Overview

overview

8

Static

static

3

3e5d00a0c1...7c.exe

windows7-x64

8

3e5d00a0c1...7c.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    155s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 02:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3e5d00a0c1631e94b08f8fa84145748f5616662a89e2c0b4d5df3dba864b217c.exe

  • Size

    146KB

  • MD5

    ed9f7a9870f20f13ae0521ef922463ef

  • SHA1

    bd2e8abbe8258c6c9c16ab7d8cba11a9d73f28e8

  • SHA256

    3e5d00a0c1631e94b08f8fa84145748f5616662a89e2c0b4d5df3dba864b217c

  • SHA512

    16650c47c11fe03f3b7a19b04fdb1a3d30c8430df9f9136976546ca0b1b48e39ea24949322db08d067b799e3bd568d716af49cfe398b96df2b923429c416aa95

  • SSDEEP

    3072:3gHIxZV+Lu+djDW67COI/4PNzp4e/ZV7ypAjvyNaTsOhzynOhzyE:Qo/+/DV7CiPNeI/VxzyyzyE

Score
8/10
persistence

Malware Config

Signatures

  • Downloads MZ/PE file
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e5d00a0c1631e94b08f8fa84145748f5616662a89e2c0b4d5df3dba864b217c.exe
    "C:\Users\Admin\AppData\Local\Temp\3e5d00a0c1631e94b08f8fa84145748f5616662a89e2c0b4d5df3dba864b217c.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3248
    • C:\Users\Admin\AppData\Roaming\Microsoft\update_17.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\update_17.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3328
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3720
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2676
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4272
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1432
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1540
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4324
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    PID:4356

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
    Filesize

    2KB

    MD5

    cc4e4914d5f9a1ecb6b15d2cb7321e40

    SHA1

    dbd37052b5c7c2caf5a3f13ba5fb055276308e9e

    SHA256

    16c61dce000032ad47e638887795a1667c17953005aadfe56a83182facb963a2

    SHA512

    e4195619bc5354b34b15ab79db117aa79b0ba7aec9ee7a57414552577f4e55801ffebcf095cfda747c5d4246b29c0d3aa3fd8f833b61817e373dd08357334419

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
    Filesize

    36KB

    MD5

    0e2a09c8b94747fa78ec836b5711c0c0

    SHA1

    92495421ad887f27f53784c470884802797025ad

    SHA256

    0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

    SHA512

    61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133522653405459603.txt
    Filesize

    74KB

    MD5

    c09e63e4b960a163934b3c29f3bd2cc9

    SHA1

    d3a43b35c14ae2e353a1a15c518ab2595f6a0399

    SHA256

    308deca5e1ef4d875fbe0aff3ce4b0b575b28e643dffda819d4390ec77faf157

    SHA512

    5ca3321034dff47e3afe0b0bdfaffc08782991660910a29375a8e0363794b78247282aba65dbd882ae225aa140ae63927dfd0946a441ee6fa64a1d8c146777b9

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\0A55C1OB\microsoft.windows[1].xml
    Filesize

    97B

    MD5

    291a3f3ebf21195c8af7c2f120ca4dfc

    SHA1

    1cade2dac000db3bca92e2daee371beffd2c0bee

    SHA256

    fbe32bda6ca669397ca6d02b329f235aee87a8f36b09a589548e969c19cb78de

    SHA512

    ed2dea282f97d25171e0e95fe718103e04e37f13a1edf79373af204ac344cdb9a0fca34d82e45d3475a9845ee92644a99a1c2733f8858fe384e3b6958331f287

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\update_17.exe
    Filesize

    189KB

    MD5

    873ab58d8b14eb82eca77ea58c086d9b

    SHA1

    295b605b0cb79f96ebb85c20092d4b36abd56de6

    SHA256

    2588b9fc27f5cbe9f496153803cc2aa22a5280f6194bb1bb8d3bb3d1009b30c5

    SHA512

    3331392cd54d144a07ffc176e569b97842f66d007dc99d477b2ca53788d6a594da86b486565d7a4db3bbd044569a76242e983e5e0fdaf98ba159894ef4a8b0e1

    Download Submit

  • memory/1432-102-0x00000285D1580000-0x00000285D15A0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1432-99-0x00000285D15C0000-0x00000285D15E0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1432-104-0x00000285D1990000-0x00000285D19B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1540-125-0x000002A8D8580000-0x000002A8D85A0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1540-120-0x000002A8D81B0000-0x000002A8D81D0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1540-122-0x000002A8D8170000-0x000002A8D8190000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2256-26-0x0000000006F70000-0x0000000006FD6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2256-17-0x0000000000550000-0x0000000000562000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2256-91-0x0000000004B50000-0x0000000004B60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2256-24-0x0000000005550000-0x0000000005AF4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2256-23-0x0000000005470000-0x0000000005502000-memory.dmp

    Filesize

    584KB

    Download

  • memory/2256-21-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2256-89-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2256-22-0x0000000004B50000-0x0000000004B60000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2676-34-0x00000232211D0000-0x00000232211F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2676-37-0x0000023221190000-0x00000232211B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2676-41-0x00000232215A0000-0x00000232215C0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3248-0-0x00000000006E0000-0x00000000006E8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3248-5-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3248-16-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3248-4-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3328-27-0x00000000032C0000-0x00000000032C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4272-81-0x0000026072760000-0x0000026072780000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4272-78-0x0000026072350000-0x0000026072370000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4272-75-0x0000026072390000-0x00000260723B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4324-141-0x000001CC67580000-0x000001CC675A0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4324-143-0x000001CC67540000-0x000001CC67560000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4324-147-0x000001CC67950000-0x000001CC67970000-memory.dmp

    Filesize

    128KB

    Download