Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231201-en
  • resource tags

    arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2023, 04:23

General

  • Target

    cce3cf3b425a4783b2632cdeca7b172dd5ddf7577e9c6be82e92b81f3d31a619.exe

  • Size

    10.7MB

  • MD5

    e2f47d90261992d34a18e49568de265e

  • SHA1

    9078292c6d7865c4471fec79b6f65001024fb281

  • SHA256

    cce3cf3b425a4783b2632cdeca7b172dd5ddf7577e9c6be82e92b81f3d31a619

  • SHA512

    c71c7839eeb1ee7e54e25610cb92c894977e67df1c1c74d85d45bd9761c6b290f91af797b932fc5978f70e93b9fcf117a43145b2f58f6610bd1132854367e58c

  • SSDEEP

    196608:RVVE/H/MVA2OR3+qNTFiKTmDEyt3e2mEJcBww0tUYb/6/FEAwDCf3hZtmEVjVuYT:14UPSvhiQwt3e2mQcB82KWFICtN11ww/

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 10 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cce3cf3b425a4783b2632cdeca7b172dd5ddf7577e9c6be82e92b81f3d31a619.exe
    "C:\Users\Admin\AppData\Local\Temp\cce3cf3b425a4783b2632cdeca7b172dd5ddf7577e9c6be82e92b81f3d31a619.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\ProgramData\onliawaz.exe
      C:\ProgramData\onliawaz.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\windows\Runn\Yloux.exe
        "C:\windows\Runn\Yloux.exe"
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2632
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ping 127.0.0.1 -n 5 &del "C:\Users\Admin\AppData\Local\Temp\cce3cf3b425a4783b2632cdeca7b172dd5ddf7577e9c6be82e92b81f3d31a619.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 5
        3⤵
        • Runs ping.exe
        PID:2568

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\onliawaz.exe

          Filesize

          5.4MB

          MD5

          e16899ad557215c7af9942c93ad0b5c5

          SHA1

          89939d6c77c59b13287a74fbc73092e1b66c15ab

          SHA256

          b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301

          SHA512

          4342b3a16d4803ee2e0300ef9484e5b11fc5f0c310da501c50d1eb2a5e19ff0ae0402306dc02828702432877f41fffdcd8df4c00a43224937bd839084adce0bb

        • C:\ProgramData\onliawaz.exe

          Filesize

          5.4MB

          MD5

          e16899ad557215c7af9942c93ad0b5c5

          SHA1

          89939d6c77c59b13287a74fbc73092e1b66c15ab

          SHA256

          b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301

          SHA512

          4342b3a16d4803ee2e0300ef9484e5b11fc5f0c310da501c50d1eb2a5e19ff0ae0402306dc02828702432877f41fffdcd8df4c00a43224937bd839084adce0bb

        • C:\ProgramData\onliawaz.exe

          Filesize

          5.4MB

          MD5

          e16899ad557215c7af9942c93ad0b5c5

          SHA1

          89939d6c77c59b13287a74fbc73092e1b66c15ab

          SHA256

          b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301

          SHA512

          4342b3a16d4803ee2e0300ef9484e5b11fc5f0c310da501c50d1eb2a5e19ff0ae0402306dc02828702432877f41fffdcd8df4c00a43224937bd839084adce0bb

        • C:\Windows\Runn\Yloux.exe

          Filesize

          3.0MB

          MD5

          8eb8324b0edbf91fdc49ec66e0248959

          SHA1

          5c98914ce7b5c564db4456320b89428f8b6d83aa

          SHA256

          c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a

          SHA512

          5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

        • C:\windows\Runn\1.bin

          Filesize

          176KB

          MD5

          7e9d02bca3ab745c84117057f48b1a97

          SHA1

          b17986a21b44749f042f4bf779c9b75ab7bce5bf

          SHA256

          a3cd7777c4344f0c80140d2cdfce1b993a8653707de8a68490bfcc6fbfc63c1f

          SHA512

          edfb1cff6736f4ebf5675c9d54039e036201715b89fe2233e790a7cb1796b10fb7c1016f305f13742427baae627c1f7bd32b43c0c8d9d7d7fda4440a4b9fefae

        • C:\windows\Runn\Yloux.exe

          Filesize

          3.0MB

          MD5

          8eb8324b0edbf91fdc49ec66e0248959

          SHA1

          5c98914ce7b5c564db4456320b89428f8b6d83aa

          SHA256

          c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a

          SHA512

          5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

        • \ProgramData\onliawaz.exe

          Filesize

          5.4MB

          MD5

          e16899ad557215c7af9942c93ad0b5c5

          SHA1

          89939d6c77c59b13287a74fbc73092e1b66c15ab

          SHA256

          b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301

          SHA512

          4342b3a16d4803ee2e0300ef9484e5b11fc5f0c310da501c50d1eb2a5e19ff0ae0402306dc02828702432877f41fffdcd8df4c00a43224937bd839084adce0bb

