Overview

overview

10

Static

static

8

5e1799dcf2...54.exe

windows7-x64

10

5e1799dcf2...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    194s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 10:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54.exe

  • Size

    994KB

  • MD5

    a6e5b08eb7418c10b365b7a9dc3c7de3

  • SHA1

    4ef29aa1be128173f3568eb3078c8ab34dda7458

  • SHA256

    5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54

  • SHA512

    f0ffbe3b2a78f1a34cb0da2ea617d8b83f86348f71b827bbd41ba44e543f69ea8963ca72926b4eaf46c7d394e9623159140a702335159c705df7d51c1ceacc62

  • SSDEEP

    1536:2fRN2/SWANOttpVxXVIXKL7mxUH1OibPoQT9lnouy8:EOAKnrq6Oxo1OcRJ9out

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 14 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • UPX packed file 13 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54.exe
    "C:\Users\Admin\AppData\Local\Temp\5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1304
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Sets file execution options in registry
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:2032
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1272 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1504

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          61KB

          MD5

          fc4666cbca561e864e7fdf883a9e6661

          SHA1

          2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

          SHA256

          10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

          SHA512

          c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          aaaa2879a79b8646851a9d5a1a66831a

          SHA1

          66543f01b490a3fbf4fbcd99b6b0064f888e8553

          SHA256

          cc86453b8b6e5bb387d9561118c95d802b7bb7a0c91300b0beb5fd563b9b4127

          SHA512

          dcc5dc76f965318e783370d3dc1cdf801aba99f0461d8a63e2cedc15ac4875d34b5c758804b5d19b05272ae03006624c92fd99c6add343fcfb855a186a7709d3

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          2b89562075a2d430d7cf5a3c52472dbc

          SHA1

          8620d5e78d67586af4d6f33b9d9a6474f6372064

          SHA256

          7195ac72f2edeba4307cc1080d3dbafaba882504de8a7a4d4b5529293383e230

          SHA512

          9f54ba2b49f0fe1ca0bc301f6fc2fc70dd9385ae58632ebca0c393ec681e3914339cf1dc13c6787a158e6e06673bbc63d6305058eea1f272141d27b022d28e29

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          003fb3a6312d15187eb36fccaa14ee30

          SHA1

          8a39f3a42521f4cdd9324dabec54235ac05233d6

          SHA256

          447ee82a2a432e5197fea9deabf3061205aeb7beca56c143539ec4bd6b8c9669

          SHA512

          919ed375223c3e432ffed804210db0a570ad33c43d1a75a75d5cc7dabcefcf77f39b6adeb22e66430f5f3ee7d1d7ff19c8ea114d6435db25b4d6946eef0bdc02

          Download Submit

        • C:\Users\Admin\E696D64614\winlogon.exe
          Filesize

          994KB

          MD5

          a6e5b08eb7418c10b365b7a9dc3c7de3

          SHA1

          4ef29aa1be128173f3568eb3078c8ab34dda7458

          SHA256

          5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54

          SHA512

          f0ffbe3b2a78f1a34cb0da2ea617d8b83f86348f71b827bbd41ba44e543f69ea8963ca72926b4eaf46c7d394e9623159140a702335159c705df7d51c1ceacc62

          Download Submit

        • C:\Users\Admin\E696D64614\winlogon.exe
          Filesize

          994KB

          MD5

          a6e5b08eb7418c10b365b7a9dc3c7de3

          SHA1

          4ef29aa1be128173f3568eb3078c8ab34dda7458

          SHA256

          5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54

          SHA512

          f0ffbe3b2a78f1a34cb0da2ea617d8b83f86348f71b827bbd41ba44e543f69ea8963ca72926b4eaf46c7d394e9623159140a702335159c705df7d51c1ceacc62

          Download Submit

        • C:\Users\Admin\E696D64614\winlogon.exe
          Filesize

          994KB

          MD5

          a6e5b08eb7418c10b365b7a9dc3c7de3

          SHA1

          4ef29aa1be128173f3568eb3078c8ab34dda7458

          SHA256

          5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54

          SHA512

          f0ffbe3b2a78f1a34cb0da2ea617d8b83f86348f71b827bbd41ba44e543f69ea8963ca72926b4eaf46c7d394e9623159140a702335159c705df7d51c1ceacc62

          Download Submit

        • \Users\Admin\E696D64614\winlogon.exe
          Filesize

          994KB

          MD5

          a6e5b08eb7418c10b365b7a9dc3c7de3

          SHA1

          4ef29aa1be128173f3568eb3078c8ab34dda7458

          SHA256

          5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54

          SHA512

          f0ffbe3b2a78f1a34cb0da2ea617d8b83f86348f71b827bbd41ba44e543f69ea8963ca72926b4eaf46c7d394e9623159140a702335159c705df7d51c1ceacc62

          Download Submit

        • \Users\Admin\E696D64614\winlogon.exe
          Filesize

          994KB

          MD5

          a6e5b08eb7418c10b365b7a9dc3c7de3

          SHA1

          4ef29aa1be128173f3568eb3078c8ab34dda7458

          SHA256

          5e1799dcf2c2b14bd7a9471ebdc2ce293a1104036bcce30fddc0be2198c7cc54

          SHA512

          f0ffbe3b2a78f1a34cb0da2ea617d8b83f86348f71b827bbd41ba44e543f69ea8963ca72926b4eaf46c7d394e9623159140a702335159c705df7d51c1ceacc62

          Download Submit

        • memory/1304-67-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

          Download

        • memory/1304-68-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

          Download

        • memory/1416-62-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

          Download

        • memory/1416-57-0x0000000075F01000-0x0000000075F03000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1416-55-0x0000000000400000-0x0000000000446000-memory.dmp

          Filesize

          280KB

          Download

        • memory/2032-69-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/2032-74-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/2032-80-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download

        • memory/2032-73-0x0000000000400000-0x000000000043F000-memory.dmp

          Filesize

          252KB

          Download