c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd

Analysis

max time kernel
272s
max time network
383s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe
Size

1.0MB
MD5

e488d5f6bf3691c6e76961ce1ac83f21
SHA1

cc6e5a9c5c66505c6152a53b80f1c664b298935e
SHA256

c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd
SHA512

3d1f50a7114d53a34c000290236eedc5f4d8d4a8a4dcb62f6cb4842412957aa509834b287dd70a67c9c80c4ad4590fa5ee5dfc2350958f0204625141b0436e86
SSDEEP

24576:am3HPzj8Ajz1QFf3ixqqdT90qa9I0UHlaKDHvIv+U35sR:LHPDof0q2Tz4UgKDL05sR

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1180-55-0x0000000000400000-0x0000000000A08000-memory.dmp	upx
behavioral1/memory/1180-56-0x0000000000400000-0x0000000000A08000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\OperationSystem.exe	c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinServices.exe = "C:\\Users\\Admin\\AppData\\Local\\Uniless\\WinServices.exe"	c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1180	c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1180	c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe
1180	c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe

C:\Users\Admin\AppData\Local\Temp\c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe
"C:\Users\Admin\AppData\Local\Temp\c058daedbdb304ef0c5fcc192390a6a54bf6037af0213f14f6f52d472e3d50bd.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1180

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-54-0x0000000074FA1000-0x0000000074FA3000-memory.dmp

Filesize
8KB

Download
memory/1180-55-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download
memory/1180-56-0x0000000000400000-0x0000000000A08000-memory.dmp

Filesize
6.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads