Overview

overview

10

Static

static

bc84507c35...10.exe

windows7-x64

8

bc84507c35...10.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    179s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 20:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bc84507c35813fdb04268b1f45c9c635842f11554e8e46bdd98494ef2d410010.exe

  • Size

    361KB

  • MD5

    c082d170449ab37db151a4393125bd18

  • SHA1

    a68346e9aa54b20bdf13e91818312b5a33e666ec

  • SHA256

    bc84507c35813fdb04268b1f45c9c635842f11554e8e46bdd98494ef2d410010

  • SHA512

    5ef2838a0a4ff21b7368a7176179c9c5ac6c30d356519ed4b2b3ea464487ca3acd03bff28a069a3e48a0daa83d062859c41185835aba543c5b2bb95f5c42c26c

  • SSDEEP

    6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
  • Executes dropped EXE 11 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc84507c35813fdb04268b1f45c9c635842f11554e8e46bdd98494ef2d410010.exe
    "C:\Users\Admin\AppData\Local\Temp\bc84507c35813fdb04268b1f45c9c635842f11554e8e46bdd98494ef2d410010.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Temp\hcausmkecxupnhfz.exe
      C:\Temp\hcausmkecxupnhfz.exe run
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\snkfcxvpni.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:2884
        • C:\Temp\snkfcxvpni.exe
          C:\Temp\snkfcxvpni.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3640
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:4452
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4020
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_snkfcxvpni.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:2016
        • C:\Temp\i_snkfcxvpni.exe
          C:\Temp\i_snkfcxvpni.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3992
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\qifaxsqkic.exe ups_run
        3⤵
        • Executes dropped EXE
        PID:116
        • C:\Temp\qifaxsqkic.exe
          C:\Temp\qifaxsqkic.exe ups_run
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3736
          • C:\temp\CreateProcess.exe
            C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
            5⤵
            • Executes dropped EXE
            PID:1124
            • C:\windows\system32\ipconfig.exe
              C:\windows\system32\ipconfig.exe /release
              6⤵
              • Gathers network information
              PID:4340
      • C:\temp\CreateProcess.exe
        C:\temp\CreateProcess.exe C:\Temp\i_qifaxsqkic.exe ups_ins
        3⤵
        • Executes dropped EXE
        PID:4336
        • C:\Temp\i_qifaxsqkic.exe
          C:\Temp\i_qifaxsqkic.exe ups_ins
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4580
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4372 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3672
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    1⤵
    • Suspicious use of NtCreateUserProcessOtherParentProcess
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2552

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    17cc52c0daa34cb4b49124f18b1b8182

    SHA1

    8ab0f2e62ec6978478c83258b8127e20a7f6c5a3

    SHA256

    18738c29f8751fe44fc6fc8b64eed2b05a3d5e7f8542478b2764321125c77d97

    SHA512

    5e9aa5c2feb79a7f6448e227cde1fb128f0dd43a12586ffe8160ee8d4d1aa012345b0d6d20762ce7227a727056f09bc286c11f55d16a07a88bb05743aa38111d

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    17cc52c0daa34cb4b49124f18b1b8182

    SHA1

    8ab0f2e62ec6978478c83258b8127e20a7f6c5a3

    SHA256

    18738c29f8751fe44fc6fc8b64eed2b05a3d5e7f8542478b2764321125c77d97

    SHA512

    5e9aa5c2feb79a7f6448e227cde1fb128f0dd43a12586ffe8160ee8d4d1aa012345b0d6d20762ce7227a727056f09bc286c11f55d16a07a88bb05743aa38111d

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    17cc52c0daa34cb4b49124f18b1b8182

    SHA1

    8ab0f2e62ec6978478c83258b8127e20a7f6c5a3

    SHA256

    18738c29f8751fe44fc6fc8b64eed2b05a3d5e7f8542478b2764321125c77d97

    SHA512

    5e9aa5c2feb79a7f6448e227cde1fb128f0dd43a12586ffe8160ee8d4d1aa012345b0d6d20762ce7227a727056f09bc286c11f55d16a07a88bb05743aa38111d

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    17cc52c0daa34cb4b49124f18b1b8182

