Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 20:35

General

  • Target

    3d567d93342f92d66717c8b1dbce6412e27ebd1da7c2b014b611e258ece8b37c.exe

  • Size

    545KB

  • MD5

    53d5101bf73ad81743a6b8e94deee77f

  • SHA1

    0e997ff5b72fec6ba747aac8405e6d85ad625050

  • SHA256

    3d567d93342f92d66717c8b1dbce6412e27ebd1da7c2b014b611e258ece8b37c

  • SHA512

    9b819d023c928ccb6802f38bb46c1734fd4f7f2188f962cc38bfa3f1641655c1121d7a51edfd9e9724079b5c848e40929d67fb819bf2a8978b37614ec4305b10

  • SSDEEP

    6144:vhjxrU2+7kO+4LT9FD/QOuVkJpFYcEOkCybEaQRXr9HNdvOaAC6:vvr+M4H9FrGVkwOkx2LIat6

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 9 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 6 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 26 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 59 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:576
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1016
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Drops file in Drivers directory
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3276
      • C:\Users\Admin\AppData\Local\Temp\3d567d93342f92d66717c8b1dbce6412e27ebd1da7c2b014b611e258ece8b37c.exe
        "C:\Users\Admin\AppData\Local\Temp\3d567d93342f92d66717c8b1dbce6412e27ebd1da7c2b014b611e258ece8b37c.exe"
        2⤵
        • Checks computer location settings
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3760
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\3d567d93342f92d66717c8b1dbce6412e27ebd1da7c2b014b611e258ece8b37c.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4748
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            4⤵
            • Delays execution with timeout.exe
            PID:2496

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

            Filesize

            2KB

            MD5

            9ba47a279b7950e198b6076171704bd8

            SHA1

            2d40167fb1cffc590d18f00b6ae5a22a7ba2bcab

            SHA256

            1d855e013b588989a67757730de9fef0ae45fba49359eeeb9ca7ce03089f75c6

            SHA512

            d048eb90cc64e568aa36c857a19ab9d4ebbb829716ec397d91fe92ab7cf0e5addbb2928cabfdec043ed46db02b2705a079668184474c08f5e7e57d58122d83c5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

            Filesize

            1KB

            MD5

            b3e886f0a26b67c1234b30c755341758

            SHA1

            8a881fb559672e95834def740fc5ba017879b0db

            SHA256

            808b71ea8048ef6e5014fbd1dedbd496516bf963107c8dff13a53d807c60686f

            SHA512

            66f612ae244a65d623617290f58bd01b8db16fcb98d9b60dca78adc7b2371bfff0ad03dbb244def434e8f243efcef37337a39a30871c64dcd1f6db6e57f50524

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DED9969D7ED2C6E555C5C9254A43EDE4

            Filesize

            599B

            MD5

            3fefedd2d651734aab0aff2f8161db56

            SHA1

            eda0d013d0db080e6477965234bf4db2aceb215e

            SHA256

            4a2a561a396876d9ef6387f7f5394313a82d06945aae92d672a39b3db8cc5f01

            SHA512

            0ac825bf61b063f64e93eb4638ebeb63457309068e8a8ac27ea15b79c0ae7968ec1db6df757d74d9350abfd262d2a834ab54ee47f8d04dbb6451f7133072a56e

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A

            Filesize

            484B

            MD5

            935a9e5d0ec698c565519d6a572d9601

            SHA1

            cf53a7aac2159cd12cc946f8c8c8f698a32a5d0d

            SHA256

            5aa2798065cc6b8558acee4889ed1dee7f6204116860480c8c6ab2c34c70a80a

            SHA512

            1c6db16d154594cf743b99b3fe052070f9c869dd8ee2ff981d33e6cf66e856051bfd4f794e89f76eaceb01e6c86c97fc77729787134bf9f5581c928a057e0b8c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

