Overview

overview

8

Static

static

e8b891b805...af.exe

windows7-x64

8

e8b891b805...af.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2022, 15:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e8b891b805f4ca0bd88edf3b91e29d04eeac5376fead4469d1346ad5dffec0af.exe

  • Size

    20KB

  • MD5

    1b7c00e998a7eb7528b90a895f4360e0

  • SHA1

    cc6e57f469f3e8e735c192df5e8b0255c5ea506d

  • SHA256

    e8b891b805f4ca0bd88edf3b91e29d04eeac5376fead4469d1346ad5dffec0af

  • SHA512

    e2cc9c87ef6158c2fc8e299f08ded85a4e498c9f8a9807ad3d56971718d1be1f6dc1a140b8d5ccbaa3bb9598cc84898c1a0ed3175a7ffc3f3c9ffc18b0975b06

  • SSDEEP

    192:1l5E3krTuntKy0peHDfCpHfBv+I4QwXt9V+jqu0G5KDJB29SKGLI:1M3PnQoHDCpHf4I4Qwdc0G5KDJiSI

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 17 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Drops desktop.ini file(s) 30 IoCs
  • Drops autorun.inf file 1 TTPs 27 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 40 IoCs
    adwarespyware
  • Modifies registry class 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8b891b805f4ca0bd88edf3b91e29d04eeac5376fead4469d1346ad5dffec0af.exe
    "C:\Users\Admin\AppData\Local\Temp\e8b891b805f4ca0bd88edf3b91e29d04eeac5376fead4469d1346ad5dffec0af.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\AE 0124 BE.gif
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1596
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1596 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2576
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Checks computer location settings
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:364
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3292
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3548

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          471B

          MD5

          cb295ed32b0acd9eac87bcc961fb315a

          SHA1

          a580f2d38c9d1611e25b6aaa3d79b54eb34d3ebe

          SHA256

          980abeaa872503211925db8acf8bdcdff0bc3c6deb2182fd698f6a444d2625be

          SHA512

          974f48bdfb8ea90a49cfa25cacc98c9a145702f4e4967dd6ffddd5eaee6144189499682e80b342708e04f812006314b04e5715492170d0f63c7b0530e9cd399a

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          Filesize

          434B

          MD5

          470aa83642f5c27075f04a04b6d71a0f

          SHA1

          c703d048e337957f6d6822f00a046a401799ec93

          SHA256

          22b6b1be55497f8ba43fe0da3e64035dbd4a1674395c90d7c52d23f76e98e13f

          SHA512

          6a9fb3d45efdd744e5afbdc38e3e8e54e85099b8d82fc58d503cbe62c124b3c5cdcddf1d6c94bfe8fae6826f5b2ba4037bd9b2bc621375673b575b96e626f235

          Download Submit

        • C:\Windows\AE 0124 BE.exe
          Filesize

          40KB

          MD5

          8c373c37d11f22fee4c8c75246977b5f

          SHA1

          c9c0dd9597372ccbf9cee5ea92f6f0c1b8187dc1

          SHA256

          a7befe37bc618b5b79b8b6e8de31575a562b1952d4679fd4061fb6883ac95933

          SHA512

          d5614f4b25b0e9230cf98b74115568013b1acdd9fe5f3ca6eb64ca4066dc3ccd0ee319656f6c0195bb1fd5671be7783cb72df2d4510a3708d2cf3e8a43ab21e5

          Download Submit

        • C:\Windows\AE 0124 BE.exe
          Filesize

          40KB

          MD5

          8c373c37d11f22fee4c8c75246977b5f

          SHA1

          c9c0dd9597372ccbf9cee5ea92f6f0c1b8187dc1

          SHA256

          a7befe37bc618b5b79b8b6e8de31575a562b1952d4679fd4061fb6883ac95933

          SHA512

          d5614f4b25b0e9230cf98b74115568013b1acdd9fe5f3ca6eb64ca4066dc3ccd0ee319656f6c0195bb1fd5671be7783cb72df2d4510a3708d2cf3e8a43ab21e5

