Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2023, 14:34

General

  • Target

    f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe

  • Size

    280KB

  • MD5

    61d5af8062275bfd4213106f731437d2

  • SHA1

    777b0c4202ae6a7c72129204d69963407c178094

  • SHA256

    f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10

  • SHA512

    077f441d30b23e91c3d3c886ea6b506986f6608dcfbec26416908f6ef2a3fa22ea85ebdf7bdd26901fae89341d2a870c34029ee069568b5b60bce288ea94e36b

  • SSDEEP

    6144:yXSQ8BCMis1TMrRQwy7eIeCDbFcEOkCybEaQRXr9HNdvOa:yXv8BCLocRZy7eIeyb1Okx2LIa

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 16 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:624
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Users\Admin\AppData\Local\Temp\f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe
        "C:\Users\Admin\AppData\Local\Temp\f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe"
        2⤵
        • Checks computer location settings
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\f14569088c650abd3d79f0489e148d4f3b0dca3dadfac841808dacdcf0c6cb10.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4440
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            4⤵
            • Delays execution with timeout.exe
            PID:2176
      • C:\ProgramData\Microsoft\mpnotify.exe
        "C:\ProgramData\Microsoft\mpnotify.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2332
    • C:\Windows\Syswow64\955be6e3
      C:\Windows\Syswow64\955be6e3
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3104
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Windows\Syswow64\955be6e3"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4040
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 1
          3⤵
          • Delays execution with timeout.exe
          PID:1616

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Microsoft\mpnotify.exe

      Filesize

      19KB

      MD5

      8f9739e266623499391cbac652a01036

      SHA1

      da16142d698dbbd243930e5058d7756f2204296d

      SHA256

      33f636f222a3af0bbbe429cc87b25b21b6c56182936c81c9453c4bdfb61a3c5e

      SHA512

      d5e562332b4bcd77c7c4c426491e37d3501388656e51f600fb6f007a59675d3ad5669487e730a38af705e94e2746f1bd9238190fe1c6152229096a5180aa3797

    • C:\Windows\SysWOW64\955be6e3

      Filesize

      280KB

      MD5

      997740488eb4f875a6696ac96520302b

      SHA1

      d409e698e370c58e765829672bcfa3d8ec64e486

      SHA256

      5608f96513eec84923dce8dc0a046a659a20a6a4b32dacd51a92eaeb4a58078b

      SHA512

      620064c55ac50848ff94bbaf6a0216b6bacfa26fd8f0656dffbd36532cbde3258ce88cda9a305307d283fdd9d449f0db6f51c89724ddaa69040a56cbe4ee2fb1

    • C:\Windows\SysWOW64\955be6e3

      Filesize

      280KB

      MD5

      997740488eb4f875a6696ac96520302b

      SHA1

      d409e698e370c58e765829672bcfa3d8ec64e486

      SHA256

      5608f96513eec84923dce8dc0a046a659a20a6a4b32dacd51a92eaeb4a58078b

      SHA512

      620064c55ac50848ff94bbaf6a0216b6bacfa26fd8f0656dffbd36532cbde3258ce88cda9a305307d283fdd9d449f0db6f51c89724ddaa69040a56cbe4ee2fb1