        • \ProgramData\onliawaz.exe

          Filesize

          5.4MB

          MD5

          e16899ad557215c7af9942c93ad0b5c5

          SHA1

          89939d6c77c59b13287a74fbc73092e1b66c15ab

          SHA256

          b8e048347ec8cfc70d59e457515382765641da64a712fa294abc1bbdc46c6301

          SHA512

          4342b3a16d4803ee2e0300ef9484e5b11fc5f0c310da501c50d1eb2a5e19ff0ae0402306dc02828702432877f41fffdcd8df4c00a43224937bd839084adce0bb

        • \Windows\Runn\Yloux.exe

          Filesize

          3.0MB

          MD5

          8eb8324b0edbf91fdc49ec66e0248959

          SHA1

          5c98914ce7b5c564db4456320b89428f8b6d83aa

          SHA256

          c6f62df5dcfc64177de6cf2ee5a95b0cbf404ce262b60cbe3c8e260108a4c29a

          SHA512

          5a4991ef70fcd902a03c1af8d9e43ee72ecdb035625d29c596a0d0cf34f38504e2a567d3547f4b0e4f75b14d617854fe1dcd85a76d1452bb284b9d95912d1500

        • memory/2332-12-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB

        • memory/2332-37-0x0000000077330000-0x0000000077331000-memory.dmp

          Filesize

          4KB

        • memory/2332-25-0x0000000001810000-0x0000000001811000-memory.dmp

          Filesize

          4KB

        • memory/2332-23-0x0000000001810000-0x0000000001811000-memory.dmp

          Filesize

          4KB

        • memory/2332-20-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2332-18-0x00000000003F0000-0x00000000003F1000-memory.dmp

          Filesize

          4KB

        • memory/2332-31-0x0000000001830000-0x0000000001831000-memory.dmp

          Filesize

          4KB

        • memory/2332-33-0x0000000001830000-0x0000000001831000-memory.dmp

          Filesize

          4KB

        • memory/2332-35-0x0000000001830000-0x0000000001831000-memory.dmp

          Filesize

          4KB

        • memory/2332-28-0x0000000001820000-0x0000000001821000-memory.dmp

          Filesize

          4KB

        • memory/2332-30-0x0000000001820000-0x0000000001821000-memory.dmp

          Filesize

          4KB

        • memory/2332-15-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB

        • memory/2332-13-0x0000000000400000-0x000000000180F000-memory.dmp

          Filesize

          20.1MB

        • memory/2332-9-0x00000000003D0000-0x00000000003D1000-memory.dmp

          Filesize

          4KB

        • memory/2332-7-0x00000000003D0000-0x00000000003D1000-memory.dmp

          Filesize

          4KB

        • memory/2332-5-0x00000000003D0000-0x00000000003D1000-memory.dmp

          Filesize

          4KB

        • memory/2332-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2332-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2332-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

          Filesize

          4KB

        • memory/2332-57-0x0000000000400000-0x000000000180F000-memory.dmp

          Filesize

          20.1MB

        • memory/2632-81-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/2632-87-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/2632-104-0x00000000028C0000-0x0000000002904000-memory.dmp

          Filesize

          272KB

        • memory/2632-99-0x00000000028C0000-0x0000000002904000-memory.dmp

          Filesize

          272KB

        • memory/2632-97-0x0000000002880000-0x00000000028BE000-memory.dmp

          Filesize

          248KB

        • memory/2632-75-0x0000000000260000-0x000000000028D000-memory.dmp

          Filesize

          180KB

        • memory/2632-98-0x00000000028C0000-0x0000000002904000-memory.dmp

          Filesize

          272KB

        • memory/2632-95-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/2632-88-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/2632-96-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/2632-89-0x0000000180000000-0x0000000180033000-memory.dmp

          Filesize

          204KB

        • memory/2632-94-0x0000000000400000-0x0000000000591000-memory.dmp

          Filesize

          1.6MB

        • memory/2780-93-0x0000000000EC0000-0x000000000176A000-memory.dmp

          Filesize

          8.7MB

        • memory/2780-59-0x0000000010000000-0x0000000010606000-memory.dmp

          Filesize

          6.0MB

        • memory/2780-54-0x0000000000EC0000-0x000000000176A000-memory.dmp

          Filesize

          8.7MB

        • memory/2780-80-0x0000000000EC0000-0x000000000176A000-memory.dmp

          Filesize

          8.7MB

        • memory/2780-51-0x00000000000F0000-0x00000000000F1000-memory.dmp

          Filesize

          4KB

        • memory/2780-56-0x0000000077330000-0x0000000077331000-memory.dmp

          Filesize

          4KB

        • memory/2780-53-0x00000000000F0000-0x00000000000F1000-memory.dmp

          Filesize

          4KB

        • memory/2780-58-0x0000000003040000-0x0000000003641000-memory.dmp

          Filesize

          6.0MB