Overview

overview

10

Static

static

8

7b12e4caee...1e.exe

windows7-x64

10

7b12e4caee...1e.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    192s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2022 00:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e.exe

  • Size

    722KB

  • MD5

    c006626e4fcbc675c911ba705fe60525

  • SHA1

    f8193cc8d62922eb726420ae4115e0766a1119d8

  • SHA256

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

  • SHA512

    a1d84e0c99120b749275c0140a9cc9153ef4613703197f622d500d08ee9b8eb9c0e7a1e604091ad2713cf724659647bb92edcc20ab024825452431ef6ed74476

  • SSDEEP

    1536:2fRN2/SWANOttpVxXVIXKL7mxUH1OibPoQT9lnouy8:EOAKnrq6Oxo1OcRJ9out

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 14 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e.exe
    "C:\Users\Admin\AppData\Local\Temp\7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:1624
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1376

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    64997c8f73cef58bb10a037692f448d8

    SHA1

    d53011dcd92d9e8ba2c86355f89cd45761a1ffd7

    SHA256

    36cfee3c247eedf62c7b8af3fc8a37a8d94f1d80e6bfd4fbd04d2c5ada1f245f

    SHA512

    2e68c59bb64d30f535c97e41cbeace41eb0e4b5c6b88ac29d9fa7dec2ac3e1e1594d4761a75756fbd3f0029e7a1db0005639cdf178ae47d3bac5cf9a3f08cf79

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    b0724cc54a929061744c082cda2aebdc

    SHA1

    4e1b2d25ceef4c997db463881bc914c07531c82f

    SHA256

    e95f731e06688ad4e972539673decc5a1de08e30f9ca6fa9188aa1450e477e06

    SHA512

    e2f5725eafa69d0c4ea5ae84da9a6ac69488c98e6b595b11f535f33d6f55b396e62329264eff1cef832b9d1ee8a524d327569992f6fc877e6ede21ec380ebcb1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    361be719e30c8ca802a5ecb62a27a926

    SHA1

    c0762a43cdbd9ee079d7b3f00f168475a9c4bfa9

    SHA256

    ec36919e53976a01063eb397927ee779402c0df8a1675c33c77f134f65a489f7

    SHA512

    f17f432d0bbbced09772f6f233922f73672863c66ed43890441105efc7f799d43ceee6d03e89271dba205d4ad0139cee5a27059b824cca6bbb0389ed9b6ebe31

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9f62baeb52e63495667c701ab456f8bf

    SHA1

    c5abaab1dc6a505c5be6eb1388a212ee2122ec8e

    SHA256

    94a87c84a7b5f2c7f01fdbdd497190dc21d0c3d7668391af54d2a7e6262388ab

    SHA512

    3579813571a2fd0460bb442ec5a8c7c685631ea99b8dc2c6f67610e4f65d88b0c96ef58ebf8377e366b1d44a986050ff14a0d9e60649836a8fefeccad940cfd8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a2bfdd40026ed79113013b7c30e214c8

    SHA1

    720421f6a2bedc6a40fa1fe7bf1532e6a4ec33a4

    SHA256

    80e92c3e93d5f6de83be2e8b028f0c7bcd1e5dc3154bcc90b4587932d2d928d6

    SHA512

    ebeffcb5bf8bd23657aab1ee3821bd5943fa30279bacc93078372f1353238ae3358d6c03a138cfe68a1479b867fa895e9fd30a6c827cec4682e6c32002ba3c57

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    ccf1c173c1b3c19038ca963e126ae8f4

    SHA1

    aa44358cc6383eaf13d359128c32469563026d53

    SHA256

    6f824686538ff7ecaccd523a337ba29e44f26860117ee5409fcb21af8ad53a6c

    SHA512

    ffe9a1cfe007b436ff62a8cb2c9a38f9192601f1cf74531591cc0a7b0cb79089fc90bfe48c9b434472c20b91e1a419d58a7facde840c5fc28aa2f32c3efd8556

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    88bb5d022cc3fb06eb2b21fd7f91d605

    SHA1

    780ee87d5f8b78e1c63095e8ab213a21fcfd05a8

    SHA256

    ec19606beec0697bd2479f8e368fd020b8728c9743f3a418e8d31a7d1280e2b4

    SHA512

    7b5418e090131c2f0eecd0227bd1b5e88f42d17b68265c1bfe83d86f0d5d71b2aa91b366fb4c89d6ccb98659ce1f276e99f9af5008cf63769c641d156637fe73

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    238f5a165589ccec03a7627bdb8a3a28

    SHA1

    7fbc4f81fcc884ab9220cfaf9202883e1f5717b2

    SHA256

    e068078ebe69aab60cf0e240d2d257049ce0647c0ab090be81c82d9eebaeae3f

    SHA512

    83674c270ced215facc6bbc69cdea7fca2499921a631e7ee8defdb4d313055e38bac6c15263ed4ddadf6946c174f12d82df65dfd2bb94fa265b175b979d72529

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9a064c0a50b6d5f30e440d15e0ba6637

    SHA1

    27b7d9f04f7b736cf71a4cfb97052e702c1c3508

    SHA256

    d8fe5859378411a5cf36f68dfbb6c000aee94a4751fd4a7a44eeb05d087b9718

    SHA512

    569287045b9862806b930e0352415d993860ba72d65152572752bba94310cdea4af86b5b628d31500354a8e23b10426701f0c9a66e881a55d049fbb571d5bb2f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    be1a739f6ddf7be597c2483d12b81daa

    SHA1

    5f1ad84540939cf9ca517983caff69c1a20a2d5c

    SHA256

    560d79f5c1d95c310bd3b666442d4d497510d84bf789a120ddf004bc7e27efb9

    SHA512

    2929efa94cbba7d41bcc5b7167aab33f920fa509f36d13a980ffc3063518e698300183b9c61876f18aa006049b3daecbd2e6b63cbf4cd152e21353efe45c6a25

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    fb8ea111eda4998ea1c88215c90c817a

    SHA1

    76e8f38ccec7ce01906be9f82998dc8b6df872b1

    SHA256

    98eefe8edaba4665263978573594069a9755a102da4e4dc6b4de203f72a3c8c9

    SHA512

    929334120a2de65360138d41efb7b02583b305d051466fc37ec188a5420962f42044075db594057327b3193e780f106b7e4f47447e08be78ff21ecca199801f8

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    703b5c0227ab6e40a2ec32483f695c5e

    SHA1

    a16f4abeec9556a38bd8d83b8bec156fca89d955

    SHA256

    8a4893bda11e17428c86abef45f4cca4a359153b94486ca246c99f255f004797

    SHA512

    113ecb6220c46cdbecfc9da1563c54e8ad953d205566edd9c820408a8b34dc66ed59a931dee41f681ba2fdb2119505e39945c30b95d98002b47dcfbc3588d1c0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    48303d0c29838514df046285c0a314d0

    SHA1

    7a3452eb07f8b5270939e309a6919b074a95656c

    SHA256

    59366190d9c7fbfb14b356418ab4de565a531b347df3701be601433a0fda88c3

    SHA512

    a771db80e8f921adc04b2fa4fa545204934dfb3115bff8ecfdc756320b9a0a5220505f67280bca23db8a9c4d4ece08636c1a393793fd0dd99d4808780c6a97be

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    ce309c4940eaf41196c969e588766fba

    SHA1

    255f308dbd50e9e821c6c8a8fbef24e3f5b80fd1

    SHA256

    d4be225103ecef7030bbdfb88f4f965fd2606f237b7e81df6d2d9de207aa1a07

    SHA512

    faa918c60656a26479e721fc4533bcca941661026e363b0a6ad4c988291eda5cea980eb50be4c371c0b4332352b38e742a0e2cce53ae427375a38849ed972e98

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    6acf21a31b714beddb9b6de5a8f26ec7

