Overview

overview

8

Static

static

1

DETAILS AN... .exe

windows7-x64

8

DETAILS AN... .exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/02/2023, 13:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DETAILS AND INVOICES 6 PAGES .exe
  • Size 295KB
  • Sample230217-qphszafa91
  • SHA256 83e90e75eb49fccf0f69331483311ce57f89b33824fbec54e773af910da239a8
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2620
    • C:\Users\Admin\AppData\Local\Temp\DETAILS AND INVOICES 6 PAGES .exe
      "C:\Users\Admin\AppData\Local\Temp\DETAILS AND INVOICES 6 PAGES .exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4832
      • C:\Users\Admin\AppData\Local\Temp\lrzio.exe
        "C:\Users\Admin\AppData\Local\Temp\lrzio.exe" C:\Users\Admin\AppData\Local\Temp\dyxxwxihck.h
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4496
        • C:\Users\Admin\AppData\Local\Temp\lrzio.exe
          "C:\Users\Admin\AppData\Local\Temp\lrzio.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1164
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:5112
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 5112 -s 184
            4⤵
            • Program crash
            PID:3288
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 460 -p 5112 -ip 5112
      1⤵
        PID:4772

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            dyxxwxihck.h
            • Path C:\Users\Admin\AppData\Local\Temp\dyxxwxihck.h
            • Size 5KB
            • SHA256 10fa85f7007c41a9ec62ee1d76683c7e246bdbdc1727119563ff65277d86aa66
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            lrzio.exe
            • Path C:\Users\Admin\AppData\Local\Temp\lrzio.exe
            • Size 98KB
            • SHA256 c5c1c3a82843fff120055d78b1376eb29c186fbc7cc3ae44afcd1e84aa01e441
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            lrzio.exe
            • Path C:\Users\Admin\AppData\Local\Temp\lrzio.exe
            • Size 98KB
            • SHA256 c5c1c3a82843fff120055d78b1376eb29c186fbc7cc3ae44afcd1e84aa01e441
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            lrzio.exe
            • Path C:\Users\Admin\AppData\Local\Temp\lrzio.exe
            • Size 98KB
            • SHA256 c5c1c3a82843fff120055d78b1376eb29c186fbc7cc3ae44afcd1e84aa01e441
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ynbdro.e
            • Path C:\Users\Admin\AppData\Local\Temp\ynbdro.e
            • Size 205KB
            • SHA256 3b2b1091d06736a5dafe288990b414e24d5df1cf57cc1f82957a9ffd8ea3eea9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/1164-140-0x0000000001620000-0x000000000196A000-memory.dmp
            Download

            memory/1164-144-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/1164-139-0x0000000000400000-0x000000000042F000-memory.dmp
            Download

            memory/1164-141-0x00000000010C0000-0x00000000010D0000-memory.dmp
            Download

            memory/2076-145-0x00000000001D0000-0x00000000002AC000-memory.dmp
            Download

            memory/2076-146-0x0000000000B30000-0x0000000000B5D000-memory.dmp
            Download

            memory/2076-147-0x0000000001C40000-0x0000000001F8A000-memory.dmp
            Download

            memory/2076-148-0x0000000001A90000-0x0000000001B1F000-memory.dmp
            Download

            memory/2620-142-0x0000000003280000-0x000000000338D000-memory.dmp
            Download

            memory/2620-149-0x0000000008710000-0x00000000087D7000-memory.dmp
            Download

            memory/2620-150-0x0000000008710000-0x00000000087D7000-memory.dmp
            Download