Overview

overview

8

Static

static

f07321d518...38.exe

windows7-x64

8

f07321d518...38.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    183s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 19:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f07321d518899920642ef12d783f600093e461afcc11c37413d3046cb53f1e38.exe

  • Size

    66KB

  • MD5

    582b1b120cb451dd3473116f6f7fc5b0

  • SHA1

    f46b118610d6f0aa91f06512e117048032bb94ca

  • SHA256

    f07321d518899920642ef12d783f600093e461afcc11c37413d3046cb53f1e38

  • SHA512

    4003dae9a7c30c2044fce07d0b5607b396b4a6a21c184fb2a1a8697886fbc988dc0aa79f3cd2939e7855ad32e36ec4fb314c641729b0226b4c5d153472482151

  • SSDEEP

    1536:sr+Fum5LMI+WTJjcXnXMcpm/zOxJXKJwa:sr+Fu2II+HXXMcI/AKJd

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Drops desktop.ini file(s) 24 IoCs
  • Drops autorun.inf file 1 TTPs 25 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Modifies registry class 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f07321d518899920642ef12d783f600093e461afcc11c37413d3046cb53f1e38.exe
    "C:\Users\Admin\AppData\Local\Temp\f07321d518899920642ef12d783f600093e461afcc11c37413d3046cb53f1e38.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4412
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Windows\AE 0124 BE.gif
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5060 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4928
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Checks computer location settings
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:560
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:236
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4364

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    e32d02ce684c01ef3af05fae9066160e

    SHA1

    29c7a6e8ed553ac2765634265d1db041d6d422ec

    SHA256

    b00322d178a6cfc206458c26b26d6c80596073bb3283dcc3fc4e33a4b5f29d71

    SHA512

    e4e3175fb131095e4681ecb76d14dc74d059c0beafb6340965516c6d3d0538deb314b36a3f09df03b491edac84d5c0580e764fed1d8bca9abd4e65cb56167148

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    434B

    MD5

    a5ee28a9791eeb868d1273bd7ee2da2c

    SHA1

    a7b758b21867b11839a8c58003cee2c1fd62d3f8

    SHA256

    916e14f532ffdb6d2284cb4a045413cd33d720b74afee73d7964cb0f9309f2d0

    SHA512

    5acf836a7a717da94fc83fb578839f92d3d031e76e3161ad2816eb3806d1aa1e734cb5dd550c49f0a4586b86099a95bf19b9df2570ec9357a1742c9c8ac8fb9c

    Download Submit

  • C:\Windows\AE 0124 BE.exe
    Filesize

    130KB

    MD5

    4027bf9b2bf3265f1da3f5aa9e4ec2c1

    SHA1

    c104f6f780032aa1592d9b1e309477e127f16067

    SHA256

    82177bfcb6ee47409884d33a0c4794b8536913e4be21c7badb2c375535587a3f

    SHA512

    32bf1999d8ad128e24b55b404a5b69102f386a1bbbec2d3077c1b28e3c90b2ea94d5ed072d3e401801c202a6f8c424fcb82ba9f3f1e9745e3f3452824c175c7e

    Download Submit

  • C:\Windows\AE 0124 BE.exe
    Filesize

    130KB

    MD5

    4027bf9b2bf3265f1da3f5aa9e4ec2c1

    SHA1

    c104f6f780032aa1592d9b1e309477e127f16067

    SHA256

    82177bfcb6ee47409884d33a0c4794b8536913e4be21c7badb2c375535587a3f

    SHA512

    32bf1999d8ad128e24b55b404a5b69102f386a1bbbec2d3077c1b28e3c90b2ea94d5ed072d3e401801c202a6f8c424fcb82ba9f3f1e9745e3f3452824c175c7e

    Download Submit

  • C:\Windows\AE 0124 BE.gif
    Filesize

    66KB

    MD5

    0d357db753e66654668e939fb9414b58

    SHA1

    4fd2aa7c70d4bd74e46d0e8ff90ea5961f77ec9a

    SHA256

    a6a20802a87d726a4b69faded5a0ee8814eceb0335ddd26401da6c88397e546c

    SHA512

    872a8bf82a4813db78aa52edd79b86a103f0ce54260f1a06bdc19409baebde55d02e620027eb4b7d83fd0c9f74495816f3162cd390097366369b4492fbfeea70

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\MSVBVM60.DLL
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    130KB

    MD5

    4027bf9b2bf3265f1da3f5aa9e4ec2c1

    SHA1

    c104f6f780032aa1592d9b1e309477e127f16067

    SHA256

    82177bfcb6ee47409884d33a0c4794b8536913e4be21c7badb2c375535587a3f

    SHA512

    32bf1999d8ad128e24b55b404a5b69102f386a1bbbec2d3077c1b28e3c90b2ea94d5ed072d3e401801c202a6f8c424fcb82ba9f3f1e9745e3f3452824c175c7e

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    130KB

    MD5

    4027bf9b2bf3265f1da3f5aa9e4ec2c1

    SHA1

    c104f6f780032aa1592d9b1e309477e127f16067

    SHA256

    82177bfcb6ee47409884d33a0c4794b8536913e4be21c7badb2c375535587a3f

    SHA512

    32bf1999d8ad128e24b55b404a5b69102f386a1bbbec2d3077c1b28e3c90b2ea94d5ed072d3e401801c202a6f8c424fcb82ba9f3f1e9745e3f3452824c175c7e

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    130KB

    MD5

    4027bf9b2bf3265f1da3f5aa9e4ec2c1

    SHA1

    c104f6f780032aa1592d9b1e309477e127f16067

    SHA256

    82177bfcb6ee47409884d33a0c4794b8536913e4be21c7badb2c375535587a3f

    SHA512

    32bf1999d8ad128e24b55b404a5b69102f386a1bbbec2d3077c1b28e3c90b2ea94d5ed072d3e401801c202a6f8c424fcb82ba9f3f1e9745e3f3452824c175c7e

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    130KB

    MD5

    4027bf9b2bf3265f1da3f5aa9e4ec2c1

    SHA1

    c104f6f780032aa1592d9b1e309477e127f16067

    SHA256

    82177bfcb6ee47409884d33a0c4794b8536913e4be21c7badb2c375535587a3f

    SHA512

    32bf1999d8ad128e24b55b404a5b69102f386a1bbbec2d3077c1b28e3c90b2ea94d5ed072d3e401801c202a6f8c424fcb82ba9f3f1e9745e3f3452824c175c7e

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • memory/236-154-0x0000000000000000-mapping.dmp

    Download

  • memory/560-134-0x0000000000000000-mapping.dmp

    Download

  • memory/4288-139-0x0000000000000000-mapping.dmp

    Download

  • memory/4364-146-0x0000000000000000-mapping.dmp

    Download