Overview

overview

10

Static

static

7

adc058d526...f8.exe

windows7-x64

10

adc058d526...f8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    107s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    adc058d526fa64e133140aecac5b05f8.exe
  • Size 4.6MB
  • Sample240107-x87d1acfar
  • SHA256 48ad282c30928d9b5795e42d74aa19c30ff3e2bc29a414010a069bfb3dc90d94
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 15 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\adc058d526fa64e133140aecac5b05f8.exe
    "C:\Users\Admin\AppData\Local\Temp\adc058d526fa64e133140aecac5b05f8.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Users\Admin\E696D64614\winlogon.exe
      "C:\Users\Admin\E696D64614\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Users\Admin\E696D64614\winlogon.exe
        "C:\Users\Admin\E696D64614\winlogon.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Sets file execution options in registry
        • Executes dropped EXE
        • Windows security modification
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies Internet Explorer start page
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:540
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:4308
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4000
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4000 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4452

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Hide Artifacts

          2
          T1564

          Hidden Files and Directories

          2
          T1564.001

          Impair Defenses

          3
          T1562

          Disable or Modify Tools

          3
          T1562.001

          Modify Registry

          12
          T1112

          Credential Access

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          3
          T1082

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          www.google[1].xml
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\NIX3JMVR\www.google[1].xml
          • Size 13B
          • SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
          • MD5 SHA1 SHA512
          Submit Download

          verD409.tmp
          • Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD409.tmp
          • Size 15KB
          • SHA256 557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          jquery.fancybox.min[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7V1N9ZS9\jquery.fancybox.min[1].css
          • Size 12KB
          • SHA256 5736e3eec0c34bfc288854b7b8d2a8f1e22e9e2e7dae3c8d1ad5dfb2d4734ad0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          zyw6mds[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7V1N9ZS9\zyw6mds[1].css
          • Size 1KB
          • SHA256 cfddcd1ab28963d8219ef42d0b455b1e062521bfe7b100d4c47e0b9dd0a79023
          • MD5 SHA1 SHA512
          Submit Download

          reboot.min[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8D1Z5HG5\reboot.min[1].css
          • Size 3KB
          • SHA256 bd78e3bcc569d029e7c709144e4038dede4d92a143e77bc46e4f15913769758b
          • MD5 SHA1 SHA512
          Submit Download

          styles__ltr[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8D1Z5HG5\styles__ltr[1].css
          • Size 55KB
          • SHA256 7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          suggestions[1].en-US
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8D1Z5HG5\suggestions[1].en-US
          • Size 17KB
          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          css[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GG17NQDF\css[1].css
          • Size 530B
          • SHA256 c1294965425b5028a83bbe5eeed0cd9b92733ec41efd07e34532522d4c97b6e1
          • MD5 SHA1 SHA512
          Submit Download

          domain_profile[1].htm
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UCK1SA0Q\domain_profile[1].htm
          • Size 6KB
          • SHA256 94c3857959a658794fa4b9ce516a121cb47efa49b7f99dddf678db26c3a64ef3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          p[1].css
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UCK1SA0Q\p[1].css
          • Size 5B
          • SHA256 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
          • MD5 SHA1 SHA512
          Submit Download

          recaptcha__en[1].js
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UCK1SA0Q\recaptcha__en[1].js
          • Size 93KB
          • SHA256 3f91b61b63fd4b7366b085caed1ba80cf60d90c828ca42eaea5052f9ec22c9e0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/540-20-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/540-41-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/540-55-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/540-23-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/540-302-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/540-24-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/540-395-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/540-502-0x0000000000400000-0x000000000043F000-memory.dmp
          Download

          memory/4132-0-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4132-12-0x0000000000400000-0x0000000000447000-memory.dmp
          Download

          memory/4516-54-0x0000000000400000-0x0000000000447000-memory.dmp
          Download