Overview

overview

8

Static

static

3

H5LsB5Wxip1.exe

windows10-2004-x64

8

Resubmissions

07/01/2024, 03:21

240107-dwdflsegc33

07/01/2024, 03:16

240107-dspdpsefg63

07/01/2024, 03:16

240107-dspdpsddal

07/01/2024, 03:12

240107-dqergsdcej3

07/01/2024, 03:09

240107-dnh15adcbl8

07/01/2024, 03:05

240107-dlkryaeeg53

Analysis

  • max time kernel
    39s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 03:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    H5LsB5Wxip1.exe
  • Size 719KB
  • Sample240107-dnh15adcbl
  • SHA256 81bfe8be46e4c703269c4eba30d92f428aff5beaefa618dc24b350131220a832
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 42 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 44 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\H5LsB5Wxip1.exe
    "C:\Users\Admin\AppData\Local\Temp\H5LsB5Wxip1.exe"
    1⤵
      PID:4152
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4300
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1312
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:8
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2284
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1168
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3432
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4060
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:320
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:5080
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:2312
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3620
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:4240
              • C:\Windows\system32\werfault.exe
                werfault.exe /hc /shared Global\0a3d3b43bc4a461d931c8b3d9c700154 /t 4264 /p 4032
                1⤵
                  PID:4804
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:900
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:3616
                    • C:\Windows\system32\werfault.exe
                      werfault.exe /hc /shared Global\ef010c755b244c91bedd346529458490 /t 2404 /p 3616
                      1⤵
                        PID:2880
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:4996
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:952

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                • Size 471B
                                • SHA256 04f8b2a47cfa5d1c009320508e0567f700fcf00c3a7e6d1f3dba6a7e226fd0d7
                                • MD5 SHA1 SHA512
                                Submit Download

                                80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                • Size 412B
                                • SHA256 2e8a682875fa59ba615a9fe572a66455781080d97c95d4701f09a453dd0ae8d4
                                • MD5 SHA1 SHA512
                                Submit Download

                                microsoft.windows[1].xml
                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVCJPK60\microsoft.windows[1].xml
                                • Size 97B
                                • SHA256 760a918c3a9caefe1573ab926c6e3c703b0d0ce7cb3db83e018241bd5c72cad1
                                • MD5 SHA1 SHA512
                                Submit Download

                                memory/3616-41-0x000001B2EBEC0000-0x000001B2EBEE0000-memory.dmp
                                Download

                                memory/3616-43-0x000001B2EBE80000-0x000001B2EBEA0000-memory.dmp
                                Download

                                memory/3616-46-0x000001BAED4A0000-0x000001BAED4C0000-memory.dmp
                                Download

                                memory/3620-17-0x0000026D393C0000-0x0000026D393E0000-memory.dmp
                                Download

                                memory/3620-21-0x0000026D39380000-0x0000026D393A0000-memory.dmp
                                Download

                                memory/3620-23-0x0000026D39790000-0x0000026D397B0000-memory.dmp
                                Download

                                memory/4240-55-0x0000000003F50000-0x0000000003F51000-memory.dmp
                                Download

                                memory/5080-10-0x00000000048B0000-0x00000000048B1000-memory.dmp
                                Download