    • memory/624-23-0x000001A778980000-0x000001A778983000-memory.dmp

      Filesize

      12KB

    • memory/624-49-0x000001A7789F0000-0x000001A7789F1000-memory.dmp

      Filesize

      4KB

    • memory/624-25-0x000001A7789F0000-0x000001A7789F1000-memory.dmp

      Filesize

      4KB

    • memory/624-26-0x000001A778990000-0x000001A7789B8000-memory.dmp

      Filesize

      160KB

    • memory/1188-0-0x0000000000740000-0x00000000007CE000-memory.dmp

      Filesize

      568KB

    • memory/1188-6-0x0000000000740000-0x00000000007CE000-memory.dmp

      Filesize

      568KB

    • memory/1188-33-0x0000000000740000-0x00000000007CE000-memory.dmp

      Filesize

      568KB

    • memory/2332-72-0x000002786CAC0000-0x000002786CACF000-memory.dmp

      Filesize

      60KB

    • memory/2332-75-0x000002786CAA0000-0x000002786CAA1000-memory.dmp

      Filesize

      4KB

    • memory/2332-18-0x000002786B0B0000-0x000002786B17B000-memory.dmp

      Filesize

      812KB

    • memory/2332-83-0x000002786CA80000-0x000002786CA81000-memory.dmp

      Filesize

      4KB

    • memory/2332-20-0x00007FFEDA620000-0x00007FFEDA630000-memory.dmp

      Filesize

      64KB

    • memory/2332-15-0x000002786AE20000-0x000002786AE23000-memory.dmp

      Filesize

      12KB

    • memory/2332-82-0x000002786CAD0000-0x000002786CADC000-memory.dmp

      Filesize

      48KB

    • memory/2332-81-0x000002786CAA0000-0x000002786CAA2000-memory.dmp

      Filesize

      8KB

    • memory/2332-80-0x000002786CAB0000-0x000002786CAB1000-memory.dmp

      Filesize

      4KB

    • memory/2332-79-0x000002786D230000-0x000002786D2D0000-memory.dmp

      Filesize

      640KB

    • memory/2332-78-0x000002786CAC0000-0x000002786CAC1000-memory.dmp

      Filesize

      4KB

    • memory/2332-77-0x000002786CAD0000-0x000002786CADC000-memory.dmp

      Filesize

      48KB

    • memory/2332-76-0x000002786CAB0000-0x000002786CAB1000-memory.dmp

      Filesize

      4KB

    • memory/2332-47-0x000002786B0B0000-0x000002786B17B000-memory.dmp

      Filesize

      812KB

    • memory/2332-48-0x000002786B1C0000-0x000002786B1C1000-memory.dmp

      Filesize

      4KB

    • memory/2332-74-0x000002786CAB0000-0x000002786CAB1000-memory.dmp

      Filesize

      4KB

    • memory/2332-65-0x00007FFEDA620000-0x00007FFEDA630000-memory.dmp

      Filesize

      64KB

    • memory/2332-66-0x000002786CA90000-0x000002786CA91000-memory.dmp

      Filesize

      4KB

    • memory/2332-67-0x000002786CAA0000-0x000002786CAA1000-memory.dmp

      Filesize

      4KB

    • memory/2332-68-0x000002786CAB0000-0x000002786CAB1000-memory.dmp

      Filesize

      4KB

    • memory/2332-69-0x000002786CAC0000-0x000002786CAC1000-memory.dmp

      Filesize

      4KB

    • memory/2332-70-0x000002786CA90000-0x000002786CA91000-memory.dmp

      Filesize

      4KB

    • memory/2332-71-0x000002786D230000-0x000002786D2D0000-memory.dmp

      Filesize

      640KB

    • memory/2332-17-0x000002786B0B0000-0x000002786B17B000-memory.dmp

      Filesize

      812KB

    • memory/2332-73-0x000002786CAA0000-0x000002786CAA2000-memory.dmp

      Filesize

      8KB

    • memory/3104-3-0x0000000000040000-0x00000000000CE000-memory.dmp

      Filesize

      568KB

    • memory/3104-46-0x0000000000040000-0x00000000000CE000-memory.dmp

      Filesize

      568KB

    • memory/3104-40-0x0000000000040000-0x00000000000CE000-memory.dmp

      Filesize

      568KB

    • memory/3104-19-0x0000000000040000-0x00000000000CE000-memory.dmp

      Filesize

      568KB

    • memory/3116-5-0x0000000000650000-0x0000000000653000-memory.dmp

      Filesize

      12KB

    • memory/3116-41-0x0000000007E50000-0x0000000007F47000-memory.dmp

      Filesize

      988KB

    • memory/3116-42-0x0000000000690000-0x0000000000691000-memory.dmp

      Filesize

      4KB

    • memory/3116-8-0x0000000000650000-0x0000000000653000-memory.dmp

      Filesize

      12KB

    • memory/3116-9-0x0000000007E50000-0x0000000007F47000-memory.dmp

      Filesize

      988KB

    • memory/3116-10-0x0000000000690000-0x0000000000691000-memory.dmp

      Filesize

      4KB