Overview

overview

10

Static

static

2f5269813e...e0.exe

windows7-x64

10

2f5269813e...e0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 17:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0.exe

  • Size

    272KB

  • MD5

    310d66d4488e4fd0e978c3e85973a308

  • SHA1

    a25dfe830e1611f1eb8870a941a560c315db8fdc

  • SHA256

    2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0

  • SHA512

    3cb1cbef871dab640913a9bd7d9bdf5c85a91c9c5b9ce0844064ae8bf6c618c2320e2f57ad7a71424adafa43cbba1e08b42fa8c93bbd21422c3bf4d54b3659bb

  • SSDEEP

    6144:9x5ZY0h2Bg8WNo+Ik/P/Godl8BwYf4Nnpwp2uWDBJJ3UWQi:nbYQ2ByC2H/Gob8iY6pC2u0Bvd

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 60 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0.exe
    "C:\Users\Admin\AppData\Local\Temp\2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4872
    • C:\Users\Admin\AppData\Local\Temp\2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0.exe
      C:\Users\Admin\AppData\Local\Temp\2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0.exe startC:\Users\Admin\AppData\Roaming\88ACC\0C305.exe%C:\Users\Admin\AppData\Roaming\88ACC
      2⤵
        PID:4528
      • C:\Users\Admin\AppData\Local\Temp\2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0.exe
        C:\Users\Admin\AppData\Local\Temp\2f5269813e0717956acf58ee2e276368cf931482364cf1e0a9119e2bcf2d5de0.exe startC:\Program Files (x86)\CCDE6\lvvm.exe%C:\Program Files (x86)\CCDE6
        2⤵
          PID:1856
        • C:\Program Files (x86)\LP\0518\8368.tmp
          "C:\Program Files (x86)\LP\0518\8368.tmp"
          2⤵
          • Executes dropped EXE
          PID:3940
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2244
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4488
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3736

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\LP\0518\8368.tmp
              Filesize

              98KB

              MD5

              fecb4f028d5d57b4b5ecbfb32c70e1f9

              SHA1

              0166a6e719259752a262eb80434fe0afee6ede72

              SHA256

              edcefab796d415a177cdf9faabe2e695f7664b153f83147038948748d7bff387

              SHA512

              b0d28d2ed32933e4fbe769e55ca589dfa57a1bc3e1290e7ef846d03e8e05af74737575cd2f9a20c2bc55221981db6d1d41e3041987768357a305cf09d644d929

              Download Submit

            • C:\Program Files (x86)\LP\0518\8368.tmp
              Filesize

              98KB

              MD5

              fecb4f028d5d57b4b5ecbfb32c70e1f9

              SHA1

              0166a6e719259752a262eb80434fe0afee6ede72

              SHA256

              edcefab796d415a177cdf9faabe2e695f7664b153f83147038948748d7bff387

              SHA512

              b0d28d2ed32933e4fbe769e55ca589dfa57a1bc3e1290e7ef846d03e8e05af74737575cd2f9a20c2bc55221981db6d1d41e3041987768357a305cf09d644d929

              Download Submit

            • memory/1856-151-0x00000000006F4000-0x0000000000707000-memory.dmp

              Filesize

              76KB

              Download

            • memory/1856-150-0x0000000000400000-0x000000000046A000-memory.dmp

              Filesize

              424KB

              Download

            • memory/1856-149-0x00000000006F4000-0x0000000000707000-memory.dmp

              Filesize

              76KB

              Download

            • memory/3736-296-0x000001FC0C284000-0x000001FC0C287000-memory.dmp

              Filesize

              12KB

              Download

            • memory/3736-301-0x000001FC0C287000-0x000001FC0C28B000-memory.dmp

              Filesize

              16KB

              Download

            • memory/3736-309-0x000001FC0C28B000-0x000001FC0C28E000-memory.dmp

              Filesize

              12KB

              Download

            • memory/3736-310-0x000001FC0C28B000-0x000001FC0C28E000-memory.dmp

              Filesize

              12KB

              Download

            • memory/3736-308-0x000001FC0C28B000-0x000001FC0C28E000-memory.dmp

              Filesize

              12KB

              Download

            • memory/3736-303-0x000001FC0C287000-0x000001FC0C28B000-memory.dmp

              Filesize

              16KB

              Download

            • memory/3736-304-0x000001FC0C287000-0x000001FC0C28B000-memory.dmp

              Filesize

              16KB

              Download

            • memory/3736-302-0x000001FC0C287000-0x000001FC0C28B000-memory.dmp

              Filesize

              16KB

              Download

            • memory/3736-300-0x000001FC0C287000-0x000001FC0C28B000-memory.dmp

              Filesize

              16KB

              Download

            • memory/3736-297-0x000001FC0C284000-0x000001FC0C287000-memory.dmp

              Filesize

              12KB

              Download

            • memory/3736-295-0x000001FC0C284000-0x000001FC0C287000-memory.dmp

              Filesize

              12KB

              Download

            • memory/3736-294-0x000001FC0C284000-0x000001FC0C287000-memory.dmp

              Filesize

              12KB

              Download

            • memory/3736-161-0x000001FC08CC0000-0x000001FC08CE0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3736-163-0x000001FC1C280000-0x000001FC1C380000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/3736-170-0x000001FC0C180000-0x000001FC0C1A0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3736-181-0x000001FC0C080000-0x000001FC0C0A0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3736-272-0x000001FC0C080000-0x000001FC0C0A0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/3940-158-0x000000000062F000-0x000000000063B000-memory.dmp

              Filesize

              48KB

              Download

            • memory/3940-157-0x0000000000400000-0x000000000041C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/3940-156-0x000000000062F000-0x000000000063B000-memory.dmp

              Filesize

              48KB

              Download

            • memory/3940-155-0x0000000000400000-0x000000000041C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/4528-139-0x00000000004E5000-0x00000000004F8000-memory.dmp

              Filesize

              76KB

              Download

            • memory/4528-137-0x00000000004E5000-0x00000000004F8000-memory.dmp

              Filesize

              76KB

              Download

            • memory/4528-138-0x0000000000400000-0x000000000046A000-memory.dmp

              Filesize

              424KB

              Download

            • memory/4872-132-0x0000000000400000-0x000000000046A000-memory.dmp

              Filesize

              424KB

              Download

            • memory/4872-133-0x0000000000400000-0x000000000046A000-memory.dmp

              Filesize

              424KB

              Download

            • memory/4872-134-0x0000000000741000-0x0000000000754000-memory.dmp

              Filesize

              76KB

              Download