140f2e0a4f4163af3dc66274beb504a5ff554a46297c27ec039077b8d211b56f

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21/05/2023, 10:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

recoverit_setup_full4174.exe
Size

1.2MB
MD5

3e01349dab2dbe1158981ed976ca59f9
SHA1

47189c1ec868823309193083a5b6311677893097
SHA256

140f2e0a4f4163af3dc66274beb504a5ff554a46297c27ec039077b8d211b56f
SHA512

96125b025e4117c376f1d4c5e54529fa69f0848049e086c5e264c1f597b46d4e6d8be4bfaea9f618375ee53e88b949e84d9892328b56ade27658f6cfff1a9625
SSDEEP

24576:XOXAaO/6uSLYnFYARGDgrq/fSdYHhC/+EXNP7HkBNqEL7jtf6408:srW6uSLYnPRGDgrq/X0/lON9L7jk4J

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2272	NFWCHK.exe

Loads dropped DLL 1 IoCs

pid	Process
2044	recoverit_setup_full4174.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	recoverit_setup_full4174.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	recoverit_setup_full4174.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	recoverit_setup_full4174.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	recoverit_setup_full4174.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	recoverit_setup_full4174.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2044	recoverit_setup_full4174.exe
2044	recoverit_setup_full4174.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2272	2044	recoverit_setup_full4174.exe	29
PID 2044 wrote to memory of 2272	2044	recoverit_setup_full4174.exe	29
PID 2044 wrote to memory of 2272	2044	recoverit_setup_full4174.exe	29
PID 2044 wrote to memory of 2272	2044	recoverit_setup_full4174.exe	29

C:\Users\Admin\AppData\Local\Temp\recoverit_setup_full4174.exe
"C:\Users\Admin\AppData\Local\Temp\recoverit_setup_full4174.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  C:\Users\Public\Documents\Wondershare\NFWCHK.exe
  2⤵
  - Executes dropped EXE
  PID:2272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\wsWAE.log

Filesize
1KB

MD5
087d1ce808970fe1c4b747d6456b36c6

SHA1
87ddeb405a9198a3def61c4eecfa330337b1ca73

SHA256
b2d33b98802c248a1b65d7f06691de3ce3de56cb22ee559405c61a81a9fe43cc

SHA512
c3db0b25ce8abd72a253cb89eb77ab8875954d55076fe69851f14ef0821ba638b791aebb7efbf54baef7423965f9ed49a6eaebd7b9ca776f8d070c9e10b97f1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log

Filesize
2KB

MD5
684cc7ebf8644db016547967e17ac846

SHA1
3edeae7447ed6cd718e9445e5b51d8838bfc66bf

SHA256
a6da36f97e429ab053d7483a3b082b1404b4f26425f547862a29df28312ac786

SHA512
2b48d4c9a407b18c96d3177a356906816df9180556f9ad1b220e10485fd3de7ac4bdf15cda2f5efb9fef2b1c4befc5cd25ab9f1e6df43d36fd5945c08a1fed20

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log

Filesize
4KB

MD5
434dcf29e01152b10cebc5804952ea89

SHA1
f0c8e0a7463c5408733173ba6c92254016905e6b

SHA256
7d816785c7aec55c28713bacb14ea2fb06b3da28b96c9972be4e481571c39d57

SHA512
9951f452a32a1a93714821fb23a85bad863e252d9818aedd0d81a2fef19d789e378656c6f2098f564e16472271952c5f79385a3ee98d8a23ec8c874e8a25da21

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsWAE.log

Filesize
716B

MD5
b41506ab4654d5916827f58819a2488f

SHA1
cca27aaa6f9a11298bc9af0c237dce0475b2570f

SHA256
f2c3cbd115283257817c8c34cb31d07fdc6eac430ab2501b4dc41d61718542e0

SHA512
5e378eb8223645336de9d4bc43efd4af7d447e1ece6e1015d5c3c041a94e70e2288ed9452ad12e25a7ec359ebe43ca90094f281c9f3d4e4aaad5ce252e78e452

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
1KB

MD5
ae35e7a10a74b7b884a9ce245eedc9e8

SHA1
9622c3a3fce1eed60b495fd3bcbec34f726962cd

SHA256
5036272e364869b3607ec6276045d9e6ac135c9c724dcee4e9517ff4ff0f9ed3

SHA512
1e614d5256f2f0b072444df8625a3a2d47d9344c76390071d2776ffe022b26e48c9526b37afb10583b052ea3697074e4bb86aecceb0bf8c6021592799847211e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
1KB

MD5
ae35e7a10a74b7b884a9ce245eedc9e8

SHA1
9622c3a3fce1eed60b495fd3bcbec34f726962cd

SHA256
5036272e364869b3607ec6276045d9e6ac135c9c724dcee4e9517ff4ff0f9ed3

SHA512
1e614d5256f2f0b072444df8625a3a2d47d9344c76390071d2776ffe022b26e48c9526b37afb10583b052ea3697074e4bb86aecceb0bf8c6021592799847211e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsduilib.log

Filesize
7KB

MD5
57ee996fcdc4871fe4ae70349d1daa62

SHA1
da7bd7f976b9ca3a6a744878706432313661ca72

SHA256
94b8a8ec3d2a565fb1b1fc432f7d45ae3a88268fb9c8239d039febb478b80102

SHA512
a06849efdb9ccfb95d018adf79dabec9e44baf12c512eb0986b817f7715b48ba10e9261f831a8b5ad8cc2acc17b99a8191d159ee5bed3cba114505b1f1df3284

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
C:\Users\Public\Documents\Wondershare\NFWCHK.exe.config

Filesize
229B

MD5
ad0967a0ab95aa7d71b3dc92b71b8f7a

SHA1
ed63f517e32094c07a2c5b664ed1cab412233ab5

SHA256
9c1212bc648a2533b53a2d0afcec518846d97630afb013742a9622f0df7b04fc

SHA512
85766a907331f60044ec205cf345453fc3d44bfcac296ac93a12e8a752b84290dfd94f73b71de82f46f9503177d29602cbb87549f89dc61373d889b4ea26634b

Download Submit
\Users\Public\Documents\Wondershare\NFWCHK.exe

Filesize
7KB

MD5
27cfb3990872caa5930fa69d57aefe7b

SHA1
5e1c80d61e8db0cdc0c9b9fa3b2e36d156d45f8f

SHA256
43881549228975c7506b050bce4d9b671412d3cdc08c7516c9dbbb7f50c25146

SHA512
a1509024872c99c1cf63f42d9f3c5f063afde4e9490c21611551ddd2322d136ce9240256113c525305346cf7b66ccca84c3df67637c8fecbfeebf14ffa373a2a

Download Submit
memory/2272-1113-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads