Overview

overview

8

Static

static

3

5745a5c1b5...90.exe

windows7-x64

8

5745a5c1b5...90.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-10-2023 18:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5745a5c1b56ed1b404a3895b50b7cb915a6a507b8414d67be6bf30d56bca8090.exe

  • Size

    2.6MB

  • MD5

    e6374ad6ef12b76c1299afcabca961ae

  • SHA1

    3670672392efccc5daf1c9f2b2fa032217573f1d

  • SHA256

    5745a5c1b56ed1b404a3895b50b7cb915a6a507b8414d67be6bf30d56bca8090

  • SHA512

    1b716b30fc5ee01036f83be052b4a442e55aa2694f5a085748de007ba043ee7fbb1253365a69ffff0d2562cd5a86a36f735a079233a079411edbed9689d6e95b

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlKUAehPYPETkrNDiNdp:c+8X9G3vP3AMTAeaPETkS3

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 16 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\5745a5c1b56ed1b404a3895b50b7cb915a6a507b8414d67be6bf30d56bca8090.exe
    "C:\Users\Admin\AppData\Local\Temp\5745a5c1b56ed1b404a3895b50b7cb915a6a507b8414d67be6bf30d56bca8090.exe"
    1⤵
      PID:3260
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3924
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1244
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2020
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4320
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2328
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:800
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4244
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:5048
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:572
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2268
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4848

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
        Filesize

        96B

        MD5

        4114b63fafc98d9307dc8bfae1c379cd

        SHA1

        8959adf99facaf14c6be813470286c448b0e0b44

        SHA256

        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

        SHA512

        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{0A6AC72E-ED8C-C16F-38B6-05831557CF24}
        Filesize

        36KB

        MD5

        8aaad0f4eb7d3c65f81c6e6b496ba889

        SHA1

        231237a501b9433c292991e4ec200b25c1589050

        SHA256

        813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

        SHA512

        1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
        Filesize

        36KB

        MD5

        406347732c383e23c3b1af590a47bccd

        SHA1

        fae764f62a396f2503dd81eefd3c7f06a5fb8e5f

        SHA256

        e0a9f5c75706dc79a44d0c890c841b2b0b25af4ee60d0a16a7356b067210038e

        SHA512

        18905eaad8184bb3a7b0fe21ff37ed2ee72a3bd24bb90cbfcad222cf09e2fa74e886d5c687b21d81cd3aec1e6c05891c24f67a8f82bafd2aceb0e0dcb7672ce7

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
        Filesize

        96B

        MD5

        4114b63fafc98d9307dc8bfae1c379cd

        SHA1

        8959adf99facaf14c6be813470286c448b0e0b44

        SHA256

        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

        SHA512

        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
        Filesize

        96B

        MD5

        4114b63fafc98d9307dc8bfae1c379cd

        SHA1

        8959adf99facaf14c6be813470286c448b0e0b44

        SHA256

        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

        SHA512

        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
        Filesize

        96B

        MD5

        4114b63fafc98d9307dc8bfae1c379cd

        SHA1

        8959adf99facaf14c6be813470286c448b0e0b44

        SHA256

        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

        SHA512

        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ANTV7B43\microsoft.windows[1].xml
        Filesize

        96B

        MD5

        4114b63fafc98d9307dc8bfae1c379cd

        SHA1

        8959adf99facaf14c6be813470286c448b0e0b44

        SHA256

        f93f1cffd4688bc4cd9e3dfb2ee84a1f53f40d966cab8542c5863906faaf197f

        SHA512

        51eb95339b914b6674922ad2635a193ae1fb1d008c35f03cc8664c46e4f124389a884d7854268c90ac7883102f9a98483e0019a269070b7d6a96fcc70c937723

        Download Submit

      • memory/572-101-0x0000021057160000-0x0000021057180000-memory.dmp

        Filesize

        128KB

        Download

      • memory/572-97-0x0000021056D90000-0x0000021056DB0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/572-99-0x0000021056D50000-0x0000021056D70000-memory.dmp

        Filesize

        128KB

        Download

      • memory/800-31-0x00000263DF520000-0x00000263DF540000-memory.dmp

        Filesize

        128KB

        Download

      • memory/800-33-0x00000263DF1E0000-0x00000263DF200000-memory.dmp

        Filesize

        128KB

        Download

      • memory/800-36-0x00000263DF8F0000-0x00000263DF910000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2268-120-0x0000029CB00E0000-0x0000029CB0100000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2268-117-0x0000029CAF9D0000-0x0000029CAF9F0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2268-115-0x0000029CAFD20000-0x0000029CAFD40000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2328-12-0x000001FC1C530000-0x000001FC1C550000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2328-14-0x000001FC1CB40000-0x000001FC1CB60000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2328-10-0x000001FC1C570000-0x000001FC1C590000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4244-56-0x000002175FC60000-0x000002175FC80000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4244-60-0x0000021760020000-0x0000021760040000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4244-58-0x000002175FC20000-0x000002175FC40000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5048-84-0x0000022D8BE20000-0x0000022D8BE40000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5048-80-0x0000022D8B7D0000-0x0000022D8B7F0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/5048-77-0x0000022D8BA20000-0x0000022D8BA40000-memory.dmp

        Filesize

        128KB

        Download