Analysis
-
max time kernel
45s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
03/09/2023, 06:34
Behavioral task
behavioral1
Sample
9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe
Resource
win10v2004-20230831-en
General
-
Target
9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe
-
Size
889KB
-
MD5
771b63756e09ab724dc4ae1c58d4cee4
-
SHA1
891f864d16cdfe0e24e87089fed7ddd74de3f181
-
SHA256
9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9
-
SHA512
596c07a404a1972e9892c288348fbc0605fdeb9a58af5df4be5cab86c1f1da5d073c64b5844314d595a1f6143a0c8567156d1d66e85b0d7f0fae9be74498fb2c
-
SSDEEP
6144:PJ1etoAWIVpTiAKhft1JEqwLcEOkCybEaQRXr9HNdvOa7AXGSqLr4Eza:hAoo7i5FMqwTOkx2LIa0EC
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\uLUYT20i.sys cscript.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Control Panel\International\Geo\Nation 9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe -
Executes dropped EXE 2 IoCs
pid Process 812 a8699670 1164 cscript.exe -
resource yara_rule behavioral2/memory/2108-0-0x0000000000580000-0x000000000060E000-memory.dmp upx behavioral2/files/0x0007000000023229-2.dat upx behavioral2/files/0x0007000000023229-3.dat upx behavioral2/memory/812-4-0x0000000000B10000-0x0000000000B9E000-memory.dmp upx behavioral2/memory/2108-5-0x0000000000580000-0x000000000060E000-memory.dmp upx behavioral2/memory/812-7-0x0000000000B10000-0x0000000000B9E000-memory.dmp upx behavioral2/memory/812-23-0x0000000000B10000-0x0000000000B9E000-memory.dmp upx behavioral2/memory/2108-29-0x0000000000580000-0x000000000060E000-memory.dmp upx behavioral2/memory/812-61-0x0000000000B10000-0x0000000000B9E000-memory.dmp upx behavioral2/memory/812-64-0x0000000000B10000-0x0000000000B9E000-memory.dmp upx -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.114.114 -
Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE a8699670 File created C:\Windows\system32\ \Windows\System32\goPFSvji.sys cscript.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content a8699670 File created C:\Windows\SysWOW64\a8699670 9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E a8699670 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft a8699670 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\cscript.exe Explorer.EXE File opened for modification C:\Program Files\Common Files\cscript.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\c3gJbhW.sys cscript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 cscript.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 3912 timeout.exe 4660 timeout.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\Software\Microsoft\Internet Explorer\New Windows\Allow cscript.exe Set value (data) \REGISTRY\USER\S-1-5-21-4272677097-406801653-1594978504-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.hao774.com cscript.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix a8699670 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" a8699670 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ a8699670 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" a8699670 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" a8699670 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" a8699670 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing a8699670 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" a8699670 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" a8699670 -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 812 a8699670 812 a8699670 812 a8699670 812 a8699670 812 a8699670 812 a8699670 812 a8699670 812 a8699670 812 a8699670 812 a8699670 708 Explorer.EXE 708 Explorer.EXE 708 Explorer.EXE 708 Explorer.EXE 812 a8699670 812 a8699670 1164 cscript.exe 1164 cscript.exe 1164 cscript.exe 1164 cscript.exe 1164 cscript.exe -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 684 Process not Found 684 Process not Found 684 Process not Found -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 2108 9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe