Overview

overview

10

Static

static

ca3ab4cf7f...2e.exe

windows7-x64

10

ca3ab4cf7f...2e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 04:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe

  • Size

    1.1MB

  • MD5

    922f13354a57e00020a78680d844dc0a

  • SHA1

    c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

  • SHA256

    ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

  • SHA512

    b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

  • SSDEEP

    1536:7I17SYMoQEeZ3tmnunbHq7eOHc3Hbuk93VMjBmGQSbcW+gZ372Fc0h:i4otehtmnuLqdHguq3pGz4W+g

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe
    "C:\Users\Admin\AppData\Local\Temp\ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe
      "C:\Users\Admin\AppData\Local\Temp\ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4584
        • C:\Users\Admin\E696D64614\winlogon.exe
          "C:\Users\Admin\E696D64614\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3504
          • C:\Users\Admin\E696D64614\winlogon.exe
            "C:\Users\Admin\E696D64614\winlogon.exe"
            5⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:3416
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:1480
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:3816
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4724 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:984

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        2KB

        MD5

        76e7d5bf61b2e80d159f88aa9798ce91

        SHA1

        32a46de50c9c02b068e39cf49b78c7e2d5ace20d

        SHA256

        280fd6ae3ad21323199759814c4dd82329eb8f9847ed1fa2be145e83b4c88bf3

        SHA512

        5efd8c64ac40ae006d2ce4509eb9e5f1448fb1156e914d303e8bc4dcfe1d94c57c7eae216b362877e7b644876656cc9e5c4cebfc905bab3f8b09cb1a051d69c4

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        471B

        MD5

        dedb504b3469b24ec0df79c68f5772e2

        SHA1

        177a8b1045b456316ca32d90aba942bf34774c64

        SHA256

        e18111fd56db31f02eb16990f0bbc7991a0c80571703281ee66010e229c9f8b0

        SHA512

        101312fa01991caeaef010d0d21e740244cb3768490a1b82ae12e7524e50b6e7f2e23c08978ac4c373e9013baa0a8f50de8e1994341556b78ecd88ce13df5680

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        Filesize

        1KB

        MD5

        916c512d221c683beeea9d5cb311b0b0

        SHA1

        bf0db4b1c4566275b629efb095b6ff8857b5748e

        SHA256

        64a36c1637d0a111152002a2c0385b0df9dd81b616b3f2073fbbe3f2975aa4d8

        SHA512

        af32cffea722438e9b17b08062dc2e209edc5417418964ead0b392bd502e1a647a8456b2ee2ea59faf69f93d0c6ea6f15949b6c30924db7da65b91cb18e8dc6c

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C67047FE238D580B731A13BEA5F7481F
        Filesize

        472B

        MD5

        cfbcb12817712d4f8f816c208590444a

        SHA1

        9999caeedbb1a95ae4236a5b962c233633df6799

        SHA256

        b5a41ab77d5ff4ba1a17ff074eb91bc18824d56dfc4b6c3320e900bbd6f3a90a

        SHA512

        a70eb8c366dfa0226cd62dbffbf51bd2da25571a6ff6b1f2e44dd8d9193a72f79ab7d90367378edf808ff3152ca45bf2a6ba3d64882d0f6d4aa437b6881d13f2

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        488B

        MD5

        0b35a712c06f222eaca06ce66428baf2

        SHA1

        52e947775bdec3020ce7a6fa7a88cfabc73ff964

        SHA256

        dfb60a722c4419c209f24cb131503faf2d4a52cdb787cae7bc66586c8636227c

        SHA512

        e1baadcd40193af629167def8e5636aedd92530e592bda9e8f08bc5ec1a52200e9b76508f886c69c8358dbdffc94492ff8e078fdebe0a05391af6770c94f3d4d

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        404B

        MD5

        9e6b90d88cd3ddab117c9be3ec20e6a7

        SHA1

        6dc359013e3081ed59d2a88e801788fd63d2076e

        SHA256

        d366d161f480286f442af1da33dae193fd161f42efeb374f57312d0f4ee3d933

        SHA512

        0de68f680c87661885748952702f28e99528fcbcca675bff1cc767a7dd74eddd84adc4cc5a7fe6b90c4618e71a6c446c007a8eb08ef67bbd41a86fe9539e2c62

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        Filesize

        482B

        MD5

        d052ade0f44436c171c662e56477e298

        SHA1

        c5f9e03bf0a9e479cdfcb84fc6004ce9d87bbd04

        SHA256

        7eb64a9c3742a1728beb083b3b63f17e66b2ab6c3903bbd32d116c6799023027

        SHA512

        08fabacfeb2b75690d0ad26d3f9bf27af186474369b3782318e4c0ed90d53208e6d822cb8c906ae7186d22a754a79254aad031d4ab858473ff4281570c970309

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
        Filesize

        480B

        MD5

        c80aaea5168973b466f308a6f3a09abd

        SHA1

        559fa48abe0be81554e7c39ad7014435b670be91

        SHA256

        856ec27979e9b60fa5b426ebc8a45994e10469bb93ad9c9a7ddf89353f334664

        SHA512

        c9b5388433154452f7385063822d355491d73c84246b594ec4357084d552323c1c0d34cbbae246c3ed5ebd0e937995a60b55ebb58ef1c78d3ac7b5497227106c

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C67047FE238D580B731A13BEA5F7481F
        Filesize

        480B

        MD5

        cc8a77e5a3be546de25a6bb04b2d03ff

        SHA1

        cf05872f9f322fd380afac1393ea7a74eae099c3

        SHA256

        7f1d7c00ef8ebe323c00d3b0768b1b784dad6070834c467d265e4c242b97e549

        SHA512

        7eee8a0bf2fe2ab23701b1f646ce5f2a748aaea4042eda2fcbc0fc320c7eb3388ed40ac75f76426a79279636acb88d0e50bd2a32d5172ff1f70782bb6f5e6e2b

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.1MB

        MD5

        922f13354a57e00020a78680d844dc0a

        SHA1

        c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

        SHA256

        ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

        SHA512

        b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.1MB

        MD5

        922f13354a57e00020a78680d844dc0a

        SHA1

        c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

        SHA256

        ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

        SHA512

        b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.1MB

        MD5

        922f13354a57e00020a78680d844dc0a

        SHA1

        c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

        SHA256

        ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

        SHA512

        b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.1MB

        MD5

        922f13354a57e00020a78680d844dc0a

        SHA1

        c2e6c1bdfec4593c6d30ac3cdc530be2fc6b35d6

        SHA256

        ca3ab4cf7f60dfa72f65be3539147856ec74efca1bffe786b35159072124cf2e

        SHA512

        b78f8f3bcb6202e0456efaeb379f3c39b637c74203a13278204aa20a3a9c57e77926d678bbc047af0eca3285b1397999cc7dd73739ef85d9841289b6f2a823a0

        Download Submit

      • memory/3416-156-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3416-157-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3416-153-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3416-166-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3504-151-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4964-141-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4964-136-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4964-135-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4964-133-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download