Overview

overview

10

Static

static

3

7334275ea9...97.exe

windows7-x64

10

7334275ea9...97.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    54s
  • max time network
    62s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 23:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7334275ea99a70a3634ed3bfbe401697.exe

  • Size

    636KB

  • MD5

    7334275ea99a70a3634ed3bfbe401697

  • SHA1

    d1057b879d985bcd3446d29fe7693636b10262e3

  • SHA256

    3fa6488e2ff08826e9134bdc0d5c45f7a4cb61a456dcd07d038903999f465744

  • SHA512

    3ccf6e08ddc73d65376a3841b8d49ea0000c4a93347a81b28d6d3bc203cd67800cc315532572e4a7d61361c5fd01268a0b2a68048c646354796dc36d37da4c11

  • SSDEEP

    6144:Lj6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionXdbV:P6onxOp8FySpE5zvIdtU+YmefZ3MMq

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • UAC bypass 3 TTPs 12 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 17 IoCs
    persistence
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 55 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 25 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 39 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7334275ea99a70a3634ed3bfbe401697.exe
    "C:\Users\Admin\AppData\Local\Temp\7334275ea99a70a3634ed3bfbe401697.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4620
    • C:\Users\Admin\AppData\Local\Temp\pbvdjwmqzlf.exe
      "C:\Users\Admin\AppData\Local\Temp\pbvdjwmqzlf.exe" "c:\users\admin\appdata\local\temp\7334275ea99a70a3634ed3bfbe401697.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2196
      • C:\Users\Admin\AppData\Local\Temp\bjoov.exe
        "C:\Users\Admin\AppData\Local\Temp\bjoov.exe" "-C:\Users\Admin\AppData\Local\Temp\yrhskyocsjypobme.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:4912
      • C:\Users\Admin\AppData\Local\Temp\bjoov.exe
        "C:\Users\Admin\AppData\Local\Temp\bjoov.exe" "-C:\Users\Admin\AppData\Local\Temp\yrhskyocsjypobme.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System policy modification
        PID:3948

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\dfeyzwvsrrppxtnosklnm.hed
    Filesize

    272B

    MD5

    f0265742a8d851dc1a0311fb41919240

    SHA1

    5d9ff475e1c2761a8589b49754c416b570bcff8b

    SHA256

    6a732555ade0e3ed153307fd40d7ab8b9b6e0b407f52e5ba24a11f806cde76c1

    SHA512

    e5a70d52f124809ba84410bc6c1deac8d00294a7fd15cd602e416586d95813e6b67d357ce841938f7834451b9807b7669e5403a279aef4a0c804f8053bf8d173

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\bjoov.exe
    Filesize

    724KB

    MD5

    011753d09c6b29b02d0e49e34f2fc18f

    SHA1

    4576b1e26f2685c415ea0061b622f93b1fb801f8

    SHA256

    c86cb81dc9d6e382b3ef155a7b933c7f0bbf3b56c8ec688d8f39b4990192ec47

    SHA512

    7c923633dc63967b78ed87fb055375d65d8a62c2f1ef6101e978d6c8e762fa20ef49d3a97862023eacf1181234b908b6d7d904e158be0a0bf67cf5ecca595248

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\pbvdjwmqzlf.exe
    Filesize

    320KB

    MD5

    5203b6ea0901877fbf2d8d6f6d8d338e

    SHA1

    c803e92561921b38abe13239c1fd85605b570936

    SHA256

    0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060

    SHA512

    d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471

    Download Submit

  • C:\Users\Admin\AppData\Local\dfeyzwvsrrppxtnosklnm.hed
    Filesize

    272B

    MD5

    1ca2db244ac2f306b27b0a536e347972

    SHA1

    436d38640af8eddd2b746c8558ec4670f4682b7d

    SHA256

    90664ce6f7230981416c0c2553a60c2952030ce6cff8ba0d3e8cacaf9b451bb3

    SHA512

    779457c17e52c5ed92240b698686efb8ba28ccea12ca261fb887b437cf07fa010b7a355d44d08cfb2757f4431c270f11911b897b8246bd8ec01451440421908f

    Download Submit

  • C:\Users\Admin\AppData\Local\ylvamuemwhqbubgshkwjtyksckufozsz.qfi
    Filesize

    3KB

    MD5

    3f8121f6358fbe8fe734ead307b9ff13

    SHA1

    76d79da82fe9c856adb99dac4c611d82c68d6f3e

    SHA256

    37685552418027321f3ece67c16bd735d944259b7f0a2267f3a2307cd44bab90

    SHA512

    5de2e8b76652d17cf3391f4588f9f5e30daa92bddb5696b8eb765a9e397c795bc6de4fa198eb03c1092c417ad7a55bc99dd230b26df121291fdd9c282b6fa876

    Download Submit

  • C:\Windows\SysWOW64\ojboiyqgyribcreyvg.exe
    Filesize

    636KB

    MD5

    7334275ea99a70a3634ed3bfbe401697

    SHA1

    d1057b879d985bcd3446d29fe7693636b10262e3

    SHA256

    3fa6488e2ff08826e9134bdc0d5c45f7a4cb61a456dcd07d038903999f465744

    SHA512

    3ccf6e08ddc73d65376a3841b8d49ea0000c4a93347a81b28d6d3bc203cd67800cc315532572e4a7d61361c5fd01268a0b2a68048c646354796dc36d37da4c11

    Download Submit