Analysis

  • max time kernel
    116s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 20:20

General

  • Target

    633dc1aac7fa6b61805d8cf2092171e0779aa9a47657537570375b70fec92930.exe

  • Size

    1.4MB

  • MD5

    f7577a6fc9c05c81dc2576c932453742

  • SHA1

    30f1189f61008f6bff2878e23732aeac0151a84e

  • SHA256

    633dc1aac7fa6b61805d8cf2092171e0779aa9a47657537570375b70fec92930

  • SHA512

    fedc847fd044058ee6306831f05889e78722ea5a7b6cc9519133c920080b16d1822f47690ad3a4f4e07bf0b6dc3957f5641dd769883a6b92ddff22e1e1e1c4df

  • SSDEEP

    24576:xIfXENOIcLm+dJ690iSmX0mgV9U6Sq53PHnpb0Es5zUsXkS9S7spu:xIf0NOIcLddZzrmwUK53Pnpb0H5pRAsg

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Installs/modifies Browser Helper Object 2 TTPs 14 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\633dc1aac7fa6b61805d8cf2092171e0779aa9a47657537570375b70fec92930.exe
    "C:\Users\Admin\AppData\Local\Temp\633dc1aac7fa6b61805d8cf2092171e0779aa9a47657537570375b70fec92930.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1324
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "Office" /f
      2⤵
        PID:1160
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\SysWOW64\schtasks.exe" /Create /TR "\"C:\Program Files (x86)\Office\Office.exe\"" /SC DAILY /TN "Office" /ST 12:06:00 /du 0024:00 /RI 360 /RL HIGHEST /f
        2⤵
        • Creates scheduled task(s)
        PID:580
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "9A5A8340-6B15" /f
        2⤵
          PID:588
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /Create /TR "\"C:\Users\Admin\AppData\Roaming\ARHome\Updater.exe\"" /SC ONIDLE /TN "9A5A8340-6B15" /I 1 /RL HIGHEST /f
          2⤵
          • Creates scheduled task(s)
          PID:1752
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /Create /TN "Java Update" /TR "\"C:\Program Files (x86)\Java\Java.exe\"" /SC ONSTART /DELAY 0005:00 /RL HIGHEST /f
          2⤵
          • Creates scheduled task(s)
          PID:812
        • C:\Windows\SysWOW64\cscript.exe
          "C:\Windows\System32\cscript.exe" C:\Users\Admin\AppData\Local\IHH5rI.vbs
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:828
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dll"
            3⤵
            • Loads dropped DLL
            • Installs/modifies Browser Helper Object
            • Modifies registry class
            PID:1320
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"
            3⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2036
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll"
              4⤵
              • Registers COM server for autorun
              • Loads dropped DLL
              • Installs/modifies Browser Helper Object
              • Modifies registry class
              PID:2004
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://www.acdcads.com/aff/thanks/updater-thanks.php?t=1386580451&wti=1000&s=1000&sta=1&av=None
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:112
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:112 CREDAT:275457 /prefetch:2
            3⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:952
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "mium0d" /f
          2⤵
            PID:836
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /Create /TR "\"C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe\"" /SC ONLOGON /TN "mium0d" /RL HIGHEST /f
            2⤵
            • Creates scheduled task(s)
            PID:780
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\SysWOW64\schtasks.exe" /Delete /tn "keepup" /f
            2⤵
              PID:1616
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\SysWOW64\schtasks.exe" /Create /TR "\"C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe\"" /SC DAILY /TN "keepup" /ST 20:43:00 /du 0024:00 /RI 10 /RL HIGHEST /f
              2⤵
              • Creates scheduled task(s)
              PID:572
            • C:\Windows\SysWOW64\cscript.exe
              "C:\Windows\System32\cscript.exe" C:\Users\Admin\AppData\Local\IHH5rI.vbs
              2⤵
              • Deletes itself
              PID:520
          • C:\Windows\system32\taskeng.exe
            taskeng.exe {43BCF9AC-7146-4D37-99F5-12E793534C1C} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
            1⤵
              PID:1800
              • C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe
                C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe
                2⤵
                • Executes dropped EXE
                PID:1876

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Execution

            Scheduled Task

            1
            T1053

            Persistence

            Registry Run Keys / Startup Folder

            1
            T1060

            Browser Extensions

            1
            T1176

            Scheduled Task

            1
            T1053

            Privilege Escalation

            Scheduled Task

            1
            T1053

            Defense Evasion

            Modify Registry

            3
            T1112

            Credential Access

            Credentials in Files

            1
            T1081

            Discovery

            System Information Discovery

            1
            T1082

            Collection

            Data from Local System

            1
            T1005

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\IHH5rI.vbs
              Filesize

              520B

              MD5

              f84de64817e033afc93090402498fe10

              SHA1

              0cbde725a7650151ed3b2b16f3f24a4e3e1e1968

              SHA256

              20b22d2c137fea3d52aab3b3bd5c4271c6d018d15cbb00367469407467e58a2f

              SHA512

              1bb87ff8e90f428158083b72f255bc129a00221a3e0bdcd29c7e2912c4f2d37a3e4ff7c1ed6a2d6438d7ccf7623e970a170a57b329770ad37ae409816f380ffb

            • C:\Users\Admin\AppData\Local\IHH5rI.vbs
              Filesize

              450B

              MD5

              dbccbed3050cdf2b8bef806ffdb9813b

              SHA1

              a113e7d1072abad94c36a11fef6b2b0b28845ae9

              SHA256

              815a193f97f5056dac1f992eafbf0d6b37081f14c53bb9686693522401263742

              SHA512

              baa3a529f3bf0903c0c57e871cf35e5d390c480bc566fc3909381f39c3ace658f4f2281d6ef224eedf7d1b7bdf89c8df0f2f447aadf6a55de2fd4bf5b49200fc

