Analysis

  • max time kernel
    146s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2023, 06:34

General

  • Target

    9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe

  • Size

    889KB

  • MD5

    771b63756e09ab724dc4ae1c58d4cee4

  • SHA1

    891f864d16cdfe0e24e87089fed7ddd74de3f181

  • SHA256

    9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9

  • SHA512

    596c07a404a1972e9892c288348fbc0605fdeb9a58af5df4be5cab86c1f1da5d073c64b5844314d595a1f6143a0c8567156d1d66e85b0d7f0fae9be74498fb2c

  • SSDEEP

    6144:PJ1etoAWIVpTiAKhft1JEqwLcEOkCybEaQRXr9HNdvOa7AXGSqLr4Eza:hAoo7i5FMqwTOkx2LIa0EC

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:424
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe
        "C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe"
        2⤵
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe"
          3⤵
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:2816
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            4⤵
            • Delays execution with timeout.exe
            PID:2208
      • C:\Windows\Inf\tabcal.exe
        "C:\Windows\Inf\tabcal.exe"
        2⤵
        • Executes dropped EXE
        PID:2872
    • C:\Windows\Syswow64\edd61628
      C:\Windows\Syswow64\edd61628
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\edd61628"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1352
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 1
          3⤵
          • Delays execution with timeout.exe
          PID:1780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Tar94A2.tmp

      Filesize

      163KB

      MD5

      9441737383d21192400eca82fda910ec

      SHA1

      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

      SHA256

      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

      SHA512

      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    • C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    • C:\Windows\SysWOW64\edd61628

      Filesize

      889KB

      MD5

      9100dcb2d80ba5f75a14f1068ad009fc

      SHA1

      3bc85afad70d8feb1ae8fed79c32163a0444cf74

      SHA256

      772cd4111b1fbe69a109fc5750de13d15aa59be4c6fba123a012be481318412f

      SHA512

      ff2e8ef98980505cc0c5dea48a9f24d13ed8c866865e8acb84b85cb8ff48d5ec38bc386325258bb2aca169146386eecf0ada9aee860c211295f3d9c042f4f337

    • C:\Windows\Syswow64\edd61628

      Filesize

      889KB

      MD5

      9100dcb2d80ba5f75a14f1068ad009fc

      SHA1

      3bc85afad70d8feb1ae8fed79c32163a0444cf74

      SHA256

      772cd4111b1fbe69a109fc5750de13d15aa59be4c6fba123a012be481318412f

      SHA512

      ff2e8ef98980505cc0c5dea48a9f24d13ed8c866865e8acb84b85cb8ff48d5ec38bc386325258bb2aca169146386eecf0ada9aee860c211295f3d9c042f4f337

    • C:\Windows\inf\tabcal.exe

      Filesize

      77KB

      MD5

      98e7911befe83f76777317ce6905666d

      SHA1

      2780088dffe1dd1356c5dd5112a9f04afee3ee8d

      SHA256

      3fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1

      SHA512

      fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6

    • \Windows\inf\tabcal.exe

      Filesize

      77KB

      MD5

      98e7911befe83f76777317ce6905666d

      SHA1

      2780088dffe1dd1356c5dd5112a9f04afee3ee8d

      SHA256

      3fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1

      SHA512

      fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6

    • memory/424-60-0x0000000000770000-0x0000000000798000-memory.dmp

      Filesize

      160KB

    • memory/1032-4-0x0000000000C30000-0x0000000000CBE000-memory.dmp

      Filesize

      568KB

    • memory/1032-54-0x0000000000C30000-0x0000000000CBE000-memory.dmp

      Filesize

      568KB

    • memory/1032-0-0x0000000000C30000-0x0000000000CBE000-memory.dmp

      Filesize

      568KB

    • memory/1180-21-0x00000000029B0000-0x00000000029B3000-memory.dmp

      Filesize

      12KB

    • memory/1180-22-0x00000000064C0000-0x00000000065B7000-memory.dmp

      Filesize

      988KB

    • memory/1180-19-0x00000000029B0000-0x00000000029B3000-memory.dmp

      Filesize

      12KB

    • memory/1180-82-0x0000000002A70000-0x0000000002A71000-memory.dmp

      Filesize

      4KB

    • memory/1180-23-0x00000000064C0000-0x00000000065B7000-memory.dmp

      Filesize

      988KB

    • memory/1180-81-0x0000000006A60000-0x0000000006B2B000-memory.dmp

      Filesize

      812KB

    • memory/1180-73-0x000007FEBE980000-0x000007FEBE990000-memory.dmp

      Filesize

      64KB

    • memory/1180-71-0x0000000002A70000-0x0000000002A71000-memory.dmp

      Filesize

      4KB

    • memory/1180-70-0x0000000006A60000-0x0000000006B2B000-memory.dmp

      Filesize

      812KB

    • memory/1180-46-0x00000000064C0000-0x00000000065B7000-memory.dmp

      Filesize

      988KB

    • memory/1180-69-0x0000000006A60000-0x0000000006B2B000-memory.dmp

      Filesize

      812KB

    • memory/1180-20-0x00000000029B0000-0x00000000029B3000-memory.dmp

      Filesize

      12KB

    • memory/2484-58-0x0000000000E20000-0x0000000000EAE000-memory.dmp

      Filesize

      568KB

    • memory/2484-45-0x0000000000E20000-0x0000000000EAE000-memory.dmp

      Filesize

      568KB

    • memory/2484-96-0x0000000000E20000-0x0000000000EAE000-memory.dmp

      Filesize

      568KB

    • memory/2484-6-0x0000000000E20000-0x0000000000EAE000-memory.dmp

      Filesize

      568KB

    • memory/2484-3-0x0000000000E20000-0x0000000000EAE000-memory.dmp

      Filesize

      568KB

    • memory/2872-27-0x0000000000060000-0x0000000000123000-memory.dmp

      Filesize

      780KB

    • memory/2872-50-0x0000000001CA0000-0x0000000001D6B000-memory.dmp

      Filesize

      812KB

    • memory/2872-49-0x0000000001CA0000-0x0000000001D6B000-memory.dmp

      Filesize

      812KB

    • memory/2872-44-0x000007FEBE980000-0x000007FEBE990000-memory.dmp

      Filesize

      64KB

    • memory/2872-43-0x0000000001CA0000-0x0000000001D6B000-memory.dmp

      Filesize

      812KB

    • memory/2872-41-0x0000000001CA0000-0x0000000001D6B000-memory.dmp

      Filesize

      812KB

    • memory/2872-35-0x0000000000160000-0x0000000000163000-memory.dmp

      Filesize

      12KB

    • memory/2872-29-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB