Overview

overview

8

Static

static

8f8694d677...28.exe

windows7-x64

8f8694d677...28.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 04:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f8694d6770b35934b232c3737f78ecc3acf2e75f0066151c28958d813191d28.exe

  • Size

    255KB

  • MD5

    3f4d96cbd4ea55d9e8c4aafa19b86197

  • SHA1

    572a642c153bbd2c05a1fe7175c7e53e063b8479

  • SHA256

    8f8694d6770b35934b232c3737f78ecc3acf2e75f0066151c28958d813191d28

  • SHA512

    39ace922d4f71c5113aa5cdfc6a91b4436c3bcc41e46634ba120601e3730a0e3a3e56a61fd7b7482bdc03c9c6eee63236e241ced5aef172d439a065e1f6238b7

  • SSDEEP

    6144:7UnITMpSph0lMqqgWoDhujqcQQbxJhVGvkVbOcH4CIMc:7CQMY07qgWo6VVGvkVLAV

Score
8/10
persistenceupx

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 4 IoCs
    persistence
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f8694d6770b35934b232c3737f78ecc3acf2e75f0066151c28958d813191d28.exe
    "C:\Users\Admin\AppData\Local\Temp\8f8694d6770b35934b232c3737f78ecc3acf2e75f0066151c28958d813191d28.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Modifies registry class
        PID:2216
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1080
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2520
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1352

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat
    Filesize

    95KB

    MD5

    4fd4ea70588718fa6193950229b718ed

    SHA1

    ec4abd19eec0cf9f919e1477ef3cb5b8fabacad2

    SHA256

    08a7de96b2500aaca4bc654b0b1f78dea41a32b63b46e0b0c04f16480cf615e1

    SHA512

    a15636034731f1bd1314ddc20043fd8f61d2bfa9da303182a65541014f7fb10f3bdd5a48231be7083a973b5512bfbe34b92d6169f4ae0f06e73cdd7e0a7e1d9c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat
    Filesize

    95KB

    MD5

    4fd4ea70588718fa6193950229b718ed

    SHA1

    ec4abd19eec0cf9f919e1477ef3cb5b8fabacad2

    SHA256

    08a7de96b2500aaca4bc654b0b1f78dea41a32b63b46e0b0c04f16480cf615e1

    SHA512

    a15636034731f1bd1314ddc20043fd8f61d2bfa9da303182a65541014f7fb10f3bdd5a48231be7083a973b5512bfbe34b92d6169f4ae0f06e73cdd7e0a7e1d9c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat
    Filesize

    95KB

    MD5

    4fd4ea70588718fa6193950229b718ed

    SHA1

    ec4abd19eec0cf9f919e1477ef3cb5b8fabacad2

    SHA256

    08a7de96b2500aaca4bc654b0b1f78dea41a32b63b46e0b0c04f16480cf615e1

    SHA512

    a15636034731f1bd1314ddc20043fd8f61d2bfa9da303182a65541014f7fb10f3bdd5a48231be7083a973b5512bfbe34b92d6169f4ae0f06e73cdd7e0a7e1d9c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat
    Filesize

    95KB

    MD5

    4fd4ea70588718fa6193950229b718ed

    SHA1

    ec4abd19eec0cf9f919e1477ef3cb5b8fabacad2

    SHA256

    08a7de96b2500aaca4bc654b0b1f78dea41a32b63b46e0b0c04f16480cf615e1

    SHA512

    a15636034731f1bd1314ddc20043fd8f61d2bfa9da303182a65541014f7fb10f3bdd5a48231be7083a973b5512bfbe34b92d6169f4ae0f06e73cdd7e0a7e1d9c

    Download Submit

  • C:\Users\Admin\AppData\Roaming\SogouPinyin.local
    Filesize

    89B

    MD5

    ae50f36cf2b741a273db779a0846a599

    SHA1

    32d568e30e792b8a1a2acccfb0f57ad730ab94d3

    SHA256

    a2e14114820372a452d42d2690ba18370fef805a8a2ff62f01b310fe73c96847

    SHA512

    404e50fd8af4fa31db1fe9f726c6b81388540d1783eaced745f5f43a432d2f5e3553efb4d9e89983e319d00783a73ee78a47f67d045ef340cc41b5bb6383e242

    Download Submit

  • memory/1080-175-0x00007FF83DAB0000-0x00007FF83DB1D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/1080-141-0x00007FF83DAB0000-0x00007FF83DB1D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/1352-160-0x000001E4EC551000-0x000001E4EC555000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-165-0x000001E4FF580000-0x000001E4FF680000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1352-184-0x000001E4EC54E000-0x000001E4EC551000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1352-149-0x000001E4EA320000-0x000001E4EA340000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1352-154-0x000001E4EC54D000-0x000001E4EC550000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1352-155-0x000001E4EC54D000-0x000001E4EC550000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1352-157-0x000001E4EC54D000-0x000001E4EC550000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1352-156-0x000001E4EC54D000-0x000001E4EC550000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1352-159-0x000001E4EC551000-0x000001E4EC555000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-185-0x000001E4EC54E000-0x000001E4EC551000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1352-161-0x000001E4EC551000-0x000001E4EC555000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-162-0x000001E4EC551000-0x000001E4EC555000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-163-0x000001E4EC551000-0x000001E4EC555000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-183-0x000001E4EC54E000-0x000001E4EC551000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1352-166-0x000001E4E9500000-0x000001E4E9600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1352-167-0x000001E4EA1B0000-0x000001E4EA1B8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1352-170-0x000001E4EC541000-0x000001E4EC545000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-171-0x000001E4EC541000-0x000001E4EC545000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-172-0x000001E4EC541000-0x000001E4EC545000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-173-0x000001E4EC541000-0x000001E4EC545000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-178-0x000001E4EC54A000-0x000001E4EC54E000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-177-0x000001E4EC54A000-0x000001E4EC54E000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-179-0x000001E4EC54A000-0x000001E4EC54E000-memory.dmp

    Filesize

    16KB

    Download

  • memory/1352-180-0x000001E4EC54A000-0x000001E4EC54E000-memory.dmp

    Filesize

    16KB

    Download

  • memory/2216-135-0x0000000000000000-mapping.dmp

    Download

  • memory/2216-138-0x00007FF82F220000-0x00007FF82F28D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/2356-132-0x0000000000000000-mapping.dmp

    Download

  • memory/2356-137-0x00000000023A0000-0x000000000240D000-memory.dmp

    Filesize

    436KB

    Download