Token: SeTcbPrivilege 2108 9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe Token: SeDebugPrivilege 812 a8699670 Token: SeTcbPrivilege 812 a8699670 Token: SeDebugPrivilege 812 a8699670 Token: SeDebugPrivilege 708 Explorer.EXE Token: SeDebugPrivilege 708 Explorer.EXE Token: SeIncBasePriorityPrivilege 2108 9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe Token: SeDebugPrivilege 812 a8699670 Token: SeShutdownPrivilege 708 Explorer.EXE Token: SeCreatePagefilePrivilege 708 Explorer.EXE Token: SeDebugPrivilege 1164 cscript.exe Token: SeDebugPrivilege 1164 cscript.exe Token: SeDebugPrivilege 1164 cscript.exe Token: SeIncBasePriorityPrivilege 812 a8699670 Token: SeDebugPrivilege 1164 cscript.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 812 wrote to memory of 708 812 a8699670 25 PID 812 wrote to memory of 708 812 a8699670 25 PID 812 wrote to memory of 708 812 a8699670 25 PID 812 wrote to memory of 708 812 a8699670 25 PID 812 wrote to memory of 708 812 a8699670 25 PID 708 wrote to memory of 1164 708 Explorer.EXE 88 PID 708 wrote to memory of 1164 708 Explorer.EXE 88 PID 708 wrote to memory of 1164 708 Explorer.EXE 88 PID 708 wrote to memory of 1164 708 Explorer.EXE 88 PID 708 wrote to memory of 1164 708 Explorer.EXE 88 PID 708 wrote to memory of 1164 708 Explorer.EXE 88 PID 708 wrote to memory of 1164 708 Explorer.EXE 88 PID 812 wrote to memory of 640 812 a8699670 6 PID 812 wrote to memory of 640 812 a8699670 6 PID 812 wrote to memory of 640 812 a8699670 6 PID 812 wrote to memory of 640 812 a8699670 6 PID 812 wrote to memory of 640 812 a8699670 6 PID 2108 wrote to memory of 464 2108 9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe 90 PID 2108 wrote to memory of 464 2108 9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe 90 PID 2108 wrote to memory of 464 2108 9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe 90 PID 464 wrote to memory of 3912 464 cmd.exe 92 PID 464 wrote to memory of 3912 464 cmd.exe 92 PID 464 wrote to memory of 3912 464 cmd.exe 92 PID 812 wrote to memory of 3920 812 a8699670 96 PID 812 wrote to memory of 3920 812 a8699670 96 PID 812 wrote to memory of 3920 812 a8699670 96 PID 3920 wrote to memory of 4660 3920 cmd.exe 98 PID 3920 wrote to memory of 4660 3920 cmd.exe 98 PID 3920 wrote to memory of 4660 3920 cmd.exe 98
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:640
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe"C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe"2⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\9ac9567d900573922ecadc81a165acb92d638fbc2eafe98f2d574e0e7f8428b9.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:3912
-
-
-
-
C:\Program Files\Common Files\cscript.exe"C:\Program Files\Common Files\cscript.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Windows\Syswow64\a8699670C:\Windows\Syswow64\a86996701⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\a8699670"2⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\timeout.exetimeout /t 13⤵
- Delays execution with timeout.exe
PID:4660
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157KB
MD524590bf74bbbbfd7d7ac070f4e3c44fd
SHA1cdfe517d07f18623778829aa98d6bbadd3f294cd
SHA256ae37fd1b642e797b36b9ffcec8a6e986732d011681061800c6b74426c28a9d03
SHA512ffaf2c86c9555513cdb51a7638f1fde3e8951a203aac63fd0aac62db297c853ac8c14e1a212c01d6b181df53e790f80489358489f6415d5c7fa53bfb8888bfa9
-
Filesize
889KB
MD58ed893ae0e8f27f40880f9227cae26fa
SHA18c66c531d6a0529399ae89b666983b32a580a5e4
SHA2568767cb968bedb583c5eeb3c389d6ea34389d35b33d241a5ee2afb28a87221baa
SHA512ab1d0b3da2c21d0730b1d5975dbcbe486b91e0c2882b241ec4829c628235a4c2db7190b87c38c33b8aaf310b1eaf72b397dae3d4bc4e4c6b1549a8d489d8f7e4
-
Filesize
889KB
MD58ed893ae0e8f27f40880f9227cae26fa
SHA18c66c531d6a0529399ae89b666983b32a580a5e4
SHA2568767cb968bedb583c5eeb3c389d6ea34389d35b33d241a5ee2afb28a87221baa
SHA512ab1d0b3da2c21d0730b1d5975dbcbe486b91e0c2882b241ec4829c628235a4c2db7190b87c38c33b8aaf310b1eaf72b397dae3d4bc4e4c6b1549a8d489d8f7e4