e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095 | Triage

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 07:38

Sharing

Report Analysis Logs

General

Target

e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
Size

187KB
MD5

e549490ff53716913bdad548b51cb953
SHA1

eb3a5e2b5a6f156dd7171bbc80b2cb8a65e1c7d3
SHA256

e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095
SHA512

948fa1ef207bc5205a5ad74f0d8f969cc64e17395270beb7b6f5e3a1b75b1535f962dd05e10de9da822dcab914bc981ca2c10c55f9896c2d947322454970e875
SSDEEP

3072:1pzRNYuluupWyvbOijh7UAoaI52pySvl3nW0CWcscGF8ZHmt4qMQK5L:1ZRvupm9UX5WflXW5Wc88wGllp

Score

8^/10

evasion trojan upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral2/memory/5016-132-0x0000000010000000-0x000000001004C000-memory.dmp	upx
behavioral2/memory/5016-133-0x0000000010000000-0x000000001004C000-memory.dmp	upx
behavioral2/memory/5016-135-0x0000000010000000-0x000000001004C000-memory.dmp	upx
behavioral2/memory/5016-136-0x0000000010000000-0x000000001004C000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

Processes:

e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

Drops file in System32 directory 2 IoCs

Processes:

e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

description	ioc	process
File created	C:\Windows\SysWOW64\nsinet.exe	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File opened for modification	C:\Windows\SysWOW64\nsinet.exe	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

Drops file in Program Files directory 12 IoCs

Processes:

e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

description	ioc	process
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\js\js_api_dialer.php	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\dialerexe.ini	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Center\NoCreditCard.lnk	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File opened for modification	C:\Program Files (x86)\Instant Access\Center\NoCreditCard.lnk	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\medias\button4.jpg	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\medias\button3.jpg	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\medias\button2.jpg	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\medias\dialer.ico	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\instant access.exe	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\DesktopIcons\NoCreditCard.lnk	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\Common\module.php	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Program Files (x86)\Instant Access\Multi\20091002151014\medias\button1.jpg	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

Drops file in Windows directory 3 IoCs

Processes:

e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

description	ioc	process
File created	C:\Windows\dialexe.zl	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Windows\dialexe.epk	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
File created	C:\Windows\dialerexe.ini	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

Processes:

e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF1C8E21-4045-4D67-B528-335F1A4F0DE9}\LocalServer32\ = "C:\\Windows\\SysWow64\\nsinet.exe /run"	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF1C8E21-4045-4D67-B528-335F1A4F0DE9}	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF1C8E21-4045-4D67-B528-335F1A4F0DE9}\LocalServer32	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

pid	process
5016	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
5016	e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe

C:\Users\Admin\AppData\Local\Temp\e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe
"C:\Users\Admin\AppData\Local\Temp\e0b4b19dffaf78a7bc551c2aeebe3b415bffa4746d42c6ab3bea1bc0a1617095.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5016-132-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/5016-133-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/5016-134-0x0000000000400000-0x0000000000443908-memory.dmp

Filesize
270KB

Download
memory/5016-135-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/5016-136-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download