Overview

overview

10

Static

static

5fc8962c2a...d8.exe

windows7-x64

8

5fc8962c2a...d8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 21:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5fc8962c2a61a54403dbbbd6131582274b7a9c0d8f686793ff51b464915f0cd8.exe

  • Size

    361KB

  • MD5

    1640a7c4f4fa54a78bba9065695e5a13

  • SHA1

    c0982cd9dcce37ed3cf2249b3596dbad56104421

  • SHA256

    5fc8962c2a61a54403dbbbd6131582274b7a9c0d8f686793ff51b464915f0cd8

  • SHA512

    3ac8cdb5ca891e6fd783fe389aca3cb515cbdc10baab1d7fc17b5fabf05e956ed6f55acfc58fb383ef16c0f7fa707f2ede1e9a92a5e0fc1ed94ffac1556f012a

  • SSDEEP

    6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Executes dropped EXE 10 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5fc8962c2a61a54403dbbbd6131582274b7a9c0d8f686793ff51b464915f0cd8.exe
    "C:\Users\Admin\AppData\Local\Temp\5fc8962c2a61a54403dbbbd6131582274b7a9c0d8f686793ff51b464915f0cd8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Temp\pmhfzxrmkecwupmh.exe
      C:\Temp\pmhfzxrmkecwupmh.exe run
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4928
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\hfzxspkhca.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1076
        • C:\Temp\hfzxspkhca.exe
          C:\Temp\hfzxspkhca.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4076
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4744
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4176
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_hfzxspkhca.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:1448
        • C:\Temp\i_hfzxspkhca.exe
          C:\Temp\i_hfzxspkhca.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3000
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\dxvqnigays.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:1212
        • C:\Temp\dxvqnigays.exe
          C:\Temp\dxvqnigays.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4236
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:3460
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_dxvqnigays.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4100
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3808
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3808 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        PID:2188
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4456

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    906fb7b030d2cb00bd1a9abaaf2c5bcc

    SHA1

    77de6c9d235c6425a727b2f483b9f15aa2a98cab

    SHA256

    2c3232adb6cad3c150e66ab9886f2dca1da5f95d059e7c10e3355cdf7eece004

    SHA512

    f2d9a0cf0c07276d7abeb53069d7e0cbeb4ff0b0d379a74fdf0667d2bbddd4e594f832952564534132ceb60c8bbb857ef080f471125ca4526fb7a428ee8b9bbf

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    906fb7b030d2cb00bd1a9abaaf2c5bcc

    SHA1

    77de6c9d235c6425a727b2f483b9f15aa2a98cab

    SHA256

    2c3232adb6cad3c150e66ab9886f2dca1da5f95d059e7c10e3355cdf7eece004

    SHA512

    f2d9a0cf0c07276d7abeb53069d7e0cbeb4ff0b0d379a74fdf0667d2bbddd4e594f832952564534132ceb60c8bbb857ef080f471125ca4526fb7a428ee8b9bbf

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    906fb7b030d2cb00bd1a9abaaf2c5bcc

    SHA1

    77de6c9d235c6425a727b2f483b9f15aa2a98cab

    SHA256

    2c3232adb6cad3c150e66ab9886f2dca1da5f95d059e7c10e3355cdf7eece004

    SHA512

    f2d9a0cf0c07276d7abeb53069d7e0cbeb4ff0b0d379a74fdf0667d2bbddd4e594f832952564534132ceb60c8bbb857ef080f471125ca4526fb7a428ee8b9bbf

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    906fb7b030d2cb00bd1a9abaaf2c5bcc

    SHA1

    77de6c9d235c6425a727b2f483b9f15aa2a98cab

    SHA256

    2c3232adb6cad3c150e66ab9886f2dca1da5f95d059e7c10e3355cdf7eece004

    SHA512

    f2d9a0cf0c07276d7abeb53069d7e0cbeb4ff0b0d379a74fdf0667d2bbddd4e594f832952564534132ceb60c8bbb857ef080f471125ca4526fb7a428ee8b9bbf

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    906fb7b030d2cb00bd1a9abaaf2c5bcc

    SHA1

    77de6c9d235c6425a727b2f483b9f15aa2a98cab

    SHA256

    2c3232adb6cad3c150e66ab9886f2dca1da5f95d059e7c10e3355cdf7eece004

    SHA512

    f2d9a0cf0c07276d7abeb53069d7e0cbeb4ff0b0d379a74fdf0667d2bbddd4e594f832952564534132ceb60c8bbb857ef080f471125ca4526fb7a428ee8b9bbf

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    906fb7b030d2cb00bd1a9abaaf2c5bcc

    SHA1

    77de6c9d235c6425a727b2f483b9f15aa2a98cab

    SHA256

    2c3232adb6cad3c150e66ab9886f2dca1da5f95d059e7c10e3355cdf7eece004

    SHA512

    f2d9a0cf0c07276d7abeb53069d7e0cbeb4ff0b0d379a74fdf0667d2bbddd4e594f832952564534132ceb60c8bbb857ef080f471125ca4526fb7a428ee8b9bbf

