Analysis

  • max time kernel
    139s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/08/2023, 06:15

General

  • Target

    overlaycrypt.exe

  • Size

    846KB

  • MD5

    0f6ffc2e70d312972d592fd43d49b10c

  • SHA1

    1be29b9bf2da79e428f3e2ed95b25880b72cbc0c

  • SHA256

    7bcde76356cbd428ffd4fd3288f1f07d49db7d3d772b9671bfa2bb1f98a3ae17

  • SHA512

    71daeb9d2c213caf896a0cfcad6336c29e5c0645248fd26805ffa915ec69886639c704a4b3e1c6cd9c1412dbfff041d8efc7b60aeae69ae79a18aa81d0f4a600

  • SSDEEP

    12288:nByKFBp5YVGAVUOJNcTUW91MPSNZm6wZUkmLB7j/QFU0u0cql03za+9rSdfDG:EKrp5YoOJ41MCzwZU3LG9/2DayufD

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\overlaycrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\overlaycrypt.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4504
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell set-mppreference -exclusionpath C:\
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4024
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell set-mppreference -exclusionpath C:\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2336
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\SysWOW64\cmd.exe
        /c ""C:\Windows\System32\curl.exe" --output "C:\Users\Admin\AppData\Local\TE1NTUVR\temp.cab" --url https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/f29ffab2-0ad8-427f-8002-e8d6568524f1/Microsoft.WebView2.FixedVersionRuntime.107.0.1418.42.x86.cab"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1904
        • C:\Windows\SysWOW64\curl.exe
          "C:\Windows\System32\curl.exe" --output "C:\Users\Admin\AppData\Local\TE1NTUVR\temp.cab" --url https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/f29ffab2-0ad8-427f-8002-e8d6568524f1/Microsoft.WebView2.FixedVersionRuntime.107.0.1418.42.x86.cab
          4⤵
            PID:4728
        • C:\Windows\SysWOW64\cmd.exe
          /c ""C:\Windows\System32\expand.exe" "C:\Users\Admin\AppData\Local\TE1NTUVR\temp.cab" -F:* "C:\Users\Admin\AppData\Local\TE1NTUVR""
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3136
          • C:\Windows\SysWOW64\expand.exe
            "C:\Windows\System32\expand.exe" "C:\Users\Admin\AppData\Local\TE1NTUVR\temp.cab" -F:* "C:\Users\Admin\AppData\Local\TE1NTUVR"
            4⤵
            • Drops file in Windows directory
            PID:2844

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f4jsker1.byp.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • \??\c:\users\admin\appdata\local\te1ntuvr\temp.cab

      Filesize

      173.8MB

      MD5

      56d897c072901d6f6ab953b650ddb5a8

      SHA1

      304b6bff606a2bfe3610de4015acef2f74aaeab6

      SHA256

      5fe632de6bf14adde890b7ac74c62d3e493807858e5fa2e697898af8696cd698

      SHA512

      4f631e5cca2c0c9f9c6347e2cf31933cf59aba098613ce6e4551685cdf47d1c3cc4d833020b85c59b35c150c5b5c032efa653b90b6bed4359ff43eacf7e39c5e

    • memory/2336-1259-0x0000000070030000-0x000000007007C000-memory.dmp

      Filesize

      304KB

    • memory/2336-1222-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

      Filesize

      64KB

    • memory/2336-1278-0x0000000007160000-0x000000000717A000-memory.dmp

      Filesize

      104KB

    • memory/2336-1277-0x0000000007050000-0x000000000705E000-memory.dmp

      Filesize

      56KB

    • memory/2336-1220-0x0000000074940000-0x00000000750F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2336-1275-0x00000000070A0000-0x0000000007136000-memory.dmp

      Filesize

      600KB

    • memory/2336-1274-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

      Filesize

      64KB

    • memory/2336-1273-0x0000000006E90000-0x0000000006E9A000-memory.dmp

      Filesize

      40KB

    • memory/2336-1272-0x0000000006E30000-0x0000000006E4A000-memory.dmp

      Filesize

      104KB

    • memory/2336-1271-0x0000000007490000-0x0000000007B0A000-memory.dmp

      Filesize

      6.5MB

    • memory/2336-1270-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

      Filesize

      64KB

    • memory/2336-1257-0x000000007FC20000-0x000000007FC30000-memory.dmp

      Filesize

      64KB

    • memory/2336-1279-0x0000000007140000-0x0000000007148000-memory.dmp

      Filesize

      32KB

    • memory/2336-1219-0x0000000000D10000-0x0000000000D46000-memory.dmp

      Filesize

      216KB

    • memory/2336-1269-0x00000000060A0000-0x00000000060BE000-memory.dmp

      Filesize

      120KB

    • memory/2336-1256-0x0000000074940000-0x00000000750F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2336-1251-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

      Filesize

      64KB

    • memory/2336-1244-0x0000000005B00000-0x0000000005B1E000-memory.dmp

      Filesize

      120KB

    • memory/2336-1282-0x0000000074940000-0x00000000750F0000-memory.dmp

      Filesize

      7.7MB

    • memory/2336-1234-0x0000000005410000-0x0000000005476000-memory.dmp

      Filesize

      408KB

    • memory/2336-1233-0x00000000052F0000-0x0000000005356000-memory.dmp

      Filesize

      408KB

    • memory/2336-1232-0x0000000004AA0000-0x0000000004AC2000-memory.dmp

      Filesize

      136KB

    • memory/2336-1230-0x0000000004C50000-0x0000000005278000-memory.dmp

      Filesize

      6.2MB

    • memory/2336-1221-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

      Filesize

      64KB

    • memory/2336-1258-0x00000000060C0000-0x00000000060F2000-memory.dmp

      Filesize

      200KB

    • memory/3048-1228-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3048-1276-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/4504-162-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-170-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-188-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-190-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-192-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-194-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-196-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-198-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-200-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-202-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-594-0x0000000074940000-0x00000000750F0000-memory.dmp

      Filesize

      7.7MB

    • memory/4504-1210-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

      Filesize

      64KB

    • memory/4504-1217-0x0000000005060000-0x0000000005061000-memory.dmp

      Filesize

      4KB

    • memory/4504-184-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-182-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-180-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-178-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-176-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-1229-0x0000000074940000-0x00000000750F0000-memory.dmp

      Filesize

      7.7MB

    • memory/4504-174-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-172-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-186-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-168-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-166-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-164-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-133-0x0000000074940000-0x00000000750F0000-memory.dmp

      Filesize

      7.7MB

    • memory/4504-160-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-158-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-156-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-154-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-152-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-150-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-148-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-146-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-144-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-142-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-140-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-139-0x0000000006440000-0x0000000006507000-memory.dmp

      Filesize

      796KB

    • memory/4504-138-0x0000000004E20000-0x0000000004E2A000-memory.dmp

      Filesize

      40KB

    • memory/4504-137-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

      Filesize

      64KB

    • memory/4504-136-0x0000000004D70000-0x0000000004E02000-memory.dmp

      Filesize

      584KB

    • memory/4504-135-0x0000000005320000-0x00000000058C4000-memory.dmp

      Filesize

      5.6MB

    • memory/4504-134-0x00000000002F0000-0x00000000003CA000-memory.dmp

      Filesize

      872KB