Overview

overview

10

Static

static

a9cd6345e1...cd.exe

windows7-x64

10

a9cd6345e1...cd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-12-2022 18:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd.exe

  • Size

    299KB

  • MD5

    b0513be631c63d289e12ca35c60988d8

  • SHA1

    39fa87d51b9253212c8df411f57df3280d1def81

  • SHA256

    a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd

  • SHA512

    95807e3cbd4bfb5ef8d4b2f4ec874d811675c192adadf4308ba415be9b64b627bd71cea8ddfa2e186fca259bac2eb6ad8454c606b219db9c757cffc225384630

  • SSDEEP

    1536:7ws+Dd8oVCTSzQHhn0lIF2rX2OKvQ4m6OXHGvA3D0FsBRyBYOKG0Ph:8ZCoaSzQB0iiaSvTyCRy+4

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd.exe
    "C:\Users\Admin\AppData\Local\Temp\a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Users\Admin\AppData\Local\Temp\a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd.exe
      "C:\Users\Admin\AppData\Local\Temp\a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Users\Admin\E696D64614\winlogon.exe
          "C:\Users\Admin\E696D64614\winlogon.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1104
          • C:\Users\Admin\E696D64614\winlogon.exe
            "C:\Users\Admin\E696D64614\winlogon.exe"
            5⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:2728
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:3464
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:4208
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4648
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4648 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1816

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        2KB

        MD5

        97acf0930ce9f2f69d40ed8e1178cec6

        SHA1

        6380a2d97e4b4ccc3b4598cc2d431702e54ed69c

        SHA256

        b38f02de41dbb7db433a5f440dff85432150ff71d53b7ef8792d96da80962343

        SHA512

        f49c8a4fa51127e7d8b71cd0257bbedc8855ea708ec0e313e5071b656aedb815b55e51619df24ed967c4df0e685a4940cc1f123aa4ee0198a3d1ada1b42480e1

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2119239CBE0D3DBEF6F19E0B10265873
        Filesize

        472B

        MD5

        f1dacaaa678dfa6d22420a8b46047d44

        SHA1

        8b80f47f01cc0714a47ff3d734b6bce89756ec26

        SHA256

        6533e522fdc5ac5af0079b6c4599cee64810a54671c9e4c49f8a79597b57926e

        SHA512

        34682d276393fe8c92c96fd8d0e61fd05aced08f6a10278da01fb1294177a8021021ad9c409e56381976f80ba99922c6aacde19084df2fcfff29fbd28108a1f3

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        488B

        MD5

        80e6828f7831d30357d59f9556f4ca5e

        SHA1

        0a42c8f84da14496770c0f9d18e27447c0342ef4

        SHA256

        dd71f2e9ff852462ff2f463b5ef4a03de4477d11cb69dd71b05cb7e0c8da1aa7

        SHA512

        47988af44cbec0bf4cf4a811025eddd43170e2db553d86944f784ee9ff846e9802cc035b9dc43c00bfdd7f8ffde3cdfb906bc3775e78b08080062e3b9da68f99

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2119239CBE0D3DBEF6F19E0B10265873
        Filesize

        476B

        MD5

        ec12b22a5cba29742be0209202deb6ba

        SHA1

        0f2b195dc4c5a220c6fe0c439bdefaf6424404d7

        SHA256

        b870cfffd0f9cf52fc9a40b98d767668c7086b343039701fbb57a7bac16c0584

        SHA512

        1284fbfcdbbabfe3ee0a0f6c8e05331441d2c0becd0e9b06188d8e1fbb278e2b615a4836954a31dd27c8eed8dd0e7342a405776aea6bb4d4acea45b2a19783e4

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        299KB

        MD5

        b0513be631c63d289e12ca35c60988d8

        SHA1

        39fa87d51b9253212c8df411f57df3280d1def81

        SHA256

        a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd

        SHA512

        95807e3cbd4bfb5ef8d4b2f4ec874d811675c192adadf4308ba415be9b64b627bd71cea8ddfa2e186fca259bac2eb6ad8454c606b219db9c757cffc225384630

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        299KB

        MD5

        b0513be631c63d289e12ca35c60988d8

        SHA1

        39fa87d51b9253212c8df411f57df3280d1def81

        SHA256

        a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd

        SHA512

        95807e3cbd4bfb5ef8d4b2f4ec874d811675c192adadf4308ba415be9b64b627bd71cea8ddfa2e186fca259bac2eb6ad8454c606b219db9c757cffc225384630

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        299KB

        MD5

        b0513be631c63d289e12ca35c60988d8

        SHA1

        39fa87d51b9253212c8df411f57df3280d1def81

        SHA256

        a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd

        SHA512

        95807e3cbd4bfb5ef8d4b2f4ec874d811675c192adadf4308ba415be9b64b627bd71cea8ddfa2e186fca259bac2eb6ad8454c606b219db9c757cffc225384630

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        299KB

        MD5

        b0513be631c63d289e12ca35c60988d8

        SHA1

        39fa87d51b9253212c8df411f57df3280d1def81

        SHA256

        a9cd6345e1614b725e6f080ccec259d8b67c8508391318dadbba921c987927cd

        SHA512

        95807e3cbd4bfb5ef8d4b2f4ec874d811675c192adadf4308ba415be9b64b627bd71cea8ddfa2e186fca259bac2eb6ad8454c606b219db9c757cffc225384630

        Download Submit

      • memory/1104-152-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1104-166-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1104-143-0x0000000000000000-mapping.dmp

        Download

      • memory/1484-139-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1484-145-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1484-136-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1484-135-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1484-133-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1484-132-0x0000000000000000-mapping.dmp

        Download

      • memory/1760-140-0x0000000000000000-mapping.dmp

        Download

      • memory/2728-153-0x0000000000000000-mapping.dmp

        Download

      • memory/2728-154-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/2728-157-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/2728-158-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/2728-165-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/2728-167-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download