    SHA1

    8ab0f2e62ec6978478c83258b8127e20a7f6c5a3

    SHA256

    18738c29f8751fe44fc6fc8b64eed2b05a3d5e7f8542478b2764321125c77d97

    SHA512

    5e9aa5c2feb79a7f6448e227cde1fb128f0dd43a12586ffe8160ee8d4d1aa012345b0d6d20762ce7227a727056f09bc286c11f55d16a07a88bb05743aa38111d

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    17cc52c0daa34cb4b49124f18b1b8182

    SHA1

    8ab0f2e62ec6978478c83258b8127e20a7f6c5a3

    SHA256

    18738c29f8751fe44fc6fc8b64eed2b05a3d5e7f8542478b2764321125c77d97

    SHA512

    5e9aa5c2feb79a7f6448e227cde1fb128f0dd43a12586ffe8160ee8d4d1aa012345b0d6d20762ce7227a727056f09bc286c11f55d16a07a88bb05743aa38111d

    Download Submit

  • C:\Temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    17cc52c0daa34cb4b49124f18b1b8182

    SHA1

    8ab0f2e62ec6978478c83258b8127e20a7f6c5a3

    SHA256

    18738c29f8751fe44fc6fc8b64eed2b05a3d5e7f8542478b2764321125c77d97

    SHA512

    5e9aa5c2feb79a7f6448e227cde1fb128f0dd43a12586ffe8160ee8d4d1aa012345b0d6d20762ce7227a727056f09bc286c11f55d16a07a88bb05743aa38111d

    Download Submit

  • C:\Temp\hcausmkecxupnhfz.exe
    Filesize

    361KB

    MD5

    51169c6b3cb71dbeead0662d9c19e3ae

    SHA1

    944ee11db61bed7f94e8be02dbfbb277285359a8

    SHA256

    e3cb2b864811e3eec3d0953ce19eaa9ab36732842e70309f272060da45da5168

    SHA512

    f11a65e8686924b1276cf58fba815a0a56dc7de0462d838bfb1773656ca517544a0f574c04766330cc18398105faf416edc417ac6b5a44f1fc14f9afaf29b12f

    Download Submit

  • C:\Temp\hcausmkecxupnhfz.exe
    Filesize

    361KB

    MD5

    51169c6b3cb71dbeead0662d9c19e3ae

    SHA1

    944ee11db61bed7f94e8be02dbfbb277285359a8

    SHA256

    e3cb2b864811e3eec3d0953ce19eaa9ab36732842e70309f272060da45da5168

    SHA512

    f11a65e8686924b1276cf58fba815a0a56dc7de0462d838bfb1773656ca517544a0f574c04766330cc18398105faf416edc417ac6b5a44f1fc14f9afaf29b12f

    Download Submit

  • C:\Temp\i_qifaxsqkic.exe
    Filesize

    361KB

    MD5

    ea2d065013f417bd935e81141afc2226

    SHA1

    b0b796d1337afcbcdb8968492579f0c9ff60cdbc

    SHA256

    bbb6374ee09ecb058b02a5dfaf653c67bcf592408b0d2fa9b1f886286a97dee0

    SHA512

    86187f1b0daf9510fddd428cfe929af4e1fc92172a529320531db9b2aaede5ebe83dbbf37a76e18dd9570775d29ddf51b673937b0662013ccf93158021af7732

    Download Submit

  • C:\Temp\i_qifaxsqkic.exe
    Filesize

    361KB

    MD5

    ea2d065013f417bd935e81141afc2226

    SHA1

    b0b796d1337afcbcdb8968492579f0c9ff60cdbc

    SHA256

    bbb6374ee09ecb058b02a5dfaf653c67bcf592408b0d2fa9b1f886286a97dee0

    SHA512

    86187f1b0daf9510fddd428cfe929af4e1fc92172a529320531db9b2aaede5ebe83dbbf37a76e18dd9570775d29ddf51b673937b0662013ccf93158021af7732

