Overview

overview

8

Static

static

3

3e5d00a0c1...7c.exe

windows7-x64

8

3e5d00a0c1...7c.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    3e5d00a0c1631e94b08f8fa84145748f5616662a89e2c0b4d5df3dba864b217c.exe

  • Size

    146KB

  • MD5

    ed9f7a9870f20f13ae0521ef922463ef

  • SHA1

    bd2e8abbe8258c6c9c16ab7d8cba11a9d73f28e8

  • SHA256

    3e5d00a0c1631e94b08f8fa84145748f5616662a89e2c0b4d5df3dba864b217c

  • SHA512

    16650c47c11fe03f3b7a19b04fdb1a3d30c8430df9f9136976546ca0b1b48e39ea24949322db08d067b799e3bd568d716af49cfe398b96df2b923429c416aa95

  • SSDEEP

    3072:3gHIxZV+Lu+djDW67COI/4PNzp4e/ZV7ypAjvyNaTsOhzynOhzyE:Qo/+/DV7CiPNeI/VxzyyzyE

Score
8/10
persistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e5d00a0c1631e94b08f8fa84145748f5616662a89e2c0b4d5df3dba864b217c.exe
    "C:\Users\Admin\AppData\Local\Temp\3e5d00a0c1631e94b08f8fa84145748f5616662a89e2c0b4d5df3dba864b217c.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\AppData\Roaming\Mozilla\update_27.exe
      "C:\Users\Admin\AppData\Roaming\Mozilla\update_27.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4824
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4436
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2052
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4420
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4536
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3108
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4128
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    PID:4960

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
          Filesize

          2KB

          MD5

          f473e70556e9e801c6b53aae7cb526a5

          SHA1

          6c9e058016129eaa050036140a1c2b86d810de64

          SHA256

          c3e005b121b8ad47b901bf1eadf3f33c1ffb68c29ad8df7cfc666a4b2e74f06b

          SHA512

          9bbdca7d5b4efe5c4cb52dee782db6801dcb3de643a00b6cbacd45befa743996acdcf2d6723f704079a0c272e68821e4f93bb4f366f57dbb57a3129fc104f653

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
          Filesize

          36KB

          MD5

          0e2a09c8b94747fa78ec836b5711c0c0

          SHA1

          92495421ad887f27f53784c470884802797025ad

          SHA256

          0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

          SHA512

          61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel
          Filesize

          36KB

          MD5

          fb5f8866e1f4c9c1c7f4d377934ff4b2

          SHA1

          d0a329e387fb7bcba205364938417a67dbb4118a

          SHA256

          1649ec9493be27f76ae7304927d383f8a53dd3e41ea1678bacaff33120ea4170

          SHA512

          0fbe2843dfeab7373cde0643b20c073fdc2fcbefc5ae581fd1656c253dfa94e8bba4d348e95cc40d1e872456ecca894b462860aeac8b92cedb11a7cad634798c

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\HVCJPK60\microsoft.windows[1].xml
          Filesize

          97B

          MD5

          72bf25ac6d3c8077e265f7625887105b

          SHA1

          51b52bc669e01811e9261069b4e6c703160f3b90

          SHA256

          760a918c3a9caefe1573ab926c6e3c703b0d0ce7cb3db83e018241bd5c72cad1

          SHA512

          f4d5a1a1b044a22f85cca274419fa6b4bf6debe41689305a642696de8858c10ace5312b95795d2e4a6ae9d3df3130a203294008879fc87a4b81e3d2e99684160

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Mozilla\update_27.exe
          Filesize

          189KB

          MD5

          873ab58d8b14eb82eca77ea58c086d9b

          SHA1

          295b605b0cb79f96ebb85c20092d4b36abd56de6

          SHA256

          2588b9fc27f5cbe9f496153803cc2aa22a5280f6194bb1bb8d3bb3d1009b30c5

          SHA512

          3331392cd54d144a07ffc176e569b97842f66d007dc99d477b2ca53788d6a594da86b486565d7a4db3bbd044569a76242e983e5e0fdaf98ba159894ef4a8b0e1

          Download Submit

        • memory/224-4-0x00000000751B0000-0x0000000075960000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/224-5-0x00000000027D0000-0x00000000027E0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/224-15-0x00000000751B0000-0x0000000075960000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/224-0-0x00000000005D0000-0x00000000005D8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/2052-34-0x000002178AD60000-0x000002178AD80000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2052-36-0x000002178AD20000-0x000002178AD40000-memory.dmp

          Filesize

          128KB

          Download

        • memory/2052-38-0x000002178B130000-0x000002178B150000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3108-100-0x000001968FE20000-0x000001968FE40000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3108-103-0x00000196901E0000-0x0000019690200000-memory.dmp

          Filesize

          128KB

          Download

        • memory/3108-102-0x000001968FBD0000-0x000001968FBF0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4128-122-0x0000028E892B0000-0x0000028E892D0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4128-124-0x0000028E89270000-0x0000028E89290000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4128-125-0x0000028E89680000-0x0000028E896A0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4420-59-0x000001C700220000-0x000001C700240000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4420-60-0x000001C700630000-0x000001C700650000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4420-57-0x000001C700260000-0x000001C700280000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4536-81-0x000002C013DD0000-0x000002C013DF0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4536-79-0x000002C014020000-0x000002C014040000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4536-82-0x000002C0143E0000-0x000002C014400000-memory.dmp

          Filesize

          128KB

          Download

        • memory/4812-26-0x0000000006F70000-0x0000000006FD6000-memory.dmp

          Filesize

          408KB

          Download

        • memory/4812-115-0x00000000751B0000-0x0000000075960000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4812-24-0x0000000005550000-0x0000000005AF4000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/4812-23-0x0000000005490000-0x0000000005522000-memory.dmp

          Filesize

          584KB

          Download

        • memory/4812-22-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4812-133-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4812-21-0x00000000751B0000-0x0000000075960000-memory.dmp

          Filesize

          7.7MB

          Download

        • memory/4812-17-0x0000000002070000-0x0000000002082000-memory.dmp

          Filesize

          72KB

          Download

        • memory/4824-27-0x0000000002F10000-0x0000000002F11000-memory.dmp

          Filesize

          4KB

          Download