Overview

overview

10

Static

static

c9c15da905...ca.exe

windows7-x64

1

c9c15da905...ca.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    163s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2022 22:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca.exe

  • Size

    474KB

  • MD5

    232370e55a8931263c031a83907f5700

  • SHA1

    e8a7c73a8b0b7659fff781907e8ba28f30401f9b

  • SHA256

    c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca

  • SHA512

    8bc21b25558a940a881907a3b866b58c21962d334a8d95a64196e7341fb77b30570ba875231be56dd3d1bec948e94f062208946925d24345ca1301a849752e29

  • SSDEEP

    1536:Bq7AWlngkYFKynXvAh1MFOMLwOueYdqXhVBZXcMik421dNSkWNVYM3O3:BvQgk6Kyn/wMFOMLN9AQdjWzT+

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables taskbar notifications via registry modification
    evasion
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca.exe
    "C:\Users\Admin\AppData\Local\Temp\c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Users\Admin\AppData\Local\Temp\c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca.exe
      "C:\Users\Admin\AppData\Local\Temp\c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:1568
        • C:\Users\Admin\C86218912F4BF6CF\EB691F.exe
          "C:\Users\Admin\C86218912F4BF6CF\EB691F.exe" 15452CC4
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:212
          • C:\Users\Admin\C86218912F4BF6CF\EB691F.exe
            15452CC4
            4⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Windows security modification
            • Checks whether UAC is enabled
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:5076
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              5⤵
                PID:3556
      • C:\Windows\system32\wbem\unsecapp.exe
        C:\Windows\system32\wbem\unsecapp.exe -Embedding
        1⤵
          PID:2880

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\C86218912F4BF6CF\EB691F.exe
          Filesize

          474KB

          MD5

          232370e55a8931263c031a83907f5700

          SHA1

          e8a7c73a8b0b7659fff781907e8ba28f30401f9b

          SHA256

          c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca

          SHA512

          8bc21b25558a940a881907a3b866b58c21962d334a8d95a64196e7341fb77b30570ba875231be56dd3d1bec948e94f062208946925d24345ca1301a849752e29

          Download Submit

        • C:\Users\Admin\C86218912F4BF6CF\EB691F.exe
          Filesize

          474KB

          MD5

          232370e55a8931263c031a83907f5700

          SHA1

          e8a7c73a8b0b7659fff781907e8ba28f30401f9b

          SHA256

          c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca

          SHA512

          8bc21b25558a940a881907a3b866b58c21962d334a8d95a64196e7341fb77b30570ba875231be56dd3d1bec948e94f062208946925d24345ca1301a849752e29

          Download Submit

        • C:\Users\Admin\C86218912F4BF6CF\EB691F.exe
          Filesize

          474KB

          MD5

          232370e55a8931263c031a83907f5700

          SHA1

          e8a7c73a8b0b7659fff781907e8ba28f30401f9b

          SHA256

          c9c15da9057c43db38345260a0cfec53542c3be0d23a1f86289e7bb5bc9eaeca

          SHA512

          8bc21b25558a940a881907a3b866b58c21962d334a8d95a64196e7341fb77b30570ba875231be56dd3d1bec948e94f062208946925d24345ca1301a849752e29

          Download Submit

        • memory/212-141-0x0000000000000000-mapping.dmp

          Download

        • memory/1568-139-0x0000000000000000-mapping.dmp

          Download

        • memory/1720-136-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

          Download

        • memory/1720-140-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

          Download

        • memory/1720-132-0x0000000000000000-mapping.dmp

          Download

        • memory/1720-135-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

          Download

        • memory/1720-144-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

          Download

        • memory/1720-133-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

          Download

        • memory/3556-153-0x0000000000000000-mapping.dmp

          Download

        • memory/5076-145-0x0000000000000000-mapping.dmp

          Download

        • memory/5076-154-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

          Download

        • memory/5076-155-0x0000000000400000-0x000000000043D000-memory.dmp

          Filesize

          244KB

          Download