Overview

overview

10

Static

static

6bcf7bbd9d...4f.exe

windows7-x64

8

6bcf7bbd9d...4f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    190s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 14:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    6bcf7bbd9d1d8798657a7ec356278ba29f14dc500b5bb43174f46d2093fd514f.exe

  • Size

    361KB

  • MD5

    2c435eadc73018e98e1fb84789e5958e

  • SHA1

    bd13775fd8d450c00791928410456832f031c7ee

  • SHA256

    6bcf7bbd9d1d8798657a7ec356278ba29f14dc500b5bb43174f46d2093fd514f

  • SHA512

    1f4c9f79ca2ada84d6eddea2e589fa30ccce2d32ddb9be028c50004c7321c2d58dcfb40271f89894e94a4a61d321dc365c90b3056264b1a2028969a3a4588b54

  • SSDEEP

    6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
  • Executes dropped EXE 11 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bcf7bbd9d1d8798657a7ec356278ba29f14dc500b5bb43174f46d2093fd514f.exe
    "C:\Users\Admin\AppData\Local\Temp\6bcf7bbd9d1d8798657a7ec356278ba29f14dc500b5bb43174f46d2093fd514f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Temp\upnhfzxrpkhcausm.exe
      C:\Temp\upnhfzxrpkhcausm.exe run
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\upnhfzxspk.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2016
        • C:\Temp\upnhfzxspk.exe
          C:\Temp\upnhfzxspk.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4176
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:1632
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxspk.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:3420
        • C:\Temp\i_upnhfzxspk.exe
          C:\Temp\i_upnhfzxspk.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:732
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\avtnigaysq.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:3916
        • C:\Temp\avtnigaysq.exe
          C:\Temp\avtnigaysq.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2380
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4624
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3112
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_avtnigaysq.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4764
        • C:\Temp\i_avtnigaysq.exe
          C:\Temp\i_avtnigaysq.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3392
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1120 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4756
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3100

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Temp\CreateProcess.exe
          Filesize

          3KB

          MD5

          fdc588c8fb51fef8748307ca30066b2c

          SHA1

          176a53c3b7e97adae768ecefbb386ac1bab2b97c

          SHA256

          ced7b91e114a450c5088a3dac52435ed578dfb277ae42ba54e4bd3519f360bab

          SHA512

          d7df706b22befd67f8a955dab0433e8e67ced225924631b196deb756985a82325412593ea457297061107c4010afcb1822667251e5fa6e0d594484def18465df

          Download Submit

        • C:\Temp\CreateProcess.exe
          Filesize

          3KB

          MD5

          fdc588c8fb51fef8748307ca30066b2c

          SHA1

          176a53c3b7e97adae768ecefbb386ac1bab2b97c

          SHA256

          ced7b91e114a450c5088a3dac52435ed578dfb277ae42ba54e4bd3519f360bab

          SHA512

          d7df706b22befd67f8a955dab0433e8e67ced225924631b196deb756985a82325412593ea457297061107c4010afcb1822667251e5fa6e0d594484def18465df

          Download Submit

        • C:\Temp\CreateProcess.exe
          Filesize

          3KB

          MD5

          fdc588c8fb51fef8748307ca30066b2c

          SHA1

          176a53c3b7e97adae768ecefbb386ac1bab2b97c

          SHA256

          ced7b91e114a450c5088a3dac52435ed578dfb277ae42ba54e4bd3519f360bab

          SHA512

          d7df706b22befd67f8a955dab0433e8e67ced225924631b196deb756985a82325412593ea457297061107c4010afcb1822667251e5fa6e0d594484def18465df

          Download Submit

        • C:\Temp\CreateProcess.exe
          Filesize

          3KB

          MD5

          fdc588c8fb51fef8748307ca30066b2c

          SHA1

          176a53c3b7e97adae768ecefbb386ac1bab2b97c

          SHA256

          ced7b91e114a450c5088a3dac52435ed578dfb277ae42ba54e4bd3519f360bab

          SHA512

          d7df706b22befd67f8a955dab0433e8e67ced225924631b196deb756985a82325412593ea457297061107c4010afcb1822667251e5fa6e0d594484def18465df