          Download Submit

        • C:\Windows\AE 0124 BE.gif
          Filesize

          20KB

          MD5

          c037df1397c68bd2b15b1e8ec40fcae9

          SHA1

          ed0e933c2545ed5405f5a55a66654c6a6c1cbf5d

          SHA256

          8ae00ee0dac156dfafd070f5664007a3f0eeeb1e70c90836cfad43efc981c866

          SHA512

          50b91a24c4959c3979a21d5ee883b946faf59075957e5c965a559a40913f2350704a2f3e29d2a5aba7b60d12faf66891dd8fd6f9aa05960c5b536dfdcea5b1ea

          Download Submit

        • C:\Windows\AE 0124 BE.gif
          Filesize

          40KB

          MD5

          69e5fb74c384939adfeef53bc292f5c4

          SHA1

          26910efaed488084ecd64e66a273da619b3ea3a6

          SHA256

          c3af241c42f24ef249ba50095e9e051618b71741740060435715eb0a62a86360

          SHA512

          2d77e4f6130bd7a2abd85cbc58e5605062877450dc22ce425753d74bed0931c136de658c88ff2c1d6c67f96cc29f15228283def625c146e340d07ca07b409d7f

          Download Submit

        • C:\Windows\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\MSVBVM60.DLL
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\Msvbvm60.dll
          Filesize

          1.4MB

          MD5

          25f62c02619174b35851b0e0455b3d94

          SHA1

          4e8ee85157f1769f6e3f61c0acbe59072209da71

          SHA256

          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

          SHA512

          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          40KB

          MD5

          8c373c37d11f22fee4c8c75246977b5f

          SHA1

          c9c0dd9597372ccbf9cee5ea92f6f0c1b8187dc1

          SHA256

          a7befe37bc618b5b79b8b6e8de31575a562b1952d4679fd4061fb6883ac95933

          SHA512

          d5614f4b25b0e9230cf98b74115568013b1acdd9fe5f3ca6eb64ca4066dc3ccd0ee319656f6c0195bb1fd5671be7783cb72df2d4510a3708d2cf3e8a43ab21e5

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          40KB

          MD5

          8c373c37d11f22fee4c8c75246977b5f

          SHA1

          c9c0dd9597372ccbf9cee5ea92f6f0c1b8187dc1

          SHA256

          a7befe37bc618b5b79b8b6e8de31575a562b1952d4679fd4061fb6883ac95933

          SHA512

          d5614f4b25b0e9230cf98b74115568013b1acdd9fe5f3ca6eb64ca4066dc3ccd0ee319656f6c0195bb1fd5671be7783cb72df2d4510a3708d2cf3e8a43ab21e5

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          40KB

          MD5

          8c373c37d11f22fee4c8c75246977b5f

          SHA1

          c9c0dd9597372ccbf9cee5ea92f6f0c1b8187dc1

          SHA256

          a7befe37bc618b5b79b8b6e8de31575a562b1952d4679fd4061fb6883ac95933

          SHA512

          d5614f4b25b0e9230cf98b74115568013b1acdd9fe5f3ca6eb64ca4066dc3ccd0ee319656f6c0195bb1fd5671be7783cb72df2d4510a3708d2cf3e8a43ab21e5

          Download Submit

        • C:\Windows\SysWOW64\drivers\winlogon.exe
          Filesize

          40KB

          MD5

          8c373c37d11f22fee4c8c75246977b5f

          SHA1

          c9c0dd9597372ccbf9cee5ea92f6f0c1b8187dc1

          SHA256

          a7befe37bc618b5b79b8b6e8de31575a562b1952d4679fd4061fb6883ac95933

          SHA512

          d5614f4b25b0e9230cf98b74115568013b1acdd9fe5f3ca6eb64ca4066dc3ccd0ee319656f6c0195bb1fd5671be7783cb72df2d4510a3708d2cf3e8a43ab21e5

          Download Submit

        • \??\c:\B1uv3nth3x1.diz
          Filesize

          25B

          MD5

          589b6886a49054d03b739309a1de9fcc

          SHA1

          0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

          SHA256

          564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

          SHA512

          4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

          Download Submit

        • \??\c:\B1uv3nth3x1.diz
          Filesize

          25B

          MD5

          589b6886a49054d03b739309a1de9fcc

          SHA1

          0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

          SHA256

          564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

          SHA512

          4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

          Download Submit