Overview

overview

8

Static

static

3

8daa96f819...08.exe

windows7-x64

8

8daa96f819...08.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-02-2024 23:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8daa96f8191353654cb41c4581132308.exe

  • Size

    959KB

  • MD5

    8daa96f8191353654cb41c4581132308

  • SHA1

    3972859300c13ceac3f86b7b6fbc6453d46bd031

  • SHA256

    1ad693b741b80d11e22ba4e1f8d02a583fe52aa7416fbf80f3a2f0af9a641df5

  • SHA512

    ae63eaeaf11b3ebbde2d7398305177231572750b67a04d6fdc9476bb26d31dbfc86afe07cca6b12194191667a66ed8a5a27abcdd082ef9653dc17b6aa736c719

  • SSDEEP

    24576:Z+k5i0jaDGtXJkE5FD14Bg9Yc5NvwtyeaB:b5i0jrNJzfD14B6V5FwtE

Score
8/10
evasionpersistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 57 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\8daa96f8191353654cb41c4581132308.exe
    "C:\Users\Admin\AppData\Local\Temp\8daa96f8191353654cb41c4581132308.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3480
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe"
      2⤵
      • Modifies registry class
      PID:2160
    • C:\Windows\SysWOW64\msiesetup.exe
      "C:\Windows\System32\msiesetup.exe"
      2⤵
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      PID:4304
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\setup.cmd" "
      2⤵
        PID:3912
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5096
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
      1⤵
        PID:3792
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:4880
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4684
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1112
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3204
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1756
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4444
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3412
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3068

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
          Filesize

          2KB

          MD5

          de7afbad8f51e90630a7d64a068e5dfd

          SHA1

          80803f99df0bb5d11395cbd8aecd6257e5c9e577

          SHA256

          c90381a4153a3e6c11e0a60fd73ce7d131bcec060670aece6145a6b0f3e4b5da

          SHA512

          a35c906ad8f608cbaf888ebb8e138d96461ed9a6cb55ca0c13baf792970c6ee5feda9e9767cbd9b7b8c273adaa0c62d6630cfd454fb2c934000386c663b762e9

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
          Filesize

          36KB

          MD5

          0e2a09c8b94747fa78ec836b5711c0c0

          SHA1

          92495421ad887f27f53784c470884802797025ad

          SHA256

          0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

          SHA512

          61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
          Filesize

          36KB

          MD5

          fb5f8866e1f4c9c1c7f4d377934ff4b2

          SHA1

          d0a329e387fb7bcba205364938417a67dbb4118a

          SHA256

          1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

          SHA512

          0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\0A55C1OB\microsoft.windows[1].xml
          Filesize

          97B

          MD5

          291a3f3ebf21195c8af7c2f120ca4dfc

          SHA1

          1cade2dac000db3bca92e2daee371beffd2c0bee

          SHA256

          fbe32bda6ca669397ca6d02b329f235aee87a8f36b09a589548e969c19cb78de

          SHA512

          ed2dea282f97d25171e0e95fe718103e04e37f13a1edf79373af204ac344cdb9a0fca34d82e45d3475a9845ee92644a99a1c2733f8858fe384e3b6958331f287

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\setup.cmd
          Filesize

          21KB

          MD5

          200ad6d753aebc53ef5b83c1308661bc

          SHA1

          fd2e0c3cf5841153552d1d3ed075b15e28ebc750

          SHA256

          336f4a4d64ac4efb39d8bc77f0b8ccde40feb526e550cbfb98bac31e95623471

          SHA512

          b84ef0f2e7ee284be2f630b4b9092c64997c49e21809e8c22cd72a18d21fb29595a6cd2bb340d10ca11925fe780331ebe472cbdbc0929f1caddd15ce1fe132f2

