Overview

overview

10

Static

static

Windows10C...ns.zip

windows10-2004-x64

10

Analysis

  • max time kernel
    216s
  • max time network
    271s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 00:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Windows10Corruptions.zip

  • Size

    25.9MB

  • MD5

    58ced9055dad414215ccb68b9c03bf75

  • SHA1

    fe0126aa4cba59bfa3cb3eeb1ce91b43832a1167

  • SHA256

    85370541ae0630c1bfb0ca871198c2534f0eb6e6319cab9a5980c568940c6ff3

  • SHA512

    06740e453829a2fbcba3a4e034106074eb221d79ba53051987ca9efac04306dc7c8408f2d8e74ea12071bd1eade79485a9a3d341679d3c22e29f7073d7b0349c

  • SSDEEP

    786432:hT0wE+ZpLR9z1ITG06cdVVT+zCnz5UGvaaDWsY6kS:pa+fLR12q0HfCzmZaKNYs

Score
10/10
adwareevasionpersistencestealertrojan

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 64 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Program crash 3 IoCs
  • Checks processor information in registry 2 TTPs 23 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 64 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Windows10Corruptions.zip
    1⤵
      PID:4532
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2020
      • C:\Windows\regedit.exe
        "regedit.exe" "C:\Users\Admin\Documents\Windows10Corruptions\ShiftedHKU.reg"
        1⤵
        • Modifies system executable filetype association
        • Looks for VMWare Tools registry key
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Runs .reg file with regedit
        PID:3036
      • C:\Windows\regedit.exe
        "regedit.exe" "C:\Users\Admin\Documents\Windows10Corruptions\ShiftedHKLM.reg"
        1⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Modifies system executable filetype association
        • UAC bypass
        • Modifies Installed Components in the registry
        • Registers COM server for autorun
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Installs/modifies Browser Helper Object
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Runs .reg file with regedit
        PID:2336
      • C:\Windows\regedit.exe
        "regedit.exe" "C:\Users\Admin\Documents\Windows10Corruptions\ShiftedHKCU.reg"
        1⤵
        • Modifies system executable filetype association
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Looks for VMWare Tools registry key
        • Modifies Installed Components in the registry
        • Adds Run key to start application
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Runs .reg file with regedit
        PID:1080
      • C:\Windows\regedit.exe
        "regedit.exe" "C:\Users\Admin\Documents\Windows10Corruptions\ShiftedHKCR.reg"
        1⤵
        • Modifies system executable filetype association
        • Registers COM server for autorun
        • Modifies registry class
        • Runs .reg file with regedit
        PID:4016
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 432 -p 3340 -ip 3340
        1⤵
          PID:3516
        • C:\Windows\regedit.exe
          "regedit.exe" "C:\Users\Admin\Documents\Windows10Corruptions\ShiftedHKCC.reg"
          1⤵
          • Runs .reg file with regedit
          PID:3860
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3340 -s 2480
          1⤵
          • Program crash
          PID:1344
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:3960
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 3960 -s 520
              2⤵
              • Program crash
              PID:2868
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 408 -p 3960 -ip 3960
            1⤵
              PID:2528
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 416 -p 3488 -ip 3488
              1⤵
                PID:4560
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 3488 -s 4592
                1⤵
                • Program crash
                PID:3792
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:1656
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:228
                  • C:\Windows\system32\WerFault.exe
                    C:\Windows\system32\WerFault.exe -pss -s 580 -p 228 -ip 228
                    1⤵
                      PID:4668

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads