Overview

overview

8

Static

static

3

f94bfb4ac2...8e.exe

windows7-x64

8

f94bfb4ac2...8e.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    116s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2023 18:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f94bfb4ac26824ba0703422b030abb19fc67ac20040a5f58d47ee3e1cc311d8e.exe

  • Size

    3.4MB

  • MD5

    a6ecb1dafe1b5823e4c1cc85acf3065f

  • SHA1

    f1de78ed17e28dd3e907b578b47fe95ef952b4cd

  • SHA256

    f94bfb4ac26824ba0703422b030abb19fc67ac20040a5f58d47ee3e1cc311d8e

  • SHA512

    c56d3d7da62fbb55a9ea596d2739919a29bce337be5ef29dfe5c26a99dd11c29a52cfe56355d139e8ffc600e075f4ce1267ac8582df71b094cee6763412c65a2

  • SSDEEP

    49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTla+NepLr29VdHrC+zG:c+8X9G3vP3AMY+0r2cWG

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\f94bfb4ac26824ba0703422b030abb19fc67ac20040a5f58d47ee3e1cc311d8e.exe
    "C:\Users\Admin\AppData\Local\Temp\f94bfb4ac26824ba0703422b030abb19fc67ac20040a5f58d47ee3e1cc311d8e.exe"
    1⤵
      PID:3312
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2196
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:1856
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:976
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2864
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4612
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3848
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1152
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3016
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:1096
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3204
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3328
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      PID:2104
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3928
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      PID:3812
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:3176
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:1664
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:1884
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:3048
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3904
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:5112
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:2096
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2000
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4596
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3664
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3636
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3848
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4032
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:4588
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:4016

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                    Filesize

                                    471B

                                    MD5

                                    976ce2c91cbe61b98378e8e5c5ba4d53

                                    SHA1

                                    45b3e1eabb4e759bf46ffeb8f9722077a0d62c72

                                    SHA256

                                    255f312d16d7d080cf1a97d4eb255c236c7eee6c059d732d970e3c05c07c158e

                                    SHA512

                                    0065b7984960354aea85cd0c6792e019f40a2b359fabf7dcee438193c1bab47d74d59602627c8399df741864dffb0469d9cf8bc48907c1c67015c51d01a7b28a

                                    Download Submit

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                    Filesize

                                    412B

                                    MD5

                                    c53ea564adeaf89fbf1dcbf7d6f29207

                                    SHA1

                                    9c7b2f866e4a15cb85554500130057d0e13f272c

                                    SHA256

                                    b519fc560842b960ee51f4b49ed92366d38fbb34595a5d3d4b1fa6a59576b43f

                                    SHA512

                                    b90405566b7145a75939ddabe1958e5717858113ff39006e33b616c3ab7612f2c84a138204726fcdd1bebeeb6b009104980bc66a26dd71c8ab64308e44820369

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QFB4PTP9\microsoft.windows[1].xml
                                    Filesize

                                    97B

                                    MD5

                                    4677e3ea7a170c78520dd71312ffd31e

                                    SHA1

                                    a9ac559324a6142d85ded6da9b16f44dc630bf8c

                                    SHA256

                                    703af6af210c7a59166ca33a20c29594710708757e7ca304a5c547ec4cf791c5

                                    SHA512

                                    7bf2a89ef25cb2c2f050f60a13c9c41c1e8ca959ee153b9189b4dc7f50cbb75da581a2ae608c517e941df78523ebe23ea53cdf16ce2cb1b6ee332d6d92b89095

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133415782206881119.txt.~tmp
                                    Filesize

                                    75KB

                                    MD5

                                    62d81c2e1e8b21733f95af2a596e4b18

                                    SHA1

                                    91c005ecc5ae4171f450c43c02d1ba532b4474c6

                                    SHA256

                                    a5596f83717bf64653b95ffe6ec38f20e40fd928456d5e254a53a440804d80b6

                                    SHA512

                                    c7f349acf55694ff696750c30a25c265ff07ced95e4d2a88fa2829d047ca3b3007dc824613a8c403c7613085aca4212155afe03f8f237c0d7781fd87e1fb8a7c

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QFB4PTP9\microsoft.windows[1].xml
                                    Filesize

                                    97B

                                    MD5

                                    4677e3ea7a170c78520dd71312ffd31e

                                    SHA1

                                    a9ac559324a6142d85ded6da9b16f44dc630bf8c

                                    SHA256

                                    703af6af210c7a59166ca33a20c29594710708757e7ca304a5c547ec4cf791c5

                                    SHA512

                                    7bf2a89ef25cb2c2f050f60a13c9c41c1e8ca959ee153b9189b4dc7f50cbb75da581a2ae608c517e941df78523ebe23ea53cdf16ce2cb1b6ee332d6d92b89095