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4PEUH1PT.txt
              Filesize

              608B

              MD5

              07f0678db5b08120c76efd2413eb7328

              SHA1

              e72f0b061f4a8af7b64e3d7f10eca53d31e5ef91

              SHA256

              7fdd9c3a6823a17dde8cb29a4af7dc79779acc10d9eb71653c5e927aa0c34eef

              SHA512

              eaadb53883331829ed078b61cf15d426a45996fd7aaefedfb60c1d449b5671c9c0a72197bcae21beb26859b16c9562658d5986d633ab64534b46c4c4448f7539

            • C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dll
              Filesize

              182KB

              MD5

              ce31a05ee7c72fea9ea74dcc1a16e8d6

              SHA1

              e524c0f68b735138174137a034f5b5f7878917fb

              SHA256

              1a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f

              SHA512

              a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3

            • C:\Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll
              Filesize

              218KB

              MD5

              50d22dadb851a45d0594f23b23b9bc13

              SHA1

              2e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6

              SHA256

              a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b

              SHA512

              90f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e

            • C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe
              Filesize

              80KB

              MD5

              5afc57e409e859d48ebac2540a8e3460

              SHA1

              a260a5af72eb1f4982987abbc7aef26d604f1edb

              SHA256

              98e29511436dd9ec883eaec999d89bf86041fa2d8dddd922c00790ff920895ff

              SHA512

              207ad8eab68e88b9a20af44aa8cab7f350fe4a81d988cdac01984b0db5ff9a8a5a9e476f682f76637d236ef9b9ce6207d0ea3bfe6bbb4098a36f4a91f093ab53

            • C:\Users\Admin\AppData\Roaming\miaul\RJFC.exe
              Filesize

              80KB

              MD5

              5afc57e409e859d48ebac2540a8e3460

              SHA1

              a260a5af72eb1f4982987abbc7aef26d604f1edb

              SHA256

              98e29511436dd9ec883eaec999d89bf86041fa2d8dddd922c00790ff920895ff

              SHA512

              207ad8eab68e88b9a20af44aa8cab7f350fe4a81d988cdac01984b0db5ff9a8a5a9e476f682f76637d236ef9b9ce6207d0ea3bfe6bbb4098a36f4a91f093ab53

            • \Users\Admin\AppData\Roaming\VolIE\FoxPro_32.dll
              Filesize

              182KB

              MD5

              ce31a05ee7c72fea9ea74dcc1a16e8d6

              SHA1

              e524c0f68b735138174137a034f5b5f7878917fb

              SHA256

              1a66dab0e452c64fca4ae8f976c8fd4b790926d246db9de88c95453c7cda255f

              SHA512

              a285766e17888135ba468a69bf460fc03b2fa5fdf64d479e6767e653abe5366dfd5d9ac319f39413559a1e496db18219c8f10fa22dc49fe0fd391c1c82b146c3

            • \Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll
              Filesize

              218KB

              MD5

              50d22dadb851a45d0594f23b23b9bc13

              SHA1

              2e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6

              SHA256

              a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b

              SHA512

              90f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e

            • \Users\Admin\AppData\Roaming\VolIE\FoxPro_64.dll
              Filesize

              218KB

              MD5

              50d22dadb851a45d0594f23b23b9bc13

              SHA1

              2e042aed9b0aa3adc3c9e5b9728f6e8ee0c5d2a6

              SHA256

              a742c4aa880a36eac02e3cb2a3d07f0edc5a9f7c94c7c53e88264ec16594a07b

              SHA512

              90f2af018d03db1c9aa17f7fa98b4aa9d39c5a8de4433ab4e305a2212fa53581630c5d39061d22dabb73fe4b848a0d0973357521655b19c700ada574cc71242e

            • memory/520-81-0x0000000000000000-mapping.dmp
            • memory/572-80-0x0000000000000000-mapping.dmp
            • memory/580-59-0x0000000000000000-mapping.dmp
            • memory/588-60-0x0000000000000000-mapping.dmp
            • memory/780-78-0x0000000000000000-mapping.dmp
            • memory/812-62-0x0000000000000000-mapping.dmp
            • memory/828-63-0x0000000000000000-mapping.dmp
            • memory/836-77-0x0000000000000000-mapping.dmp
            • memory/1160-57-0x0000000000000000-mapping.dmp
            • memory/1320-66-0x0000000000000000-mapping.dmp
            • memory/1324-54-0x00000000752B1000-0x00000000752B3000-memory.dmp
              Filesize

              8KB

            • memory/1324-84-0x00000000008B0000-0x0000000001B73000-memory.dmp
              Filesize

              18.8MB

            • memory/1324-58-0x00000000008B0000-0x0000000001B73000-memory.dmp
              Filesize

              18.8MB

            • memory/1324-55-0x00000000008B0000-0x0000000001B73000-memory.dmp
              Filesize

              18.8MB

            • memory/1616-79-0x0000000000000000-mapping.dmp
            • memory/1752-61-0x0000000000000000-mapping.dmp
            • memory/1876-87-0x0000000000000000-mapping.dmp
            • memory/2004-74-0x0000000000000000-mapping.dmp
            • memory/2004-75-0x000007FEFB781000-0x000007FEFB783000-memory.dmp
              Filesize

              8KB

            • memory/2036-67-0x0000000000000000-mapping.dmp