Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/E...

windows10-2004-x64

Analysis

  • max time kernel
    107s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2023, 19:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    https://github.com/Endermanch/MalwareDatabase/blob/master/NoEscape.zip
  • Sample230331-yft4msec4x
Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/Endermanch/MalwareDatabase/blob/master/NoEscape.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4492 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2360
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:404
    • C:\Users\Admin\Downloads\NoEscape\NoEscape.exe
      "C:\Users\Admin\Downloads\NoEscape\NoEscape.exe"
      1⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Disables RegEdit via registry modification
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Drops file in Windows directory
      PID:4528
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3981855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:988
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:1480

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            • Size 471B
            • SHA256 8b1034038298faf34d3f580c1ded7212f40d146de7e62cff20826c8b53f80c36
            • MD5 SHA1 SHA512
            Submit Download

            7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            • Size 404B
            • SHA256 3324b7ab4241c6740a2f488815147ffbd58315f87a56116670190aedb26b7188
            • MD5 SHA1 SHA512
            Submit Download

            verA60.tmp
            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA60.tmp
            • Size 15KB
            • SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            imagestore.dat
            • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\cz9baam\imagestore.dat
            • Size 1KB
            • SHA256 13247ef85744557d083799e4fde8d4cbc817cce2c2605b54ddbb1b012fad167e
            • MD5 SHA1 SHA512
            Submit Download

            NoEscape[1].zip
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\NoEscape[1].zip
            • Size 616KB
            • SHA256 47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            favicon[1].png
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\favicon[1].png
            • Size 958B
            • SHA256 74cf90ac2fe6624ab1056cacea11cf7ed4f8bef54bbb0e869638013bba45bc08
            • MD5 SHA1 SHA512
            Submit Download

            suggestions[1].en-US
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\suggestions[1].en-US
            • Size 17KB
            • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            NoEscape.zip.4eugclj.partial
            • Path C:\Users\Admin\Downloads\NoEscape.zip.4eugclj.partial
            • Size 616KB
            • SHA256 47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ᪶៸ᘢᝳޢ⭉᜽ᄒ⫇᪹ठ╬ⱬᔰቆᣐ⛃⴮₎⯶
            • Path C:\Users\Public\Desktop\᪶៸ᘢᝳޢ⭉᜽ᄒ⫇᪹ठ╬ⱬᔰቆᣐ⛃⴮₎⯶
            • Size 666B
            • SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
            • MD5 SHA1 SHA512
            Submit Download

            memory/4528-336-0x0000000000400000-0x00000000005CC000-memory.dmp
            Download

            memory/4528-512-0x0000000000400000-0x00000000005CC000-memory.dmp
            Download