Overview

overview

8

Static

static

9211a42cd6...c8.exe

windows7-x64

8

9211a42cd6...c8.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    187s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 12:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9211a42cd6e5b29b072632650e6396c1caad5803db8225c1e198da5ba5e88cc8.exe

  • Size

    252KB

  • MD5

    39f80f18b02ee0cf9bba3a0d01900cd1

  • SHA1

    4f74bd8dc6a7b93acca7e8ecb773c571a0e61f6b

  • SHA256

    9211a42cd6e5b29b072632650e6396c1caad5803db8225c1e198da5ba5e88cc8

  • SHA512

    925123513e9c7dc723d4242f7ce8fade4db2944483467c334ba76123808d301481f2bfa2219bbbd1ca8a677908843e716352f33543675bb8d6472e5b1e9b3501

  • SSDEEP

    6144:6P6nejFShV25IXS7XAj+Lv998rirykvW9s8kedZCzNogr8Q+W:44O8hOXAo98rT2W1kedZ2p8Qr

Score
8/10
persistenceupx

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 36 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9211a42cd6e5b29b072632650e6396c1caad5803db8225c1e198da5ba5e88cc8.exe
    "C:\Users\Admin\AppData\Local\Temp\9211a42cd6e5b29b072632650e6396c1caad5803db8225c1e198da5ba5e88cc8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:576
      • C:\Windows\system32\regsvr32.exe
        /s "C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat"
        3⤵
        • Registers COM server for autorun
        • Loads dropped DLL
        • Modifies registry class
        PID:1452
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1324
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x58c
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:996

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Carefree\plugin.dat
    Filesize

    93KB

    MD5

    ebe4ac8e34be962ba72bf123d2c06dca

    SHA1

    4cdf6301c32f9451fca2b6b85e853902f05360fc

    SHA256

    e81ac0ac6c1bfb120ae9a5670ebe8511a2fdf7e40726faba3703ba74009834a6

    SHA512

    d4ca56a1baefc1a5444da84f536572cac4e4eea6bd2d3ce94db4e62e7f30d9db73bc25d7e8c3ee77073406d201cae301d5b67b762082dc6ae0cf6c91c1284285

    Download Submit

  • C:\Users\Admin\AppData\Roaming\SogouPinyin.local
    Filesize

    89B

    MD5

    e57500099e9708e303e9419489b31cfa

    SHA1

    f878b32225c70d924f2c76ada903154960859f46

    SHA256

    316805e9e9251febc65fb4923503c5551d449ad012bfb23cfb29c85118bd8ccf

    SHA512

    e2101cad72d3d83f951d362aed7b5d9b5f01877cca7fc15f76ca4c4c7e6632208091cfe7781d7f24caabbc9c171ad8c27dae506d6c158fc910b1813447f17bff

    Download Submit

  • \Users\Admin\AppData\Roaming\Carefree\plugin.dat
    Filesize

    93KB

    MD5

    ebe4ac8e34be962ba72bf123d2c06dca

    SHA1

    4cdf6301c32f9451fca2b6b85e853902f05360fc

    SHA256

    e81ac0ac6c1bfb120ae9a5670ebe8511a2fdf7e40726faba3703ba74009834a6

    SHA512

    d4ca56a1baefc1a5444da84f536572cac4e4eea6bd2d3ce94db4e62e7f30d9db73bc25d7e8c3ee77073406d201cae301d5b67b762082dc6ae0cf6c91c1284285

    Download Submit

  • \Users\Admin\AppData\Roaming\Carefree\plugin.dat
    Filesize

    93KB

    MD5

    ebe4ac8e34be962ba72bf123d2c06dca

    SHA1

    4cdf6301c32f9451fca2b6b85e853902f05360fc

    SHA256

    e81ac0ac6c1bfb120ae9a5670ebe8511a2fdf7e40726faba3703ba74009834a6

    SHA512

    d4ca56a1baefc1a5444da84f536572cac4e4eea6bd2d3ce94db4e62e7f30d9db73bc25d7e8c3ee77073406d201cae301d5b67b762082dc6ae0cf6c91c1284285

    Download Submit

  • \Users\Admin\AppData\Roaming\Carefree\plugin.dat
    Filesize

    93KB

    MD5

    ebe4ac8e34be962ba72bf123d2c06dca

    SHA1

    4cdf6301c32f9451fca2b6b85e853902f05360fc

    SHA256

    e81ac0ac6c1bfb120ae9a5670ebe8511a2fdf7e40726faba3703ba74009834a6

    SHA512

    d4ca56a1baefc1a5444da84f536572cac4e4eea6bd2d3ce94db4e62e7f30d9db73bc25d7e8c3ee77073406d201cae301d5b67b762082dc6ae0cf6c91c1284285

    Download Submit

  • memory/576-55-0x0000000000000000-mapping.dmp

    Download

  • memory/1324-62-0x000007FEFC3F1000-0x000007FEFC3F3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1324-65-0x000007FEFC120000-0x000007FEFC18D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/1324-66-0x000007FEFC120000-0x000007FEFC18D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/1452-59-0x0000000000000000-mapping.dmp

    Download

  • memory/1452-60-0x000007FEFC421000-0x000007FEFC423000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1656-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

    Filesize

    8KB

    Download