          Download Submit

        • C:\Windows\SysWOW64\msiesetup.exe
          Filesize

          39KB

          MD5

          6243cdd306f62cc5599b261ae3ada07e

          SHA1

          b694f40a20993946faec3b0c23caaf55b19a10e1

          SHA256

          86a409ae614bf898420bdb6f89736ec65e2a1df7a739a06b94ef21b3560d1eaf

          SHA512

          fd7140dd11def97d7e2e2d53653aa90f109f947d23639a1be578baacbaf9a1f8027713d33868f587664b1293ac3232e3983355c7b44f8921bb74512b71cca208

          Download Submit

        • C:\Windows\SysWOW64\msupdate.dll
          Filesize

          990KB

          MD5

          67906bbf203a6cd8b54939a9fd0f4b7c

          SHA1

          8d64b1a306bf8f9322abd795be6195ca6981fbdf

          SHA256

          b1cf509e6a255203e7b0d8c584a1569754a951b45bb894ff3248789bde9a9d5b

          SHA512

          8d1e0999f04528168d1fd224739d18cb9cd78285273883651afe3898f1203060ab80e9a09f97d5daebdecb369ad44c556e7c0a6b42edcf8fea4d14df5133a933

          Download Submit

        • C:\Windows\SysWOW64\msupdate.dll
          Filesize

          768KB

          MD5

          9785fe0aefdbc9bcc8d460a6a9608dbb

          SHA1

          1685bf8755c3e8092fca6c6714caff146da8b786

          SHA256

          1b195c597345495803423cd176752170395db7d7ea41eebde1df0559a691b9ff

          SHA512

          83b94a21742cd39b3bbd4a843cd73203d196b8ccd1eed4d2b38ef9ac609fe494cb442619a6e140637a46756fb0477d030aad8cb3f9271dcf638073b86efe7916

          Download Submit

        • C:\Windows\SysWOW64\msupdate.dll
          Filesize

          512KB

          MD5

          b431024b874bcaead4b9fbdbae7cbb4d

          SHA1

          f3df07a25bf261423efd98c2d3f71f08a7b77976

          SHA256

          3737fec18de777dd720c04e1c1c1f7df5fe61cc2428c797b37584d600d540f01

          SHA512

          142f54fbb99780f9d7a447c3f2032166000724b1ae5d19bbabbcc4d7b0b88f4c404e304ec25c5f45845e50babe54a54299a49ef0a185c3f501122513f38e134d

          Download Submit

        • memory/1112-75-0x000001EC713F0000-0x000001EC71410000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1112-73-0x000001EC70FE0000-0x000001EC71000000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1112-70-0x000001EC71020000-0x000001EC71040000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1756-123-0x00000177400C0000-0x00000177400E0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1756-121-0x000001773F9B0000-0x000001773F9D0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1756-119-0x000001773FD00000-0x000001773FD20000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3204-97-0x0000029057520000-0x0000029057540000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3204-104-0x00000290578F0000-0x0000029057910000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3204-100-0x00000290571E0000-0x0000029057200000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3412-162-0x00000287F4D80000-0x00000287F4DA0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3412-166-0x00000287F5160000-0x00000287F5180000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3412-164-0x00000287F4D40000-0x00000287F4D60000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3480-55-0x0000000000400000-0x00000000004F6000-memory.dmp

          Filesize

          984KB

          Download

        • memory/4304-61-0x0000000000400000-0x0000000000410000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4304-30-0x0000000000980000-0x0000000000AE1000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/4304-31-0x0000000000980000-0x0000000000AE1000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/4304-86-0x0000000000980000-0x0000000000AE1000-memory.dmp

          Filesize

          1.4MB

          Download

        • memory/4444-141-0x0000027E5AAA0000-0x0000027E5AAC0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4444-145-0x0000027E5B080000-0x0000027E5B0A0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4444-143-0x0000027E5AA60000-0x0000027E5AA80000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4684-45-0x000001F3389E0000-0x000001F338A00000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4684-41-0x000001F3383C0000-0x000001F3383E0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4684-39-0x000001F338400000-0x000001F338420000-memory.dmp

          Filesize

          128KB

          Download

        • memory/5096-33-0x0000000004720000-0x0000000004721000-memory.dmp

          Filesize

          4KB

          Download