Overview

overview

10

Static

static

05bb26136e...64.exe

windows7-x64

10

05bb26136e...64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 10:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564.exe

  • Size

    718KB

  • MD5

    971df28d45c29efa1f2eb9effb51e532

  • SHA1

    5dddea3fb298fb4beca0d08ba64c67b90f6832b7

  • SHA256

    05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564

  • SHA512

    c1f308ff86c64c3efcc1a3b6170cc718486a845522953af9c7afa4ca14df2cad1b4d978a823610e1fbc8542b0c4e73c511b82e9ab59716ff5e3025711a6ec401

  • SSDEEP

    1536:9NhENNo2oa5pHwAVvu0IysOPv3YdI3EpCK+V5iR/yKoDn66XujshkGXE7rFKh:9gN5ogyJ0XgdsEIKlyKo26Jkj7rF

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564.exe
    "C:\Users\Admin\AppData\Local\Temp\05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:396
    • C:\Users\Admin\AppData\Local\Temp\05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564.exe
      "C:\Users\Admin\AppData\Local\Temp\05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:700
        • C:\Users\Admin\E696D64614\winlogon.exe
          "C:\Users\Admin\E696D64614\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Users\Admin\E696D64614\winlogon.exe
            "C:\Users\Admin\E696D64614\winlogon.exe"
            5⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1324
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:5004
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:1448
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3580
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3580 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1412

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        2KB

        MD5

        76e7d5bf61b2e80d159f88aa9798ce91

        SHA1

        32a46de50c9c02b068e39cf49b78c7e2d5ace20d

        SHA256

        280fd6ae3ad21323199759814c4dd82329eb8f9847ed1fa2be145e83b4c88bf3

        SHA512

        5efd8c64ac40ae006d2ce4509eb9e5f1448fb1156e914d303e8bc4dcfe1d94c57c7eae216b362877e7b644876656cc9e5c4cebfc905bab3f8b09cb1a051d69c4

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9
        Filesize

        506B

        MD5

        a69db4b56f140e7897cb58e57ad523a2

        SHA1

        6cadd613c2cb1e9c112a66f21691e59dae4f9617

        SHA256

        fc3ea80bccc37d1b90d8eb9938c104d7c8338cd8ba8d1ed8d5cb71ce74b288e1

        SHA512

        49b999a31995112f86459d4fd716ef2e0d2143bd5f9d596b0a50e44546b56446c9475df02374c287a6dbad089d636b77a1222d43598d456e668c037fcba678f4

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
        Filesize

        472B

        MD5

        cfbcb12817712d4f8f816c208590444a

        SHA1

        9999caeedbb1a95ae4236a5b962c233633df6799

        SHA256

        b5a41ab77d5ff4ba1a17ff074eb91bc18824d56dfc4b6c3320e900bbd6f3a90a

        SHA512

        a70eb8c366dfa0226cd62dbffbf51bd2da25571a6ff6b1f2e44dd8d9193a72f79ab7d90367378edf808ff3152ca45bf2a6ba3d64882d0f6d4aa437b6881d13f2

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        488B

        MD5

        a0df094de23b9a74358b5057f308d4ab

        SHA1

        b6a7c8df7b0af6062939978eeb35409f696e746e

        SHA256

        ac3d24774c578492224177599e4171a8d0e6721472a8d357f6675879b9cc975c

        SHA512

        19da0fb44e2b9c177fd2a9c24aa12564c726536c6a24f7eb240ec3d7b6adbea167e19e5286da2adace3f9d6baa9a8f21743bf2816b21e37382c474ac1bcf1eb0

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9
        Filesize

        248B

        MD5

        9bdf68bab8f7908bbf7d4949f87b7a17

        SHA1

        d31b2255a81a554ca958236bbc81954c785ed3b7

        SHA256

        d9bb49f7a38e94cec5c3c8365bcca842700943be15bbb35e59a48d06c7fe5543

        SHA512

        1df05484accb0eaf0aff292d14178149493ffa50a5f59affde53793c79cd04d2513c2ec68b13018974931554c45b895003723751a903871559ce67987d48e823

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
        Filesize

        480B

        MD5

        16bd9c475765f2c1269e192ff385954c

        SHA1

        9ee47b1a40b0ef5f35bf8d7c62d48d8ba99930d6

        SHA256

        3bd758d5ab361337a7f0d43374da18ae88a633d3d7c931113ddd4d8e73484fb8

        SHA512

        42f2653e64f5e465192ed2602cc1769abf8f6160500648b95b65e3ee15097e8b5cb80604d9a554b1bffd1d2fd6228b1004c99a20713586229555cc920620f23d

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        718KB

        MD5

        971df28d45c29efa1f2eb9effb51e532

        SHA1

        5dddea3fb298fb4beca0d08ba64c67b90f6832b7

        SHA256

        05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564

        SHA512

        c1f308ff86c64c3efcc1a3b6170cc718486a845522953af9c7afa4ca14df2cad1b4d978a823610e1fbc8542b0c4e73c511b82e9ab59716ff5e3025711a6ec401

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        718KB

        MD5

        971df28d45c29efa1f2eb9effb51e532

        SHA1

        5dddea3fb298fb4beca0d08ba64c67b90f6832b7

        SHA256

        05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564

        SHA512

        c1f308ff86c64c3efcc1a3b6170cc718486a845522953af9c7afa4ca14df2cad1b4d978a823610e1fbc8542b0c4e73c511b82e9ab59716ff5e3025711a6ec401

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        718KB

        MD5

        971df28d45c29efa1f2eb9effb51e532

        SHA1

        5dddea3fb298fb4beca0d08ba64c67b90f6832b7

        SHA256

        05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564

        SHA512

        c1f308ff86c64c3efcc1a3b6170cc718486a845522953af9c7afa4ca14df2cad1b4d978a823610e1fbc8542b0c4e73c511b82e9ab59716ff5e3025711a6ec401

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        718KB

        MD5

        971df28d45c29efa1f2eb9effb51e532

        SHA1

        5dddea3fb298fb4beca0d08ba64c67b90f6832b7

        SHA256

        05bb26136e72fabecf3b3c703390f2d7f86f0546d8ecde1ccc7c1e2d37870564

        SHA512

        c1f308ff86c64c3efcc1a3b6170cc718486a845522953af9c7afa4ca14df2cad1b4d978a823610e1fbc8542b0c4e73c511b82e9ab59716ff5e3025711a6ec401

        Download Submit

      • memory/1324-154-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1324-162-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1324-169-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1324-157-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1324-158-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/1324-161-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/2108-152-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4180-144-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4180-139-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4180-136-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4180-135-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4180-133-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download