Overview

overview

8

Static

static

1

4ae26fb450...90.exe

windows7-x64

8

4ae26fb450...90.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2023, 19:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4ae26fb45091aa7df4f1fee978d786b5534ce6d1d4b2045f1eed94418918c890.exe

  • Size

    1.3MB

  • MD5

    3abcd9dbaca01dcae09569ec7c683542

  • SHA1

    4bf7aaa067bece0b0d100a12060296962e91a7fe

  • SHA256

    4ae26fb45091aa7df4f1fee978d786b5534ce6d1d4b2045f1eed94418918c890

  • SHA512

    7b85b1125905eef426c81e1471865af0d37bc36450147ed45dae6fc2a6278602db212a14baa9e3b3d0958c63ed147bcd95dcd8cc950a8ed907f780c86edeb716

  • SSDEEP

    24576:DrsYD6+IeW9/4G4QZw//e26fpruGILBVRTwwp+K556h8ZxGZl1MCamBVRTwwpq:cG6+Ip934iqBVRTwwp+456kily3mBVR0

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ae26fb45091aa7df4f1fee978d786b5534ce6d1d4b2045f1eed94418918c890.exe
    "C:\Users\Admin\AppData\Local\Temp\4ae26fb45091aa7df4f1fee978d786b5534ce6d1d4b2045f1eed94418918c890.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 356
      2⤵
      • Program crash
      PID:2008
    • C:\Users\Admin\AppData\Local\Temp\4ae26fb45091aa7df4f1fee978d786b5534ce6d1d4b2045f1eed94418918c890.exe
      C:\Users\Admin\AppData\Local\Temp\4ae26fb45091aa7df4f1fee978d786b5534ce6d1d4b2045f1eed94418918c890.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • System policy modification
      PID:2304
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 324
        3⤵
        • Program crash
        PID:4948
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 668
        3⤵
        • Program crash
        PID:3036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 784
        3⤵
        • Program crash
        PID:5084
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 812
        3⤵
        • Program crash
        PID:2620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 924
        3⤵
        • Program crash
        PID:4396
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 924
        3⤵
        • Program crash
        PID:60
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 948
        3⤵
        • Program crash
        PID:2204
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 1204
        3⤵
        • Program crash
        PID:4160
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4144 -ip 4144
    1⤵
      PID:2204
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2304 -ip 2304
      1⤵
        PID:4252
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2304 -ip 2304
        1⤵
          PID:4168
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2304 -ip 2304
          1⤵
            PID:4208
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2304 -ip 2304
            1⤵
              PID:636
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2304 -ip 2304
              1⤵
                PID:3776
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2304 -ip 2304
                1⤵
                  PID:2096
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2304 -ip 2304
                  1⤵
                    PID:3976
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2304 -ip 2304
                    1⤵
                      PID:4920
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:212
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:4948
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:680
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                        • Suspicious behavior: AddClipboardFormatListener
                        PID:3980
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:3484
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:664
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                          1⤵
                            PID:1664
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4324
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3936
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:676
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3908
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1404
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1364
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies registry class
                            PID:2976

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                            Filesize

                            97B

                            MD5

                            08e988cf9ba89661e30c9a88dcfd71d1

                            SHA1

                            c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                            SHA256

                            dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                            SHA512

                            aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                            Filesize

                            2KB

                            MD5

                            5a6eb1df550a4be60c3fee6748cd8833

                            SHA1

                            11d37c736c7dca259d5a62776d11b2add0a76428

                            SHA256

                            a00d0c50c0c19668f4378c5fcc42c0d7370695e466f6b40642bb4288026b4af1

                            SHA512

                            d33fff158fcdd7e3e993edcf58d4dbb18fa34f57901b9c2949bb50436099d2ba688521e110ebe8a05773c7df806ddaab70140b8ecbb0034d002a22325e8d450d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                            Filesize