            Filesize

            482B

            MD5

            1f60ee8de4ef7ef144eacb0bdf14df68

            SHA1

            d964f46d850f3e5ae3cbff0e0361665d03c84ff5

            SHA256

            e3ab52ee388317c0affcbe4a640c7b4c9df85ef3a8d62fcbb92ad54b9a5d45ac

            SHA512

            3c24c4cad705ff49a0af9cc1a89327d16b0cd3f90386e575f0f71e78427aebbbccaf23a976926259fb1182ce4bee4ab13e2c7111c0d6cecfc492d551fa044e35

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4

            Filesize

            504B

            MD5

            77c8cf33c3cf0a216298f3266fc3e856

            SHA1

            f044d555ebdbe99e06d6f7b0d451e9e883e744c0

            SHA256

            1c23554232be622460cb06b2c8c9db61b6b7a0ca83fbef8b69b8d957683888b4

            SHA512

            e34f3fca60c8bf7b77003f73ac02365e12247e113d567b812014d70277365cca75e1bc8e05ec63df97cdb735323f8e8a56cefb051ead603d22a49cbccb4f976d

          • C:\Windows\0rjtIRLymI.sys

            Filesize

            415KB

            MD5

            64bc1983743c584a9ad09dacf12792e5

            SHA1

            0f14098f523d21f11129c4df09451413ddff6d61

            SHA256

            057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5

            SHA512

            9ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c

          • C:\Windows\AiDlWo8jM7.sys

            Filesize

            447KB

            MD5

            dd627bbb8edb4a1072167c8b5fd6e0b5

            SHA1

            30a624eb46d35d4370000ad4b0339ec8f21bb454

            SHA256

            b795e8339a35e09a5f807b17c6c56c0d6286915775f4bfe6f2ed765ed4222e93

            SHA512

            3578fe4c9ca6915580c7517f37017ee35b3b05b1061ee88a59e4feb95702963c52405435424f35a79ee26d2d1574ca274d40d3e624b437a812ec0fc6b377b2a4

          • C:\Windows\jIOpezU3b2e.sys

            Filesize

            415KB

            MD5

            fdbf841adb1f78adca43b1aa3f303d30

            SHA1

            7a8cee7fffffcc369688d5c48daaa75eddb68156

            SHA256

            992857e7e9f2ae2458bee53c0156c632303ad5266aeacb95da30c25700f54a76

            SHA512

            ebbfaef01abc6b5ddb6f14ad0c2c3c1f4288e461d1901898cdaca3cb9a5691a96bd99fe1cbe9f42d84a00cb97852b490e395688c1d65db2cc0337277ff47ec84

