Overview

overview

10

Static

static

bd47dad114...54.exe

windows7-x64

10

bd47dad114...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2022 14:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe

  • Size

    833KB

  • MD5

    ef340e8cf4f94565b1d75b56badb3b9d

  • SHA1

    e9c8892e1978d20ad65398bfa873afac3d937fa7

  • SHA256

    bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

  • SHA512

    5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

  • SSDEEP

    1536:ybcbXVDMo9fgw5Y0ZlUmp/xLVQ8GW9AWPdApTbJ7mLcaQ9yrKYcU:yWMot5Y0Z2enQ8G0AVpTTaOyrv

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
    "C:\Users\Admin\AppData\Local\Temp\bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3520
    • C:\Users\Admin\AppData\Local\Temp\bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
      C:\Users\Admin\AppData\Local\Temp\bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254.exe
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2400
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Users\Admin\E696D64614\winlogon.exe
          C:\Users\Admin\E696D64614\winlogon.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4704
          • C:\Users\Admin\E696D64614\winlogon.exe
            "C:\Users\Admin\E696D64614\winlogon.exe"
            5⤵
            • Modifies firewall policy service
            • Modifies security service
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Windows security bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Sets file execution options in registry
            • Drops startup file
            • Windows security modification
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies Internet Explorer start page
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:4648
  • C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\unsecapp.exe -Embedding
    1⤵
      PID:320
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:2240
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3988
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3988 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4404

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        2KB

        MD5

        97acf0930ce9f2f69d40ed8e1178cec6

        SHA1

        6380a2d97e4b4ccc3b4598cc2d431702e54ed69c

        SHA256

        b38f02de41dbb7db433a5f440dff85432150ff71d53b7ef8792d96da80962343

        SHA512

        f49c8a4fa51127e7d8b71cd0257bbedc8855ea708ec0e313e5071b656aedb815b55e51619df24ed967c4df0e685a4940cc1f123aa4ee0198a3d1ada1b42480e1

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2119239CBE0D3DBEF6F19E0B10265873
        Filesize

        472B

        MD5

        0be73f837e6aeb740e5c608fb17237b5

        SHA1

        4dfd1104c0558f35d83b35ca08e4874052be4bc7

        SHA256

        9f57778d4b2af1df4ee9000e3be98a38927c78d4d61b8a70f7a6499c2842fa89

        SHA512

        1bd4cfb2889952a56d3b6c58f181343d491d18d10b645289746176d392426467a9e68f52a48315bb809cd917ac598489b0e2cad995fd689a1b8673376316313e

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        471B

        MD5

        f8f8086f87156d14091b152fcaadc3ce

        SHA1

        fe3cfbf9e2e871c948300473593dfcf189013386

        SHA256

        8d92f28b70ed5265fafad8b37ce049b0b8ecad038745173acc35a21b8222bf56

        SHA512

        1235be77513694a1478459e999631920be42183a6993dc1f93333831eaa54ea60c7d8617029289c95fed2f861fc7aa79da551c128df4428d23752044eb68ba7a

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
        Filesize

        488B

        MD5

        9405b4c9544c0a856c0bdf9920ccf00c

        SHA1

        4b94222c81e40bdc85f4755db7bdb26adb5951e7

        SHA256

        5b8f1ca251544537dfddab22915d2f9b1e43caa46b0c86535b95d17e92d2b497

        SHA512

        37cba22a3ccfbba9aa188521ee19cbf002a892c96b7f23f230f4967e6d7a26ab62a5875e504b4df56538b6d8e7f5985073ab84539b2c19bca4deafbcaae16fcb

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2119239CBE0D3DBEF6F19E0B10265873
        Filesize

        476B

        MD5

        bd1cd4cbaec5cf9d70dc5621c0b2fa8b

        SHA1

        657717f8ebb2c06b52820673640c678caf42da77

        SHA256

        36c7cf8a41f2e7149658144e316f34c235179d5ae8ce6d544a5dbe264b3be7cd

        SHA512

        a61ec2670e6e170adb2be93b1cc617111abc79a0a6dfe80bb7f7f673230c8bfd07ef11f16ffaeb57c260a8596a9a27f0b42a692eb41e192563d6871074ab06c4

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
        Filesize

        434B

        MD5

        cbbd6a4724caeb3b415f48531a34dbe1

        SHA1

        e75ce94d7bc472fff56709c7c30c083616ad712c

        SHA256

        c95f79a9b05808a2ab3518a856c4650d4293ba6a08e2528473be557d6ae84114

        SHA512

        d0a05e7a992e99828d6066f14e4a0bd771a5837fd7671934769ebf3dee553601aa2d7e6c9f9548bec967819a90f8aef5afc429e9e8734dd07dc539fffc0a1e94

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        833KB

        MD5

        ef340e8cf4f94565b1d75b56badb3b9d

        SHA1

        e9c8892e1978d20ad65398bfa873afac3d937fa7

        SHA256

        bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

        SHA512

        5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        833KB

        MD5

        ef340e8cf4f94565b1d75b56badb3b9d

        SHA1

        e9c8892e1978d20ad65398bfa873afac3d937fa7

        SHA256

        bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

        SHA512

        5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        833KB

        MD5

        ef340e8cf4f94565b1d75b56badb3b9d

        SHA1

        e9c8892e1978d20ad65398bfa873afac3d937fa7

        SHA256

        bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

        SHA512

        5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

        Download Submit

      • C:\Users\Admin\E696D64614\winlogon.exe
        Filesize

        833KB

        MD5

        ef340e8cf4f94565b1d75b56badb3b9d

        SHA1

        e9c8892e1978d20ad65398bfa873afac3d937fa7

        SHA256

        bd47dad114f41aa8f1497229446d683afe96ba9617959ec0caccfb2ffe6b5254

        SHA512

        5b6c11178e9eb3e965db330be5d88a218490834f8a2a89d4f1247a93322f9d52fef193b3e000c1853f06caed23231d6bd71af3ed9c42e2c1d7932c9d2f821731

        Download Submit

      • memory/2400-133-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/2400-135-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/2400-142-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/2400-136-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4648-153-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/4648-160-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/4648-157-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/4648-156-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/4648-165-0x0000000000400000-0x000000000043D000-memory.dmp

        Filesize

        244KB

        Download

      • memory/4704-151-0x0000000000400000-0x000000000041A000-memory.dmp

        Filesize

        104KB

        Download