                            97B

                            MD5

                            08e988cf9ba89661e30c9a88dcfd71d1

                            SHA1

                            c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                            SHA256

                            dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                            SHA512

                            aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                            Filesize

                            97B

                            MD5

                            08e988cf9ba89661e30c9a88dcfd71d1

                            SHA1

                            c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                            SHA256

                            dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                            SHA512

                            aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                            Filesize

                            97B

                            MD5

                            08e988cf9ba89661e30c9a88dcfd71d1

                            SHA1

                            c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                            SHA256

                            dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                            SHA512

                            aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\5VRLB1M0\microsoft.windows[1].xml
                            Filesize

                            97B

                            MD5

                            08e988cf9ba89661e30c9a88dcfd71d1

                            SHA1

                            c1c01b45f5ed8e34ed4f7fb2dd84d176d328a316

                            SHA256

                            dc2f4f6093e2f6f32a6ea7290d3350c88a6cac8d2d4de273cb3df33c92bbf340

                            SHA512

                            aed76e36773a8bce64cdf11a53b4d0709a095cc4865e2288ebe3aa4af27070c10041d07de52a920a74a6fb5bb8b3b2b6f483d96529c0409cc70bf5a95673e6af

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\4ae26fb45091aa7df4f1fee978d786b5534ce6d1d4b2045f1eed94418918c890.exe
                            Filesize

                            1.3MB

                            MD5

                            8d22e6344b78e9b9f12e7d9fe83f98c9

                            SHA1

                            48d7f068e65005970b0c88a709c01763de31ecd9

                            SHA256

                            6eb2063eae210be7da610e27f4d88adba6e0e1b4ad8b29a2a198d1a0df7b569d

                            SHA512

                            a8a7ce864206d73a9ecdd3fe897051d9280c62168a3f60bb4c6acf7e32216ff30896450b1ca934692f534028b85b5cd19a81dc58455e377e318ba3392fc6d08b

                            Download Submit

                          • memory/676-92-0x000001EF9F350000-0x000001EF9F370000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/676-89-0x000001EF9EF40000-0x000001EF9EF60000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/676-87-0x000001EF9EF80000-0x000001EF9EFA0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/680-33-0x0000000004D20000-0x0000000004D21000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/1364-146-0x000001CD3E600000-0x000001CD3E620000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1364-144-0x000001CD3E130000-0x000001CD3E150000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1364-142-0x000001CD3E170000-0x000001CD3E190000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1404-124-0x000002BDC2960000-0x000002BDC2980000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1404-126-0x000002BDC2920000-0x000002BDC2940000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1404-128-0x000002BDC2D20000-0x000002BDC2D40000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2304-9-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/2304-16-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/2304-8-0x0000000001500000-0x0000000001572000-memory.dmp

                            Filesize

                            456KB

                            Download

                          • memory/2304-23-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/2304-6-0x0000000000400000-0x0000000000472000-memory.dmp

                            Filesize

                            456KB

                            Download

                          • memory/3908-108-0x0000028AC1B40000-0x0000028AC1B60000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3908-112-0x0000028AC1B00000-0x0000028AC1B20000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3908-115-0x0000028AC1F00000-0x0000028AC1F20000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3936-67-0x00000227343E0000-0x0000022734400000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3936-65-0x0000022734620000-0x0000022734640000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3936-69-0x00000227349F0000-0x0000022734A10000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4144-7-0x0000000000400000-0x0000000000472000-memory.dmp

                            Filesize

                            456KB

                            Download

                          • memory/4144-0-0x0000000000400000-0x0000000000472000-memory.dmp

                            Filesize

                            456KB

                            Download

                          • memory/4324-47-0x0000018EA7F00000-0x0000018EA7F20000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4324-40-0x0000018EA78F0000-0x0000018EA7910000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4324-42-0x0000018EA78B0000-0x0000018EA78D0000-memory.dmp

                            Filesize

                            128KB

                            Download