7c4c19bdc7f712ffd61d0d3be3b29c7879d2e619579b5679a8752df806fe35f3

Analysis

max time kernel
34s
max time network
20s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
20-08-2023 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Luxury Shield/Luxury Shield.exe
Size

6.1MB
MD5

40955751ffb3df0dd4cef5728cb0a2c5
SHA1

6219105ac9261fd9eedaf9eb103f2a856e43b4ba
SHA256

07c5f5c6595f9ccb544b2d78677fce86084b1821474216a6d3d3241701d4692c
SHA512

a9bf58a9ef3dbaf01fe42b00dbad3c0455dc9d2da78833a1c05bc98992722ed044d90529272dfaedb62d1c9d09b3336774b82015c74fdc9d1279596756639808
SSDEEP

196608:nUJ5nwUlVzBvx4DkwjdtBC5U45+YXGJPVc9hC:UJhfBv67d/C6YXGJdc9hC

Score

7^/10

agilenet

Malware Config

Signatures

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral9/memory/2340-55-0x0000000006150000-0x00000000067C8000-memory.dmp	net_reactor
behavioral9/memory/2340-57-0x00000000067D0000-0x0000000006E46000-memory.dmp	net_reactor

Loads dropped DLL 1 IoCs

Processes:

Luxury Shield.exe

pid process

2340 Luxury Shield.exe

pid	process
2340	Luxury Shield.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral9/memory/2340-58-0x0000000006F60000-0x00000000071AC000-memory.dmp	agile_net
behavioral9/memory/2340-72-0x0000000008720000-0x0000000008820000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

Processes:

Luxury Shield.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Luxury Shield.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Luxury Shield.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Luxury Shield.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Luxury Shield.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Luxury Shield.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Luxury Shield.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Luxury Shield.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	Luxury Shield.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Luxury Shield.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Luxury Shield.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	Luxury Shield.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_Classes\Local Settings	Luxury Shield.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Luxury Shield.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Luxury Shield.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Luxury Shield.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	Luxury Shield.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	Luxury Shield.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	Luxury Shield.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Luxury Shield.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Luxury Shield.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

Luxury Shield.exe

pid process

2340 Luxury Shield.exe
2340 Luxury Shield.exe
2340 Luxury Shield.exe
2340 Luxury Shield.exe
2340 Luxury Shield.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Luxury Shield.exe

pid process

2340 Luxury Shield.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Luxury Shield.exe

description pid process

Token: SeDebugPrivilege 2340 Luxury Shield.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Luxury Shield.exe

pid process

2340 Luxury Shield.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Luxury Shield.exe

pid process

2340 Luxury Shield.exe
2340 Luxury Shield.exe
2340 Luxury Shield.exe

pid	process
2340	Luxury Shield.exe
2340	Luxury Shield.exe
2340	Luxury Shield.exe
2340	Luxury Shield.exe
2340	Luxury Shield.exe

pid	process
2340	Luxury Shield.exe

description	pid	process
Token: SeDebugPrivilege	2340	Luxury Shield.exe

pid	process
2340	Luxury Shield.exe

pid	process
2340	Luxury Shield.exe
2340	Luxury Shield.exe
2340	Luxury Shield.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Luxury Shield.exe

description	pid	process	target process
PID 2340 wrote to memory of 2004	2340	Luxury Shield.exe	ILMerge.exe
PID 2340 wrote to memory of 2004	2340	Luxury Shield.exe	ILMerge.exe
PID 2340 wrote to memory of 2004	2340	Luxury Shield.exe	ILMerge.exe
PID 2340 wrote to memory of 2004	2340	Luxury Shield.exe	ILMerge.exe

C:\Users\Admin\AppData\Local\Temp\Luxury Shield\Luxury Shield.exe
"C:\Users\Admin\AppData\Local\Temp\Luxury Shield\Luxury Shield.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340

C:\Users\Admin\AppData\Local\Temp\Luxury Shield\ILMerge.exe
"C:\Users\Admin\AppData\Local\Temp\Luxury Shield\ILMerge.exe"
2⤵
PID:2004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

Filesize
136KB

MD5
9af5eb006bb0bab7f226272d82c896c7

SHA1
c2a5bb42a5f08f4dc821be374b700652262308f0

SHA256
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

SHA512
7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

Download Submit
\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

Filesize
136KB

MD5
9af5eb006bb0bab7f226272d82c896c7

SHA1
c2a5bb42a5f08f4dc821be374b700652262308f0

SHA256
77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

SHA512
7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

Download Submit
memory/2004-82-0x000007FEF50A0000-0x000007FEF5A3D000-memory.dmp

Filesize
9.6MB

Download
memory/2004-83-0x0000000000550000-0x00000000005D0000-memory.dmp

Filesize
512KB

Download
memory/2004-81-0x000007FEF50A0000-0x000007FEF5A3D000-memory.dmp

Filesize
9.6MB

Download
memory/2004-80-0x00000000002D0000-0x000000000037C000-memory.dmp

Filesize
688KB

Download
memory/2340-77-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-57-0x00000000067D0000-0x0000000006E46000-memory.dmp

Filesize
6.5MB

Download
memory/2340-65-0x00000000736C0000-0x00000000736F7000-memory.dmp

Filesize
220KB

Download
memory/2340-58-0x0000000006F60000-0x00000000071AC000-memory.dmp

Filesize
2.3MB

Download
memory/2340-67-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-68-0x000000000D9D0000-0x000000000E284000-memory.dmp

Filesize
8.7MB

Download
memory/2340-69-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-70-0x0000000008830000-0x000000000894A000-memory.dmp

Filesize
1.1MB

Download
memory/2340-71-0x0000000008970000-0x00000000089D6000-memory.dmp

Filesize
408KB

Download
memory/2340-72-0x0000000008720000-0x0000000008820000-memory.dmp

Filesize
1024KB

Download
memory/2340-74-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2340-73-0x000000000EF10000-0x000000000EF72000-memory.dmp

Filesize
392KB

Download
memory/2340-75-0x000000000EFA0000-0x000000000EFAA000-memory.dmp

Filesize
40KB

Download
memory/2340-76-0x000000000F0A0000-0x000000000F0C6000-memory.dmp

Filesize
152KB

Download
memory/2340-53-0x0000000073F50000-0x000000007463E000-memory.dmp

Filesize
6.9MB

Download
memory/2340-78-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-79-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-66-0x0000000073D70000-0x0000000073DF0000-memory.dmp

Filesize
512KB

Download
memory/2340-56-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-84-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-54-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-55-0x0000000006150000-0x00000000067C8000-memory.dmp

Filesize
6.5MB

Download
memory/2340-85-0x00000000736C0000-0x00000000736F7000-memory.dmp

Filesize
220KB

Download
memory/2340-89-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-88-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-87-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-86-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-92-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-93-0x0000000008720000-0x0000000008820000-memory.dmp

Filesize
1024KB

Download
memory/2340-94-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-96-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-95-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-97-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-98-0x0000000005A90000-0x0000000005AD0000-memory.dmp

Filesize
256KB

Download
memory/2340-99-0x0000000010A40000-0x0000000010A41000-memory.dmp

Filesize
4KB

Download
memory/2340-100-0x0000000008B10000-0x0000000008B12000-memory.dmp

Filesize
8KB

Download