    Download Submit

  • C:\Temp\dxvqnigays.exe
    Filesize

    361KB

    MD5

    070634a0946eef553adb1dff1d20e08e

    SHA1

    e85f59dbe60ad9b5f22f6d47df5aee344fcff58c

    SHA256

    9772c78ade8908c0501f62813b1d973bfb335f44158475e11bc164caeb4e28b6

    SHA512

    7ce61fd4aa8e9575b1524e9723bf3165a93a7d39c9ff864a2617fc7c95187d7c4b1d063117d7713be9dcee32f61521d65cad6983c514437b317883d0b6bef111

    Download Submit

  • C:\Temp\dxvqnigays.exe
    Filesize

    361KB

    MD5

    070634a0946eef553adb1dff1d20e08e

    SHA1

    e85f59dbe60ad9b5f22f6d47df5aee344fcff58c

    SHA256

    9772c78ade8908c0501f62813b1d973bfb335f44158475e11bc164caeb4e28b6

    SHA512

    7ce61fd4aa8e9575b1524e9723bf3165a93a7d39c9ff864a2617fc7c95187d7c4b1d063117d7713be9dcee32f61521d65cad6983c514437b317883d0b6bef111

    Download Submit

  • C:\Temp\hfzxspkhca.exe
    Filesize

    361KB

    MD5

    7dad229f6089874e01c2a8f2ba49e38f

    SHA1

    74ec55bec0e7cef09fd6f48440786d6d2d1e326f

    SHA256

    1ef2fb692197655154e9d8d9bbc191856cc768c34d2faa62bd23e46bc9f581b8

    SHA512

    f5751efc837765322a7a70e64de2b099b5603e8f23d33a6ff2f7042009de326355740126a6f6cfaeb6b684686561db0f8cb4b1a3bf01955477af7a7d773b8a7d

    Download Submit

  • C:\Temp\hfzxspkhca.exe
    Filesize

    361KB

    MD5

    7dad229f6089874e01c2a8f2ba49e38f

    SHA1

    74ec55bec0e7cef09fd6f48440786d6d2d1e326f

    SHA256

    1ef2fb692197655154e9d8d9bbc191856cc768c34d2faa62bd23e46bc9f581b8

    SHA512

    f5751efc837765322a7a70e64de2b099b5603e8f23d33a6ff2f7042009de326355740126a6f6cfaeb6b684686561db0f8cb4b1a3bf01955477af7a7d773b8a7d

    Download Submit

  • C:\Temp\i_hfzxspkhca.exe
    Filesize

    361KB

    MD5

    854844a4cee36f637c364461e6ecf289

    SHA1

    5ba2d51c7e4335e700875d655f6152447fb76645

    SHA256

    160c295d2ce8d1b966e1de61691aada53dbc558e156a9e5cbf856cee727e3bf6

    SHA512

    7043bca0ffbb3360c4a49175cdf51c1dfeb8997d9ce016e08621acf998344e0a0d8c5a203914fe44c3ec8eb293130af8fd0a4fe5b9b634c82da9ad1bffe77db7

    Download Submit

  • C:\Temp\i_hfzxspkhca.exe
    Filesize

    361KB

    MD5

    854844a4cee36f637c364461e6ecf289

    SHA1

    5ba2d51c7e4335e700875d655f6152447fb76645

    SHA256

    160c295d2ce8d1b966e1de61691aada53dbc558e156a9e5cbf856cee727e3bf6

    SHA512

    7043bca0ffbb3360c4a49175cdf51c1dfeb8997d9ce016e08621acf998344e0a0d8c5a203914fe44c3ec8eb293130af8fd0a4fe5b9b634c82da9ad1bffe77db7

    Download Submit

  • C:\Temp\pmhfzxrmkecwupmh.exe
    Filesize

    361KB

    MD5

    12c7e372291a175825e144137a3e8cde

    SHA1

    00aa51822fdb20a31b24f037b19e91e93fc49ae4

    SHA256

    b1511406c9b52daa57ff88027b8d0ccb5d055f9997152ed4ad0414b215882a03

    SHA512

    9f10de636ec52f2df5659ad3f704172cd307239ae6a570a2b2ef8f9574056b6866839f861c075601c0a8ef06b7794f07e76efbe6845e7cd7ef47c99b0b1bd179

    Download Submit

  • C:\Temp\pmhfzxrmkecwupmh.exe
    Filesize

    361KB

    MD5

    12c7e372291a175825e144137a3e8cde

    SHA1

    00aa51822fdb20a31b24f037b19e91e93fc49ae4

    SHA256

    b1511406c9b52daa57ff88027b8d0ccb5d055f9997152ed4ad0414b215882a03

    SHA512

    9f10de636ec52f2df5659ad3f704172cd307239ae6a570a2b2ef8f9574056b6866839f861c075601c0a8ef06b7794f07e76efbe6845e7cd7ef47c99b0b1bd179

    Download Submit

  • C:\temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    906fb7b030d2cb00bd1a9abaaf2c5bcc

    SHA1

    77de6c9d235c6425a727b2f483b9f15aa2a98cab

    SHA256

    2c3232adb6cad3c150e66ab9886f2dca1da5f95d059e7c10e3355cdf7eece004

    SHA512

    f2d9a0cf0c07276d7abeb53069d7e0cbeb4ff0b0d379a74fdf0667d2bbddd4e594f832952564534132ceb60c8bbb857ef080f471125ca4526fb7a428ee8b9bbf

    Download Submit