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QFB4PTP9\microsoft.windows[1].xml
                                    Filesize

                                    97B

                                    MD5

                                    4677e3ea7a170c78520dd71312ffd31e

                                    SHA1

                                    a9ac559324a6142d85ded6da9b16f44dc630bf8c

                                    SHA256

                                    703af6af210c7a59166ca33a20c29594710708757e7ca304a5c547ec4cf791c5

                                    SHA512

                                    7bf2a89ef25cb2c2f050f60a13c9c41c1e8ca959ee153b9189b4dc7f50cbb75da581a2ae608c517e941df78523ebe23ea53cdf16ce2cb1b6ee332d6d92b89095

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QFB4PTP9\microsoft.windows[1].xml
                                    Filesize

                                    97B

                                    MD5

                                    4677e3ea7a170c78520dd71312ffd31e

                                    SHA1

                                    a9ac559324a6142d85ded6da9b16f44dc630bf8c

                                    SHA256

                                    703af6af210c7a59166ca33a20c29594710708757e7ca304a5c547ec4cf791c5

                                    SHA512

                                    7bf2a89ef25cb2c2f050f60a13c9c41c1e8ca959ee153b9189b4dc7f50cbb75da581a2ae608c517e941df78523ebe23ea53cdf16ce2cb1b6ee332d6d92b89095

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QFB4PTP9\microsoft.windows[1].xml
                                    Filesize

                                    97B

                                    MD5

                                    4677e3ea7a170c78520dd71312ffd31e

                                    SHA1

                                    a9ac559324a6142d85ded6da9b16f44dc630bf8c

                                    SHA256

                                    703af6af210c7a59166ca33a20c29594710708757e7ca304a5c547ec4cf791c5

                                    SHA512

                                    7bf2a89ef25cb2c2f050f60a13c9c41c1e8ca959ee153b9189b4dc7f50cbb75da581a2ae608c517e941df78523ebe23ea53cdf16ce2cb1b6ee332d6d92b89095

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QFB4PTP9\microsoft.windows[1].xml
                                    Filesize

                                    97B

                                    MD5

                                    4677e3ea7a170c78520dd71312ffd31e

                                    SHA1

                                    a9ac559324a6142d85ded6da9b16f44dc630bf8c

                                    SHA256

                                    703af6af210c7a59166ca33a20c29594710708757e7ca304a5c547ec4cf791c5

                                    SHA512

                                    7bf2a89ef25cb2c2f050f60a13c9c41c1e8ca959ee153b9189b4dc7f50cbb75da581a2ae608c517e941df78523ebe23ea53cdf16ce2cb1b6ee332d6d92b89095

                                    Download Submit

                                  • memory/976-17-0x0000029E3D600000-0x0000029E3D620000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/976-10-0x0000029E3D230000-0x0000029E3D250000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/976-13-0x0000029E3D1F0000-0x0000029E3D210000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/1096-58-0x0000000004250000-0x0000000004251000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/1664-83-0x000001FEBABE0000-0x000001FEBAC00000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/1664-85-0x000001FEBABA0000-0x000001FEBABC0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/1664-87-0x000001FEBB040000-0x000001FEBB060000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/1884-99-0x0000000004B30000-0x0000000004B31000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2000-120-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3016-48-0x000002155D350000-0x000002155D370000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3016-43-0x000002155CF40000-0x000002155CF60000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3016-41-0x000002155CF80000-0x000002155CFA0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3328-70-0x0000019A45620000-0x0000019A45640000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3328-73-0x0000019A45A60000-0x0000019A45A80000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3328-66-0x0000019A45660000-0x0000019A45680000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3636-143-0x0000000004790000-0x0000000004791000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3664-130-0x0000020CE13A0000-0x0000020CE13C0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3664-127-0x0000020CE13E0000-0x0000020CE1400000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3664-133-0x0000020CE1B40000-0x0000020CE1B60000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3812-76-0x0000000004D90000-0x0000000004D91000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3848-33-0x0000000004A70000-0x0000000004A71000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/3904-110-0x0000016229620000-0x0000016229640000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3904-108-0x0000016229220000-0x0000016229240000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3904-106-0x0000016229260000-0x0000016229280000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4032-150-0x000002CAC6E60000-0x000002CAC6E80000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4032-153-0x000002CAC6E20000-0x000002CAC6E40000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4032-157-0x000002CAC7270000-0x000002CAC7290000-memory.dmp

                                    Filesize

                                    128KB

                                    Download