Overview

overview

10

Static

static

1

SecuriteIn...24.exe

windows7-x64

10

SecuriteIn...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2023 07:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win64.PWSX-gen.3187.26224.exe

  • Size

    1.1MB

  • MD5

    9de36c98f536475f24a05cc8dda87b38

  • SHA1

    38bb84519bd71133d1df4f7c7db387055c634cbd

  • SHA256

    fbfa8f32f35e7925f320978a55f28df0c6214cefd8a93fa02a0c1d946d100715

  • SHA512

    daf15d86198a88cc6d465bafa8c1106763756dd5e4fc23e5a813becc42a8aab1187408a96b15c584d29ba5aaa3dab1bae2de2e68c7ff56a4766e77e393e1d16a

  • SSDEEP

    24576:17LXnVC7Ko7A11cljuxSd9Hbf0RnV8XJefZXZXqc1rnRqaJ:13FC7T7gBSbf0RV1F3rnRqq

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Uses the VBS compiler for execution 1 TTPs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.3187.26224.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.3187.26224.exe"
    1⤵
    • UAC bypass
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Sets service image path in registry
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: LoadsDriver
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2040
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win64.PWSX-gen.3187.26224.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:872
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
      2⤵
        PID:1912
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
        2⤵
          PID:1852
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
          2⤵
            PID:1332
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
            2⤵
              PID:1016
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Setup.exe"
              2⤵
                PID:1552
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
                2⤵
                  PID:532
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
                  2⤵
                    PID:1440
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
                    2⤵
                      PID:832
                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
                      2⤵
                        PID:240
                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
                        2⤵
                          PID:1564
                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
                          2⤵
                            PID:1628
                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
                            2⤵
                              PID:1328
                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
                              2⤵
                                PID:1824
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
                                2⤵
                                  PID:1180
                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
                                  2⤵
                                    PID:1488
                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
                                    2⤵
                                      PID:1996
                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
                                      2⤵
                                        PID:1868
                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
                                        2⤵
                                          PID:1044
                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
                                          2⤵
                                            PID:1956
                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
                                            2⤵
                                              PID:1176
                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
                                              2⤵
                                                PID:948
                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
                                                2⤵
                                                  PID:1064
                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
                                                  2⤵
                                                    PID:1084
                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
                                                    2⤵
                                                      PID:1920
                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
                                                      2⤵
                                                        PID:1212
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
                                                        2⤵
                                                          PID:1688
                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
                                                          2⤵
                                                            PID:1008
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                                                            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
                                                            2⤵
                                                              PID:1872
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
                                                              2⤵
                                                                PID:1400
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
                                                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
                                                                2⤵
                                                                  PID:1240
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                                                                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                                                                  2⤵
                                                                    PID:1664
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
                                                                    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
                                                                    2⤵
                                                                      PID:1036
                                                                    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
                                                                      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
                                                                      2⤵
                                                                        PID:436

                                                                    Network

                                                                    MITRE ATT&CK Matrix ATT&CK v6

                                                                    Initial Access

                                                                    Execution

                                                                    Scripting

                                                                    1
                                                                    T1064

                                                                    Persistence

                                                                    Registry Run Keys / Startup Folder

                                                                    1
                                                                    T1060

                                                                    Privilege Escalation

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1088

                                                                    Defense Evasion

                                                                    Bypass User Account Control

                                                                    1
                                                                    T1088

                                                                    Disabling Security Tools

                                                                    1
                                                                    T1089

                                                                    Modify Registry

                                                                    3
                                                                    T1112

                                                                    Virtualization/Sandbox Evasion

                                                                    2
                                                                    T1497

                                                                    Scripting

                                                                    1
                                                                    T1064

                                                                    Credential Access

                                                                    Discovery

                                                                    Query Registry

                                                                    4
                                                                    T1012

                                                                    Virtualization/Sandbox Evasion

                                                                    2
                                                                    T1497

                                                                    System Information Discovery

                                                                    4
                                                                    T1082

                                                                    Peripheral Device Discovery

                                                                    1
                                                                    T1120

                                                                    Lateral Movement

                                                                    Collection

                                                                    Exfiltration

                                                                    Command and Control

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • memory/872-62-0x000000001B3D0000-0x000000001B6B2000-memory.dmp
                                                                      Filesize

                                                                      2.9MB

                                                                      Download
                                                                    • memory/872-63-0x0000000001DE0000-0x0000000001DE8000-memory.dmp
                                                                      Filesize

                                                                      32KB

                                                                      Download
                                                                    • memory/872-64-0x00000000028D0000-0x0000000002950000-memory.dmp
                                                                      Filesize

                                                                      512KB

                                                                      Download
                                                                    • memory/872-65-0x00000000028D0000-0x0000000002950000-memory.dmp
                                                                      Filesize

                                                                      512KB

                                                                      Download
                                                                    • memory/872-66-0x00000000028D0000-0x0000000002950000-memory.dmp
                                                                      Filesize

                                                                      512KB

                                                                      Download
                                                                    • memory/2040-54-0x00000000002A0000-0x00000000003B6000-memory.dmp
                                                                      Filesize

                                                                      1.1MB

                                                                      Download
                                                                    • memory/2040-55-0x000000001B2B0000-0x000000001B330000-memory.dmp
                                                                      Filesize

                                                                      512KB

                                                                      Download
                                                                    • memory/2040-56-0x000000001BD20000-0x000000001BE32000-memory.dmp
                                                                      Filesize

                                                                      1.1MB

                                                                      Download