e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052

Analysis

max time kernel
183s
max time network
49s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
Size

478KB
MD5

b8ea7cfc4cad7f1aa0241ace0fb42f8e
SHA1

dd66fd0232e496cc5eec33c503b73d2574068291
SHA256

e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052
SHA512

24ddd1baca24174474d72d73b91d82dd918012cfe74a9c04edbcc640cf78d6082f33998664a2ac00c33e03886c0581f0e71b317d4b9c6e716f5b2844bc7f9b93
SSDEEP

12288:m9v5f/0M1eMMKtBpuQyqxXUUBMMnMMMMMzBDPWAzgYkBgfo8o/uPJ:m9v5f/0M1eM5hBMMnMMMMMzxWAzzGhWP

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
296	UmVbuJTOLvHcFx.exe

Loads dropped DLL 10 IoCs

pid	Process
520	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\UmVbuJTOLvHcFx.exe = "C:\\ProgramData\\UmVbuJTOLvHcFx.exe"	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Download	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
520	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
520	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe
296	UmVbuJTOLvHcFx.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
520	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 296	520	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe	28
PID 520 wrote to memory of 296	520	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe	28
PID 520 wrote to memory of 296	520	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe	28
PID 520 wrote to memory of 296	520	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe	28

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe

C:\Users\Admin\AppData\Local\Temp\e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe
"C:\Users\Admin\AppData\Local\Temp\e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
- System policy modification
PID:520
- C:\ProgramData\UmVbuJTOLvHcFx.exe
  "C:\ProgramData\UmVbuJTOLvHcFx.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\UmVbuJTOLvHcFx.exe

Filesize
478KB

MD5
b8ea7cfc4cad7f1aa0241ace0fb42f8e

SHA1
dd66fd0232e496cc5eec33c503b73d2574068291

SHA256
e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052

SHA512
24ddd1baca24174474d72d73b91d82dd918012cfe74a9c04edbcc640cf78d6082f33998664a2ac00c33e03886c0581f0e71b317d4b9c6e716f5b2844bc7f9b93

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\USLXJxomEWpTHD.dll

Filesize
431KB

MD5
bdc53a4c204304fa8788dbd1037b7b2d

SHA1
5aa9035618bee05ecfdde43126f2468e4c909f0f

SHA256
dbe407b4ecd419b0c0524160fc423e8cbe12006ae8b2b1cb5c2cdc1d9d5e757e

SHA512
4ffba431da40d45bd69edd8ba920431288da222abbe8a8fb7a0b022966cc9d4355559c6f0ab1e3c5cb9675c61832e8caf94ebd0c52060a24e70d7cea249342ba

Download Submit
\ProgramData\UmVbuJTOLvHcFx.exe

Filesize
478KB

MD5
b8ea7cfc4cad7f1aa0241ace0fb42f8e

SHA1
dd66fd0232e496cc5eec33c503b73d2574068291

SHA256
e826371c2538745546a41c6edfa353d701721994f57609013e80726a20c0a052

SHA512
24ddd1baca24174474d72d73b91d82dd918012cfe74a9c04edbcc640cf78d6082f33998664a2ac00c33e03886c0581f0e71b317d4b9c6e716f5b2844bc7f9b93

Download Submit
memory/520-60-0x0000000000230000-0x00000000002A1000-memory.dmp

Filesize
452KB

Download
memory/520-61-0x0000000014000000-0x000000001414E000-memory.dmp

Filesize
1.3MB

Download
memory/520-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download