Overview

overview

10

Static

static

1

URLScan

urlscan

https://www.youtube....

windows10-2004-x64

Analysis

  • max time kernel
    101s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2023, 22:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbURLdi1vTEtCRGJVSlhDTDJqMGtDR1JvZHFJZ3xBQ3Jtc0ttb3ZLWE16c1ZxZTRHdk5aNUZUZzYydVo3bHF2STRaU2U1VV9xdEdRRlFHVF8wWTdPU0tWMm0xb1VuWWgxVm5Bc25MbzItSFAxUEFnaXhVZkVkYnR1bDUxdHZ0LVBRX1B5ZWNCWTNEZ1g2YmY3bUJJYw&q=https%3A%2F%2Fgithub.com%2FEndermanch%2FMalwareDatabase%2Fraw%2Fmaster%2FNoEscape.zip&v=4oATWyMMH4A
  • Sample230331-15twaafc2z
Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies WinLogon 2 TTPs 3 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 2 IoCs
  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 5 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbURLdi1vTEtCRGJVSlhDTDJqMGtDR1JvZHFJZ3xBQ3Jtc0ttb3ZLWE16c1ZxZTRHdk5aNUZUZzYydVo3bHF2STRaU2U1VV9xdEdRRlFHVF8wWTdPU0tWMm0xb1VuWWgxVm5Bc25MbzItSFAxUEFnaXhVZkVkYnR1bDUxdHZ0LVBRX1B5ZWNCWTNEZ1g2YmY3bUJJYw&q=https%3A%2F%2Fgithub.com%2FEndermanch%2FMalwareDatabase%2Fraw%2Fmaster%2FNoEscape.zip&v=4oATWyMMH4A
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4360 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:368
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4952
    • C:\Program Files\7-Zip\7zG.exe
      "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NoEscape\" -spe -an -ai#7zMap19573:78:7zEvent29074
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4168
    • C:\Users\Admin\Downloads\NoEscape\NoEscape.exe
      "C:\Users\Admin\Downloads\NoEscape\NoEscape.exe"
      1⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Modifies WinLogon
      • Sets desktop wallpaper using registry
      • Drops file in Windows directory
      • Modifies Control Panel
      • System policy modification
      PID:3276
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3998855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:2740

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Size 471B
          • SHA256 8b1034038298faf34d3f580c1ded7212f40d146de7e62cff20826c8b53f80c36
          • MD5 SHA1 SHA512
          Submit Download

          7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
          • Size 434B
          • SHA256 71922186b7192e5c777a52e2f84ff5dc24549aa17f0b922efc33eb3dda928e5b
          • MD5 SHA1 SHA512
          Submit Download

          verE822.tmp
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verE822.tmp
          • Size 15KB
          • SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          imagestore.dat
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\feo4h2u\imagestore.dat
          • Size 478B
          • SHA256 85ab325afe6d0e42f4d8fddd074634fc4341242b2c18646c3b8cd5bdcce343de
          • MD5 SHA1 SHA512
          Submit Download

          NoEscape[1].zip
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\NoEscape[1].zip
          • Size 616KB
          • SHA256 47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          suggestions[1].en-US
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6K3GJRJ1\suggestions[1].en-US
          • Size 17KB
          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          favicon_32[1].png
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UUIKWEAJ\favicon_32[1].png
          • Size 348B
          • SHA256 571c382651d6337cd5fa49c512d02f0f99d523a896b87175fb59c710e1fcbc7a
          • MD5 SHA1 SHA512
          Submit Download

          NoEscape.zip.2mkujdz.partial
          • Path C:\Users\Admin\Downloads\NoEscape.zip.2mkujdz.partial
          • Size 616KB
          • SHA256 47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NoEscape.exe
          • Path C:\Users\Admin\Downloads\NoEscape\NoEscape.exe
          • Size 666KB
          • SHA256 d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          NoEscape.exe
          • Path C:\Users\Admin\Downloads\NoEscape\NoEscape.exe
          • Size 666KB
          • SHA256 d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ኁ⸎໨⪂⃵ಹ஡⓵ヰ᧾Ꮚ⧇రᄝ᧬Ⳙ
          • Path C:\Users\Public\Desktop\ኁ⸎໨⪂⃵ಹ஡⓵ヰ᧾Ꮚ⧇రᄝ᧬Ⳙ
          • Size 666B
          • SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
          • MD5 SHA1 SHA512
          Submit Download

          memory/3276-205-0x0000000000400000-0x00000000005CC000-memory.dmp
          Download

          memory/3276-381-0x0000000000400000-0x00000000005CC000-memory.dmp
          Download