          Download Submit

        • C:\Temp\CreateProcess.exe
          Filesize

          3KB

          MD5

          fdc588c8fb51fef8748307ca30066b2c

          SHA1

          176a53c3b7e97adae768ecefbb386ac1bab2b97c

          SHA256

          ced7b91e114a450c5088a3dac52435ed578dfb277ae42ba54e4bd3519f360bab

          SHA512

          d7df706b22befd67f8a955dab0433e8e67ced225924631b196deb756985a82325412593ea457297061107c4010afcb1822667251e5fa6e0d594484def18465df

          Download Submit

        • C:\Temp\CreateProcess.exe
          Filesize

          3KB

          MD5

          fdc588c8fb51fef8748307ca30066b2c

          SHA1

          176a53c3b7e97adae768ecefbb386ac1bab2b97c

          SHA256

          ced7b91e114a450c5088a3dac52435ed578dfb277ae42ba54e4bd3519f360bab

          SHA512

          d7df706b22befd67f8a955dab0433e8e67ced225924631b196deb756985a82325412593ea457297061107c4010afcb1822667251e5fa6e0d594484def18465df

          Download Submit

        • C:\Temp\avtnigaysq.exe
          Filesize

          361KB

          MD5

          a7a8882c9dd8619de74012361d5cc6d3

          SHA1

          da5cc0f62b5e1c69f0044189e6b5151c70120102

          SHA256

          8bfa15bcd1c5a6ba205a904d5e56b41c8aec6da66bfbec81dc39b649ca68cf99

          SHA512

          e1ba2d2d2ed7b9957d61897598f9d7160c287b632f520e67a14c6b137a5690ab144fcce0c5747ce4e20e6146c2a9eb524b855e023a21448570a515c148ccaab9

          Download Submit

        • C:\Temp\avtnigaysq.exe
          Filesize

          361KB

          MD5

          a7a8882c9dd8619de74012361d5cc6d3

          SHA1

          da5cc0f62b5e1c69f0044189e6b5151c70120102

          SHA256

          8bfa15bcd1c5a6ba205a904d5e56b41c8aec6da66bfbec81dc39b649ca68cf99

          SHA512

          e1ba2d2d2ed7b9957d61897598f9d7160c287b632f520e67a14c6b137a5690ab144fcce0c5747ce4e20e6146c2a9eb524b855e023a21448570a515c148ccaab9

          Download Submit

        • C:\Temp\i_avtnigaysq.exe
          Filesize

          361KB

          MD5

          f0d137178c8315fdc10ca61dce5ae4ec

          SHA1

          45d25f142ea4f21fbb54916c718639cc8858eca6

          SHA256

          df1821f8f201334fbc8bb3664b55b09fd10a96541e417e32df644437426940e7

          SHA512

          89964f4e3cab3ea7e5da8e2a548edccfd7f4225000f3d85811c0849a11403ae54e8c43970c3536db3f7d9abb991e406d9d4e54685ab1c3f225cc2203290a3dc2

          Download Submit

        • C:\Temp\i_avtnigaysq.exe
          Filesize

          361KB

          MD5

          f0d137178c8315fdc10ca61dce5ae4ec

          SHA1

          45d25f142ea4f21fbb54916c718639cc8858eca6

          SHA256

          df1821f8f201334fbc8bb3664b55b09fd10a96541e417e32df644437426940e7

          SHA512

          89964f4e3cab3ea7e5da8e2a548edccfd7f4225000f3d85811c0849a11403ae54e8c43970c3536db3f7d9abb991e406d9d4e54685ab1c3f225cc2203290a3dc2

