Overview

overview

10

Static

static

b55c26b126...9b.exe

windows7-x64

10

b55c26b126...9b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2022 14:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b.exe

  • Size

    124KB

  • MD5

    d19b993abac2d7786f69904379c13ef7

  • SHA1

    890889d6b5488258df893179b65fd739c573d5b2

  • SHA256

    b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b

  • SHA512

    56cb670f30f1ee4b8790597a7067c1c14f9455ff075c1dbcbb1a86763776637bd530772429ae357ec9bb76add1524a76369d5c7a028499609851d567e353d8c9

  • SSDEEP

    1536:GCxE8JHTdoQkO6xvJXzT0YpMgbQoToPQTiwHz7pj5omc4JyBMA6okrAbMftGG/2S:GuxBoJOMXzAMrTuw8aMBeokr4ja2P8I

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b.exe
    "C:\Users\Admin\AppData\Local\Temp\b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Users\Admin\AppData\Local\Temp\b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b.exe
      C:\Users\Admin\AppData\Local\Temp\b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Users\Admin\E696D64614\winlogon.exe
          C:\Users\Admin\E696D64614\winlogon.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5092
          • C:\Users\Admin\E696D64614\winlogon.exe
            "C:\Users\Admin\E696D64614\winlogon.exe"
            5⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:3360
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:4724
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:2028
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4896
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4896 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4864

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        2KB

        MD5

        97acf0930ce9f2f69d40ed8e1178cec6

        SHA1

        6380a2d97e4b4ccc3b4598cc2d431702e54ed69c

        SHA256

        b38f02de41dbb7db433a5f440dff85432150ff71d53b7ef8792d96da80962343

        SHA512

        f49c8a4fa51127e7d8b71cd0257bbedc8855ea708ec0e313e5071b656aedb815b55e51619df24ed967c4df0e685a4940cc1f123aa4ee0198a3d1ada1b42480e1

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        488B

        MD5

        0dc1957dc6911fe164761c26bbacd402

        SHA1

        da476469ebcbe8fb935dc7e4716d1756befc7092

        SHA256

        6c024d32d27140ba09ff5fb17729ce6d0e6281449a3b013761f7f8e2accf4cce

        SHA512

        a58dc141b9808e3447a232c5f5851170c5476b8e2ac9516a142bc609631ddb99d9cd28d6def2e1d9846f4a694183bacce29d9450bb604e7a91188a4d1c4b40c6

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        124KB

        MD5

        d19b993abac2d7786f69904379c13ef7

        SHA1

        890889d6b5488258df893179b65fd739c573d5b2

        SHA256

        b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b

        SHA512

        56cb670f30f1ee4b8790597a7067c1c14f9455ff075c1dbcbb1a86763776637bd530772429ae357ec9bb76add1524a76369d5c7a028499609851d567e353d8c9

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        124KB

        MD5

        d19b993abac2d7786f69904379c13ef7

        SHA1

        890889d6b5488258df893179b65fd739c573d5b2

        SHA256

        b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b

        SHA512

        56cb670f30f1ee4b8790597a7067c1c14f9455ff075c1dbcbb1a86763776637bd530772429ae357ec9bb76add1524a76369d5c7a028499609851d567e353d8c9

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        124KB

        MD5

        d19b993abac2d7786f69904379c13ef7

        SHA1

        890889d6b5488258df893179b65fd739c573d5b2

        SHA256

        b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b

        SHA512

        56cb670f30f1ee4b8790597a7067c1c14f9455ff075c1dbcbb1a86763776637bd530772429ae357ec9bb76add1524a76369d5c7a028499609851d567e353d8c9

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        124KB

        MD5

        d19b993abac2d7786f69904379c13ef7

        SHA1

        890889d6b5488258df893179b65fd739c573d5b2

        SHA256

        b55c26b1268bfc47d21e2dfffa617eceaa29fb525b6bf630cc6338db1ef7e89b

        SHA512

        56cb670f30f1ee4b8790597a7067c1c14f9455ff075c1dbcbb1a86763776637bd530772429ae357ec9bb76add1524a76369d5c7a028499609851d567e353d8c9

        Download Submit

      • memory/1628-133-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1628-135-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1628-136-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1628-147-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/1628-132-0x0000000000000000-mapping.dmp

        Download

      • memory/3360-157-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3360-153-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3360-152-0x0000000000000000-mapping.dmp

        Download

      • memory/3360-156-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3360-160-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/3360-163-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/5092-151-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/5092-142-0x0000000000000000-mapping.dmp

        Download

      • memory/5096-139-0x0000000000000000-mapping.dmp

        Download