Overview

overview

10

Static

static

7e80ae6776...2b.exe

windows7-x64

10

7e80ae6776...2b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 22:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe

  • Size

    1.4MB

  • MD5

    b8c5b7f562d837062717c906a2a67df1

  • SHA1

    2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

  • SHA256

    7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

  • SHA512

    038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

  • SSDEEP

    1536:GCxE8JHTdoQkO6xvJXzT0YpMgbQoToPQTiwHz7pj5omc4JyBMA6:GuxBoJOMXzAMrTuw8aMBe

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 25 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
    "C:\Users\Admin\AppData\Local\Temp\7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Users\Admin\AppData\Local\Temp\7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
      C:\Users\Admin\AppData\Local\Temp\7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3592
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Users\Admin\E696D64614\winlogon.exe
          C:\Users\Admin\E696D64614\winlogon.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4188
          • C:\Users\Admin\E696D64614\winlogon.exe
            "C:\Users\Admin\E696D64614\winlogon.exe"
            5⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:3700
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4560
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:376
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3836

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2119239CBE0D3DBEF6F19E0B10265873
        Filesize

        472B

        MD5

        f1dacaaa678dfa6d22420a8b46047d44

        SHA1

        8b80f47f01cc0714a47ff3d734b6bce89756ec26

        SHA256

        6533e522fdc5ac5af0079b6c4599cee64810a54671c9e4c49f8a79597b57926e

        SHA512

        34682d276393fe8c92c96fd8d0e61fd05aced08f6a10278da01fb1294177a8021021ad9c409e56381976f80ba99922c6aacde19084df2fcfff29fbd28108a1f3

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3538626A1FCCCA43C7E18F220BDD9B02
        Filesize

        978B

        MD5

        891fd9533297417ff20e96a1134e050e

        SHA1

        41ff9bcd5072f105156e57b556ed3a394c6b5149

        SHA256

        28c27f5683642712dc35967e8c19adb9174f56f284a7ae82b8d8724f59f4a1e3

        SHA512

        81d54d2d4a6c1178af3611ca840f3c2d37d5a08df631250b12d8534ae14c13c0ab61e7197503805cc45f7dffe82e3019836aa1fe7917f2c7ec5c48bd2997499c

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        471B

        MD5

        0ff2da8bfc83bec6bce38ba6a3f7bf58

        SHA1

        84c37df7bed08d69f040c289676735c49a9564eb

        SHA256

        91026f24711c435d99a44884c7239ed1265cd17c0259a6c5885f69e4309421ea

        SHA512

        78afdc44d7557b2f14444182085252e8456c91289511d6f2abfd1d7273d05baba9a94206d370add716b9fc30dc326a1a2e1c78f642e926759d962cf216c3a489

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2119239CBE0D3DBEF6F19E0B10265873
        Filesize

        476B

        MD5

        948c01674505a5f4a508dac949956b76

        SHA1

        d6da7fba095d00ba47de730656134cafc132caf4

        SHA256

        c557b9fd5d2c8c534412e299ddee16e12a08878e70fd1a4d5a340c0b42acfa10

        SHA512

        bad323a0f22f33f9ee702e82008c5a91307b4783175f7e82e35d11bbc8cda7f3d36ac092ab94d7ffb18216aca6a00a26cb4ca741c8100d32ac6f6eba75d88482

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3538626A1FCCCA43C7E18F220BDD9B02
        Filesize

        274B

        MD5

        4bdbdb6140c04f20203c0994ca3ee4e5

        SHA1

        d3dbd1c92f0a616e991c4421a7e0715d7f3ac59c

        SHA256

        214fad378e22b3fc141f10ec1ced7e02ede10e4f05b76abb2b98c57e80f28747

        SHA512

        cbd098e65786c6c4b4c900fc1e4cbd720b4dd3ea6141ce9ae9ea95ad59fbd5b182520eccf0037ff205b7f66d72d1d8564b9d829441c22d15db6fdb693731a653

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        404B

        MD5

        e51c45de8d078d47f2bf9c91fbd26dce

        SHA1

        d3d6903693a2791fd10076f97ffbe91732b61cf1

        SHA256

        2a4247fd410abed04501bf170fc1e4e3fa38897074994c54aae9e30b4922d3dc

        SHA512

        68423a47ebc64920f9a7c72dbc741cf4f340c8d00cab193e701615e3a4de304656607b5bb75d983dfef29ccb4204c92a4bd5c6b45f02ea8632a27431859f8cc4

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        404B

        MD5

        e51c45de8d078d47f2bf9c91fbd26dce

        SHA1

        d3d6903693a2791fd10076f97ffbe91732b61cf1

        SHA256

        2a4247fd410abed04501bf170fc1e4e3fa38897074994c54aae9e30b4922d3dc

        SHA512

        68423a47ebc64920f9a7c72dbc741cf4f340c8d00cab193e701615e3a4de304656607b5bb75d983dfef29ccb4204c92a4bd5c6b45f02ea8632a27431859f8cc4

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.4MB

        MD5

        b8c5b7f562d837062717c906a2a67df1

        SHA1

        2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

        SHA256

        7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

        SHA512

        038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.4MB

        MD5

        b8c5b7f562d837062717c906a2a67df1

        SHA1

        2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

        SHA256

        7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

        SHA512

        038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.4MB

        MD5

        b8c5b7f562d837062717c906a2a67df1

        SHA1

        2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

        SHA256

        7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

        SHA512

        038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        1.4MB

        MD5

        b8c5b7f562d837062717c906a2a67df1

        SHA1

        2c8f6f58cd1d65f6c0e230929bfe64a32c5db40c

        SHA256

        7e80ae67760877654eb878b2362fff1641dc94f68bfc40c31e4cf9b6ba63242b

        SHA512

        038a5ea19f196c048d268d628458c9e9172fa3b91d90a97639916549a3f8515312dc119cfbac45ffe107c26bb85683ec9eaa10b711b567c917dc4327c944a814

        Download Submit

      • memory/3592-146-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/3592-133-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/3592-135-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/3592-136-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/3700-165-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3700-160-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3700-153-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3700-157-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3700-156-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/4188-151-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download