          • C:\Windows\mE07feRYtg.sys

            Filesize

            447KB

            MD5

            d15f5f23df8036bd5089ce8d151b0e0d

            SHA1

            4066ff4d92ae189d92fcdfb8c11a82cc9db56bb2

            SHA256

            f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520

            SHA512

            feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9

          • memory/576-76-0x0000017DF1C90000-0x0000017DF1C91000-memory.dmp

            Filesize

            4KB

          • memory/576-31-0x0000017DF1BA0000-0x0000017DF1BC8000-memory.dmp

            Filesize

            160KB

          • memory/576-32-0x0000017DF1C90000-0x0000017DF1C91000-memory.dmp

            Filesize

            4KB

          • memory/1016-201-0x000002400A580000-0x000002400A581000-memory.dmp

            Filesize

            4KB

          • memory/1016-196-0x000002400A3A0000-0x000002400A3A3000-memory.dmp

            Filesize

            12KB

          • memory/1016-215-0x000002400A480000-0x000002400A580000-memory.dmp

            Filesize

            1024KB

          • memory/1016-213-0x000002400A3C0000-0x000002400A46F000-memory.dmp

            Filesize

            700KB

          • memory/1016-211-0x000002400AC30000-0x000002400ACDF000-memory.dmp

            Filesize

            700KB

          • memory/1016-203-0x000002400A480000-0x000002400A580000-memory.dmp

            Filesize

            1024KB

          • memory/1016-200-0x000002400A3C0000-0x000002400A46F000-memory.dmp

            Filesize

            700KB

          • memory/1016-197-0x000002400A3A0000-0x000002400A3A3000-memory.dmp

            Filesize

            12KB

          • memory/3276-208-0x000000000A720000-0x000000000A7CF000-memory.dmp

            Filesize

            700KB

          • memory/3276-198-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/3276-66-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/3276-86-0x0000000008B50000-0x0000000008BFF000-memory.dmp

            Filesize

            700KB

          • memory/3276-65-0x00007FFEE45F0000-0x00007FFEE4600000-memory.dmp

            Filesize

            64KB

          • memory/3276-218-0x0000000008080000-0x0000000008081000-memory.dmp

            Filesize

            4KB

          • memory/3276-24-0x0000000007FA0000-0x0000000008051000-memory.dmp

            Filesize

            708KB

          • memory/3276-25-0x00000000024F0000-0x00000000024F3000-memory.dmp

            Filesize

            12KB

          • memory/3276-28-0x00007FFEE45F0000-0x00007FFEE4600000-memory.dmp

            Filesize

            64KB

          • memory/3276-27-0x0000000002530000-0x0000000002531000-memory.dmp

            Filesize

            4KB

          • memory/3276-26-0x0000000007FA0000-0x0000000008051000-memory.dmp

            Filesize

            708KB

          • memory/3276-23-0x00000000024F0000-0x00000000024F3000-memory.dmp

            Filesize

            12KB

          • memory/3276-21-0x00000000024F0000-0x00000000024F3000-memory.dmp

            Filesize

            12KB

          • memory/3276-217-0x000000000A720000-0x000000000A7CF000-memory.dmp

            Filesize

            700KB

          • memory/3276-74-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/3276-73-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/3276-199-0x0000000002600000-0x0000000002601000-memory.dmp

            Filesize

            4KB

          • memory/3276-75-0x0000000002530000-0x0000000002531000-memory.dmp

            Filesize

            4KB

          • memory/3276-72-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/3276-216-0x0000000008C90000-0x0000000008C94000-memory.dmp

            Filesize

            16KB

          • memory/3276-202-0x00000000070F0000-0x00000000070F1000-memory.dmp

            Filesize

            4KB

          • memory/3276-71-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/3276-206-0x0000000008B50000-0x0000000008BFF000-memory.dmp

            Filesize

            700KB

          • memory/3276-67-0x0000000007FA0000-0x0000000008051000-memory.dmp

            Filesize

            708KB

          • memory/3276-207-0x0000000007430000-0x0000000007433000-memory.dmp

            Filesize

            12KB

          • memory/3276-210-0x0000000008080000-0x0000000008081000-memory.dmp

            Filesize

            4KB

          • memory/3276-70-0x00000000070F0000-0x00000000070F1000-memory.dmp

            Filesize

            4KB

          • memory/3276-212-0x0000000007100000-0x0000000007101000-memory.dmp

            Filesize

            4KB

          • memory/3276-69-0x0000000002600000-0x0000000002601000-memory.dmp

            Filesize

            4KB

          • memory/3276-214-0x00007FF749990000-0x00007FF749991000-memory.dmp

            Filesize

            4KB

          • memory/3276-68-0x0000000002540000-0x0000000002541000-memory.dmp

            Filesize

            4KB

          • memory/3760-0-0x0000000000CE0000-0x0000000000D6F000-memory.dmp

            Filesize

            572KB

          • memory/3760-17-0x0000000000CE0000-0x0000000000D6F000-memory.dmp

            Filesize

            572KB

          • memory/3760-55-0x0000000000CE0000-0x0000000000D6F000-memory.dmp

            Filesize

            572KB