\Admin\2xiv.exe
          C:\Users\Admin\2xiv.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5060
          • C:\Users\Admin\2xiv.exe
            "C:\Users\Admin\2xiv.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4632
        • C:\Users\Admin\3xiv.exe
          C:\Users\Admin\3xiv.exe
          3⤵
          • Modifies security service
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4332
          • C:\Users\Admin\3xiv.exe
            C:\Users\Admin\3xiv.exe startC:\Users\Admin\AppData\Roaming\51B81\2795C.exe%C:\Users\Admin\AppData\Roaming\51B81
            4⤵
            • Executes dropped EXE
            PID:760
          • C:\Program Files (x86)\LP\5C75\EA7F.tmp
            "C:\Program Files (x86)\LP\5C75\EA7F.tmp"
            4⤵
            • Executes dropped EXE
            PID:3384
          • C:\Users\Admin\3xiv.exe
            C:\Users\Admin\3xiv.exe startC:\Program Files (x86)\81518\lvvm.exe%C:\Program Files (x86)\81518
            4⤵
            • Executes dropped EXE
            PID:4272
        • C:\Users\Admin\4xiv.exe
          C:\Users\Admin\4xiv.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3120
          • C:\Users\Admin\AppData\Local\2aebb42b\X
            *0*bc*bb4eac20*31.193.3.240:53
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3544
        • C:\Users\Admin\5xiv.exe
          C:\Users\Admin\5xiv.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1104
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del b98c93cac76b67191231d3923105c75af3f98b68791895f1fc857a4cc38273a2.exe
          3⤵
            PID:4720
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              4⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:704
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:544
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1508
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4916
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1656

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            EA7F.tmp
            • Path C:\Program Files (x86)\LP\5C75\EA7F.tmp
            • Size 101KB
            • SHA256 86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            EA7F.tmp
            • Path C:\Program Files (x86)\LP\5C75\EA7F.tmp
            • Size 101KB
            • SHA256 86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            2xiv.exe
            • Path C:\Users\Admin\2xiv.exe
            • Size 64KB
            • SHA256 4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            2xiv.exe
            • Path C:\Users\Admin\2xiv.exe
            • Size 64KB
            • SHA256 4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            2xiv.exe
            • Path C:\Users\Admin\2xiv.exe
            • Size 64KB
            • SHA256 4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            3xiv.exe
            • Path C:\Users\Admin\3xiv.exe
            • Size 287KB
            • SHA256 b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            3xiv.exe
            • Path C:\Users\Admin\3xiv.exe
            • Size 287KB
            • SHA256 b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            3xiv.exe
            • Path C:\Users\Admin\3xiv.exe
            • Size 287KB
            • SHA256 b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            3xiv.exe
            • Path C:\Users\Admin\3xiv.exe
            • Size 287KB
            • SHA256 b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4xiv.exe
            • Path C:\Users\Admin\4xiv.exe
            • Size 265KB
            • SHA256 c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            4xiv.exe
            • Path C:\Users\Admin\4xiv.exe
            • Size 265KB
            • SHA256 c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            5xiv.exe
            • Path C:\Users\Admin\5xiv.exe
            • Size 44KB
            • SHA256 7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            5xiv.exe
            • Path C:\Users\Admin\5xiv.exe
            • Size 44KB
            • SHA256 7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            X
            • Path C:\Users\Admin\AppData\Local\2aebb42b\X
            • Size 38KB
            • SHA256 c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            X
            • Path C:\Users\Admin\AppData\Local\2aebb42b\X
            • Size 38KB
            • SHA256 c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            x276Ht.exe
            • Path C:\Users\Admin\x276Ht.exe
            • Size 332KB
            • SHA256 39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            x276Ht.exe
            • Path C:\Users\Admin\x276Ht.exe
            • Size 332KB
            • SHA256 39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            xoaafu.exe
            • Path C:\Users\Admin\xoaafu.exe
            • Size 332KB
            • SHA256 b8b6960a60c53c05c12bc412cef14dbd893b0c8e16762ec33e85a03931cbd6bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            xoaafu.exe
            • Path C:\Users\Admin\xoaafu.exe
            • Size 332KB
            • SHA256 b8b6960a60c53c05c12bc412cef14dbd893b0c8e16762ec33e85a03931cbd6bb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/760-179-0x0000000000400000-0x000000000046B000-memory.dmp
            Download

            memory/3120-166-0x0000000030670000-0x00000000306BF000-memory.dmp
            Download

            memory/3120-167-0x0000000000733000-0x0000000000768000-memory.dmp
            Download

            memory/3384-183-0x0000000000400000-0x000000000041D000-memory.dmp
            Download

            memory/3384-187-0x0000000000400000-0x000000000041D000-memory.dmp
            Download

            memory/3384-184-0x00000000006AF000-0x00000000006BF000-memory.dmp
            Download

            memory/3384-188-0x00000000006AF000-0x00000000006BF000-memory.dmp
            Download

            memory/4272-200-0x0000000000400000-0x000000000046B000-memory.dmp
            Download

            memory/4332-162-0x000000000065F000-0x00000000006A5000-memory.dmp
            Download

            memory/4332-171-0x0000000000400000-0x000000000046B000-memory.dmp
            Download

            memory/4332-161-0x0000000000400000-0x000000000046B000-memory.dmp
            Download

            memory/4632-149-0x0000000000400000-0x000000000040E000-memory.dmp
            Download

            memory/4632-145-0x0000000000400000-0x000000000040E000-memory.dmp
            Download

            memory/4632-148-0x0000000000400000-0x000000000040E000-memory.dmp
            Download

            memory/4632-157-0x0000000000400000-0x000000000040E000-memory.dmp
            Download