    Download Submit

  • C:\Temp\i_snkfcxvpni.exe
    Filesize

    361KB

    MD5

    5e9da2bf4d9d81172819e514157a0bdd

    SHA1

    2fd1bf847d1bbd6635eae7a722d0a49181dfe82b

    SHA256

    4b05597b7851c503110ac19f1ab35eaa72ff57ffe2044c289c68aa1a89e94e85

    SHA512

    59c127b618c0def27da6cb39d1a594e35ef268b51128eadc5ace5750b3185592e99ad42d12bcb5dd56d4fc94218b76f7e8006edbcf481eb800d8a265e7583ba0

    Download Submit

  • C:\Temp\i_snkfcxvpni.exe
    Filesize

    361KB

    MD5

    5e9da2bf4d9d81172819e514157a0bdd

    SHA1

    2fd1bf847d1bbd6635eae7a722d0a49181dfe82b

    SHA256

    4b05597b7851c503110ac19f1ab35eaa72ff57ffe2044c289c68aa1a89e94e85

    SHA512

    59c127b618c0def27da6cb39d1a594e35ef268b51128eadc5ace5750b3185592e99ad42d12bcb5dd56d4fc94218b76f7e8006edbcf481eb800d8a265e7583ba0

    Download Submit

  • C:\Temp\qifaxsqkic.exe
    Filesize

    361KB

    MD5

    14f6941f3b35fec7c3adc7703d997fbd

    SHA1

    22208079a9b7f1d2dc4b5240b21e5e26eb91f396

    SHA256

    18836084e05689249d5521e177a716fb882d0eda62b8686ab95003caad3afd1a

    SHA512

    56c12ee1a0ac5c29d8c405e56f30ad0c47918d18924e7208bfd6cb0fd64e4202eac3200720e2b8d1a4368f3d8007ec6af924e5f52e6284ba1d9a5bf62e4ade34

    Download Submit

  • C:\Temp\qifaxsqkic.exe
    Filesize

    361KB

    MD5

    14f6941f3b35fec7c3adc7703d997fbd

    SHA1

    22208079a9b7f1d2dc4b5240b21e5e26eb91f396

    SHA256

    18836084e05689249d5521e177a716fb882d0eda62b8686ab95003caad3afd1a

    SHA512

    56c12ee1a0ac5c29d8c405e56f30ad0c47918d18924e7208bfd6cb0fd64e4202eac3200720e2b8d1a4368f3d8007ec6af924e5f52e6284ba1d9a5bf62e4ade34

    Download Submit

  • C:\Temp\snkfcxvpni.exe
    Filesize

    361KB

    MD5

    d602c92883851483b559555aba602cd0

    SHA1

    869a517a46ab800b0c409669247bbdf1bfcec32f

    SHA256

    85343e47a94ed8ce6073daaec42753f8afce5427b46873f8f68ad2cffe74927a

    SHA512

    6c3c389bad7158aae89eb396bce8aea1a10b119765755d6ddfdc6bb9f8477735e0a5519529bfa7d9a944c7a3c8de68401084c27f44b533abff6a5e74bfba785a

    Download Submit

  • C:\Temp\snkfcxvpni.exe
    Filesize

    361KB

    MD5

    d602c92883851483b559555aba602cd0

    SHA1

    869a517a46ab800b0c409669247bbdf1bfcec32f

    SHA256

    85343e47a94ed8ce6073daaec42753f8afce5427b46873f8f68ad2cffe74927a

    SHA512

    6c3c389bad7158aae89eb396bce8aea1a10b119765755d6ddfdc6bb9f8477735e0a5519529bfa7d9a944c7a3c8de68401084c27f44b533abff6a5e74bfba785a

    Download Submit

  • C:\temp\CreateProcess.exe
    Filesize

    3KB

    MD5

    17cc52c0daa34cb4b49124f18b1b8182

    SHA1

    8ab0f2e62ec6978478c83258b8127e20a7f6c5a3

    SHA256

    18738c29f8751fe44fc6fc8b64eed2b05a3d5e7f8542478b2764321125c77d97

    SHA512

    5e9aa5c2feb79a7f6448e227cde1fb128f0dd43a12586ffe8160ee8d4d1aa012345b0d6d20762ce7227a727056f09bc286c11f55d16a07a88bb05743aa38111d

    Download Submit