    SHA1

    63068970eda501aafbfad721b6f7d7f1ace50933

    SHA256

    ed2dfc9248978a0ad599fc17bf2d92df9e599a199bb714558a1eee9f799faf04

    SHA512

    66dcd59406e67cd8af36aaaacb488e46c0b7b08088508ebed7223f5232c1751859c19a1ec77ec49f365a1def75e3ec644db6a307a43bdbf5ad9ad3a0202abd3c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    48e9f6df2c3dc0e3484afe0f6bce6606

    SHA1

    35e90ce4e50a15b7a5896895d73135bfdaf95f58

    SHA256

    c8ebe544d3530f2a4c14770fb52a47130e5a9e36408502f92fab338b30d18d00

    SHA512

    f6023209d1d2e756f66980d5b8210d8a561ab944e10ad48ec1f8f17536af57fa5afebbd88a829ff835d926f749d8dee55c5f421e1b0545dd50f1134e856f862b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    244d8c6391214d9f3f8556234828189f

    SHA1

    1ce01fba22683336f35c37e7a7970dd6af58adc6

    SHA256

    c07a834f760f6df49fa17f5955f6c2e583a3e8ae00a4a410032ee335c864e3b0

    SHA512

    81077f036142db0f1a903dc7187e0047d17cce654f54bad50b6074ecb66a371a502c040c9dd1593ef928e4db2623b8c0a9853bb2dda202c06876082292008df4

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    722KB

    MD5

    c006626e4fcbc675c911ba705fe60525

    SHA1

    f8193cc8d62922eb726420ae4115e0766a1119d8

    SHA256

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

    SHA512

    a1d84e0c99120b749275c0140a9cc9153ef4613703197f622d500d08ee9b8eb9c0e7a1e604091ad2713cf724659647bb92edcc20ab024825452431ef6ed74476

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    722KB

    MD5

    c006626e4fcbc675c911ba705fe60525

    SHA1

    f8193cc8d62922eb726420ae4115e0766a1119d8

    SHA256

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

    SHA512

    a1d84e0c99120b749275c0140a9cc9153ef4613703197f622d500d08ee9b8eb9c0e7a1e604091ad2713cf724659647bb92edcc20ab024825452431ef6ed74476

    Download Submit

  • C:\Users\Admin\E696D64614\winlogon.exe
    Filesize

    722KB

    MD5

    c006626e4fcbc675c911ba705fe60525

    SHA1

    f8193cc8d62922eb726420ae4115e0766a1119d8

    SHA256

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

    SHA512

    a1d84e0c99120b749275c0140a9cc9153ef4613703197f622d500d08ee9b8eb9c0e7a1e604091ad2713cf724659647bb92edcc20ab024825452431ef6ed74476

    Download Submit

  • \Users\Admin\E696D64614\winlogon.exe
    Filesize

    722KB

    MD5

    c006626e4fcbc675c911ba705fe60525

    SHA1

    f8193cc8d62922eb726420ae4115e0766a1119d8

    SHA256

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

    SHA512

    a1d84e0c99120b749275c0140a9cc9153ef4613703197f622d500d08ee9b8eb9c0e7a1e604091ad2713cf724659647bb92edcc20ab024825452431ef6ed74476

    Download Submit

  • \Users\Admin\E696D64614\winlogon.exe
    Filesize

    722KB

    MD5

    c006626e4fcbc675c911ba705fe60525

    SHA1

    f8193cc8d62922eb726420ae4115e0766a1119d8

    SHA256

    7b12e4caee4c81cb99fe95a1efb22d0cf25f4301c9c500207844ba5c0c88f81e

    SHA512

    a1d84e0c99120b749275c0140a9cc9153ef4613703197f622d500d08ee9b8eb9c0e7a1e604091ad2713cf724659647bb92edcc20ab024825452431ef6ed74476

    Download Submit

  • memory/1236-57-0x0000000075991000-0x0000000075993000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1236-54-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/1236-62-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download

  • memory/1624-69-0x000000000043C540-mapping.dmp

    Download

  • memory/1624-68-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1624-77-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1624-73-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/1624-72-0x0000000000400000-0x000000000043F000-memory.dmp

    Filesize

    252KB

    Download

  • memory/2028-60-0x0000000000000000-mapping.dmp

    Download

  • memory/2028-67-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

    Download