          Download Submit

        • C:\Temp\i_upnhfzxspk.exe
          Filesize

          361KB

          MD5

          ef0e6eca2c441481d6555a2791c07177

          SHA1

          ae676b0ecfce9b643f247cb6ee8d324f1cface4f

          SHA256

          c9d772d3436223129e383195d91eddc47273e845b592093f0c887cf13fed02c0

          SHA512

          39a75786a8b1d6d56cc27276b88058a30d618ffba270b53509447a6c200a8f3a0b662057ebc1dbb8be0a9b421f66a01f2380b9560a5a620b624fe4ae0e909e8c

          Download Submit

        • C:\Temp\i_upnhfzxspk.exe
          Filesize

          361KB

          MD5

          ef0e6eca2c441481d6555a2791c07177

          SHA1

          ae676b0ecfce9b643f247cb6ee8d324f1cface4f

          SHA256

          c9d772d3436223129e383195d91eddc47273e845b592093f0c887cf13fed02c0

          SHA512

          39a75786a8b1d6d56cc27276b88058a30d618ffba270b53509447a6c200a8f3a0b662057ebc1dbb8be0a9b421f66a01f2380b9560a5a620b624fe4ae0e909e8c

          Download Submit

        • C:\Temp\upnhfzxrpkhcausm.exe
          Filesize

          361KB

          MD5

          8e7a2027333470fa92215a24f1680c6d

          SHA1

          fc98a55c7ae09762eb29762752c7afbbcfa2e12f

          SHA256

          069c0bc7e0d1bc0d695f9a03cb2e6b929b4c1bd8602a4ba89066caab32fb57ba

          SHA512

          616261ae091766f926195b02266bdd3b45a3c2a3aa2f4b679831622f1f197fe8863cc6e2a9e2f3d929809110408157f65c569abe5663b0a8a1228935ebd52779

          Download Submit

        • C:\Temp\upnhfzxrpkhcausm.exe
          Filesize

          361KB

          MD5

          8e7a2027333470fa92215a24f1680c6d

          SHA1

          fc98a55c7ae09762eb29762752c7afbbcfa2e12f

          SHA256

          069c0bc7e0d1bc0d695f9a03cb2e6b929b4c1bd8602a4ba89066caab32fb57ba

          SHA512

          616261ae091766f926195b02266bdd3b45a3c2a3aa2f4b679831622f1f197fe8863cc6e2a9e2f3d929809110408157f65c569abe5663b0a8a1228935ebd52779

          Download Submit

        • C:\Temp\upnhfzxspk.exe
          Filesize

          361KB

          MD5

          09c3e88ff8bb126780bcc51dd5a33540

          SHA1

          66614da8972b397fdbdd8100300c71b1c7cc9454

          SHA256

          39d3034f51c31a2e8c618560ac384c791f659cf3d438aa79c468111c85fd212b

          SHA512

          4ac6bc4c7980829075ab0321ecf4dafb80985927f4a5a79bbe26f9c3e2b5e0b7e3950bd90ecc40808fcff8c0f6788ec747e9275fc81fe0b74316e1722a2d1e47

          Download Submit

        • C:\Temp\upnhfzxspk.exe
          Filesize

          361KB

          MD5

          09c3e88ff8bb126780bcc51dd5a33540

          SHA1

          66614da8972b397fdbdd8100300c71b1c7cc9454

          SHA256

          39d3034f51c31a2e8c618560ac384c791f659cf3d438aa79c468111c85fd212b

          SHA512

          4ac6bc4c7980829075ab0321ecf4dafb80985927f4a5a79bbe26f9c3e2b5e0b7e3950bd90ecc40808fcff8c0f6788ec747e9275fc81fe0b74316e1722a2d1e47

          Download Submit

        • C:\temp\CreateProcess.exe
          Filesize

          3KB

          MD5

          fdc588c8fb51fef8748307ca30066b2c

          SHA1

          176a53c3b7e97adae768ecefbb386ac1bab2b97c

          SHA256

          ced7b91e114a450c5088a3dac52435ed578dfb277ae42ba54e4bd3519f360bab

          SHA512

          d7df706b22befd67f8a955dab0433e8e67ced225924631b196deb756985a82325412593ea457297061107c4010afcb1822667251e5fa6e0d594484def18465df

          Download Submit