Overview

overview

8

Static

static

7

e24baa88f0...d5.exe

windows7-x64

8

e24baa88f0...d5.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2023, 04:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e24baa88f0e9ca9e777651038c0a4e8134322809dc0739bbe6921050031804d5.exe

  • Size

    546KB

  • MD5

    ee163ec6424ccd1919e73e8e59c6c47e

  • SHA1

    bc740b24d1deef1f80dc5043d0e2950396af5d71

  • SHA256

    e24baa88f0e9ca9e777651038c0a4e8134322809dc0739bbe6921050031804d5

  • SHA512

    623a16d33ecd3f54ac8c6f41e46fa4ae7648d11f3561b62e4f6513caa60f3bb4ad0c8ceb2645634126c53c000da226348ba98d86ab1a20cce0ce402d3436c2da

  • SSDEEP

    12288:F0X0KOnD/voMRQlNmrbhod2hiRAXQNs44BF4lI8ZhBLpw0PHcA:uX0hD34ShYVRyg0Ihw0PHcA

Score
8/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies registry class 36 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e24baa88f0e9ca9e777651038c0a4e8134322809dc0739bbe6921050031804d5.exe
    "C:\Users\Admin\AppData\Local\Temp\e24baa88f0e9ca9e777651038c0a4e8134322809dc0739bbe6921050031804d5.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3528
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c attrib +a +s +h +r "%programfiles%\Tencent\QDesk" >nul 2>nul
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Windows\SysWOW64\attrib.exe
        attrib +a +s +h +r "C:\Program Files (x86)\Tencent\QDesk"
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:2440
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c echo y|cacls "%programfiles%\Tencent\QDesk" /c /p everyone:n >nul 2>nul
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4940
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo y"
        3⤵
          PID:4340
        • C:\Windows\SysWOW64\cacls.exe
          cacls "C:\Program Files (x86)\Tencent\QDesk" /c /p everyone:n
          3⤵
            PID:2156
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c attrib +a +s +h +r "%programfiles%\QDesk" >nul 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3608
          • C:\Windows\SysWOW64\attrib.exe
            attrib +a +s +h +r "C:\Program Files (x86)\QDesk"
            3⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:2268
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c echo y|cacls "%programfiles%\QDesk" /c /p everyone:n >nul 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo y"
            3⤵
              PID:3768
            • C:\Windows\SysWOW64\cacls.exe
              cacls "C:\Program Files (x86)\QDesk" /c /p everyone:n
              3⤵
                PID:796
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c @echo off
              2⤵
                PID:3000
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c netsh interface set interface "以太网" enable
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1676
                • C:\Windows\SysWOW64\netsh.exe
                  netsh interface set interface "以太网" enable
                  3⤵
                    PID:2748
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 1&del /q "C:\Users\Admin\AppData\Local\Temp\e24baa88f0e9ca9e777651038c0a4e8134322809dc0739bbe6921050031804d5.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2832
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 1
                    3⤵
                    • Runs ping.exe
                    PID:708
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c ping -n 3 127.1 & del /q "C:\Users\Admin\AppData\Local\Temp\e24baa88f0e9ca9e777651038c0a4e8134322809dc0739bbe6921050031804d5.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2420
                  • C:\Windows\SysWOW64\PING.EXE
                    ping -n 3 127.1
                    3⤵
                    • Runs ping.exe
                    PID:2228
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 1&del /q "C:\Users\Admin\AppData\Local\Temp\e24baa88f0e9ca9e777651038c0a4e8134322809dc0739bbe6921050031804d5.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4704
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 1
                    3⤵
                    • Runs ping.exe
                    PID:3948
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                • Modifies Installed Components in the registry
                • Drops desktop.ini file(s)
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:1408
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4776
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:4600

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133236760072913302.txt
                      Filesize

                      75KB

                      MD5

                      30466909c6fd3bdb0f6d20f8bd1c4b39

                      SHA1

                      f0e015ecc6e6f60ac5871f2f62a0fff521d02932

                      SHA256

                      45d64a3ff61f03c84e611eeb213108e1de7877e8a802067698e518937ac08029

                      SHA512

                      5f84125cc967bd7ae3fc30026472ff15c5b41122ec36f776f7c2fef7f1b07319c51d1300b657e42f0a6f116f14371ce37b89821fe837867f5d06d11e25ec2909

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\aut7842.tmp
                      Filesize

                      86KB

                      MD5

                      de96ede42282a78b39700b3740dea296

                      SHA1

                      f7783e7e018b3c45762bb2d2b7380510b859646b

                      SHA256

                      9456076f9841a2932d51233040056d2641182ccc858287e6433d3c94c3300f02

                      SHA512

                      d77c6bb9dc90cb802ebcd9b198be993fc2b68665e0a9e90a5956d7e831b5fa478dac0aeb06f55a9f4797956460a53623f90cc9ade108c7e463657e58a788c5eb

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\2345AvScan\2345AvScanT
                      Filesize

                      782B

                      MD5

                      b95526eb0fa8d10551e0cbd0d78caec0

                      SHA1

                      c94dadc0c79a49160364b36aff873ae3c1bddc4d

                      SHA256

                      ffd6f0bc76b40115ca4d0eb3ae27276c5c2b3f8719abcecd6952ac64c41eb6b9

                      SHA512

                      08208f7cea4f3c25e2e1d854ce169d1356f8c4785ec400debfb33ed0e9d579f725b291b97884bc1d0c115b2f4caf2d884d0319706122c7cd45a8010a11301051

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
                      Filesize

                      1KB

                      MD5

                      e30d4ad73a1213ebf2623faa9fc4be90

                      SHA1

                      e3b828c439e21ad23b08897ef3b65d5229dde35f

                      SHA256

                      d7d1cc1ba49b911347e9256d75edf8dc3155adf56180d6d1c3c9c738239f0187

                      SHA512

                      3f6a76fcd58985fa33e919d07d35547941552b9053ae3e3f973894f0fb6047f7efa96b088c1ec7ae12c190f1ce93f497851f8777bee2234a84c6fa5939cc724f

                      Download Submit

                    • memory/1408-171-0x00000000040E0000-0x00000000040E1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/3528-141-0x0000000000450000-0x000000000055B000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/3528-163-0x0000000000450000-0x000000000055B000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/3528-164-0x0000000000450000-0x000000000055B000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/4600-180-0x0000026E0A620000-0x0000026E0A640000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/4600-183-0x0000026E0A3D0000-0x0000026E0A3F0000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/4600-186-0x0000026E0A9E0000-0x0000026E0AA00000-memory.dmp

                      Filesize

                      128KB

                      Download