Overview

overview

8

Static

static

3

637cbb8198...87.exe

windows7-x64

8

637cbb8198...87.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-02-2024 02:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe

  • Size

    779KB

  • MD5

    29ed8ed38aa3310224ef25972588a369

  • SHA1

    d7ff6bc8075abd5f500d10994061c737ede21740

  • SHA256

    637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787

  • SHA512

    e42a55fa01a6b8340c087f7ac15d117933baa91467777f25a7868629d48db2fc6703e3d976e1da4a160d9c20383a8d5ce75f52e8e2425c9f4126aab39e11ca9b

  • SSDEEP

    12288:xPJTcmjRN6KSYqk5lvgKTgt9awhBcxetQmBVRTqeRKwpNtW4fo:lJ4m9iyv28whSwNBVRTwwpK

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe
    "C:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 356
      2⤵
      • Program crash
      PID:2352
    • C:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe
      C:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • System policy modification
      PID:1676
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 324
        3⤵
        • Program crash
        PID:484
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 668
        3⤵
        • Program crash
        PID:2228
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 800
        3⤵
        • Program crash
        PID:4224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 840
        3⤵
        • Program crash
        PID:4620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 932
        3⤵
        • Program crash
        PID:1768
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 972
        3⤵
        • Program crash
        PID:4588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 920
        3⤵
        • Program crash
        PID:2160
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 1260
        3⤵
        • Program crash
        PID:5052
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1612 -ip 1612
    1⤵
      PID:4712
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1676 -ip 1676
      1⤵
        PID:3668
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1676 -ip 1676
        1⤵
          PID:4992
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1676 -ip 1676
          1⤵
            PID:3636
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1676 -ip 1676
            1⤵
              PID:4552
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1676 -ip 1676
              1⤵
                PID:1048
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1676 -ip 1676
                1⤵
                  PID:2152
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1676 -ip 1676
                  1⤵
                    PID:4312
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1676 -ip 1676
                    1⤵
                      PID:2788
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Modifies registry class
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of WriteProcessMemory
                      PID:5004
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:3168
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:704
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                        • Suspicious behavior: AddClipboardFormatListener
                        PID:2344
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:2632
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:4636
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                          1⤵
                            PID:1508
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:484
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2640
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4400
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1732
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2380
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2572

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8VBVX8VN\microsoft.windows[1].xml
                            Filesize

                            97B

                            MD5

                            8ac4d213b6b3beac6a352535e60a34c8

                            SHA1

                            defe9fb706a2c397800e4c4987d3fc4c23ac2398

                            SHA256

                            069cde6d3c9bac2415b31dc44b4dce558d142bf23b3fc33c2567cec3be21f642

                            SHA512

                            ded514d0213f2637dec9bef4372ad89d427ffc1e16a0bf170a803570131b8b5bd22a3a17c83d2cabfcf49dd4481e57479c654f2e76ec4d818d6bdfd3a7da854c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\637cbb8198159c5c2e533342e104ebfc733e5f931575d1147e425251c63f6787.exe
                            Filesize

                            779KB

                            MD5

                            26a288f8d52760c893ca810232bc0619

                            SHA1

                            5e6879b29a79b667438a5865f9db739dd8169de1

                            SHA256

                            d52d91b0ddc9cca34ef9f740d9d895eed9c84b2e448e58335f151b315e6044e7

                            SHA512

                            ec77dbe1f40e2176a5300f1e735290699cfbb7341b90de86cd2038d73068203a121b66a77eb29b1065a59f1e4baed0ceb971237a8fe4857b054771d88bbf25a1

                            Download Submit

                          • memory/484-39-0x0000024EC7320000-0x0000024EC7340000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/484-41-0x0000024EC7730000-0x0000024EC7750000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/484-37-0x0000024EC7360000-0x0000024EC7380000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/704-29-0x0000000004640000-0x0000000004641000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/1612-6-0x0000000000400000-0x000000000047C000-memory.dmp

                            Filesize

                            496KB

                            Download

                          • memory/1612-0-0x0000000000400000-0x000000000047C000-memory.dmp

                            Filesize

                            496KB

                            Download

                          • memory/1676-23-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/1676-16-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/1676-9-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/1676-8-0x0000000004F40000-0x0000000004FBC000-memory.dmp

                            Filesize

                            496KB

                            Download

                          • memory/1676-7-0x0000000000400000-0x000000000047C000-memory.dmp

                            Filesize

                            496KB

                            Download

                          • memory/1732-98-0x000001FAEE850000-0x000001FAEE870000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1732-92-0x000001FAEE480000-0x000001FAEE4A0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1732-96-0x000001FAEE440000-0x000001FAEE460000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2380-115-0x000002108FCE0000-0x000002108FD00000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2380-113-0x000002108FD20000-0x000002108FD40000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2380-118-0x00000210900F0000-0x0000021090110000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2572-134-0x000001F6034D0000-0x000001F6034F0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2572-136-0x000001F603490000-0x000001F6034B0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2572-139-0x000001F6038A0000-0x000001F6038C0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2640-64-0x0000027E858A0000-0x0000027E858C0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2640-58-0x0000027E852D0000-0x0000027E852F0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2640-60-0x0000027E85290000-0x0000027E852B0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4400-78-0x000001F9E2600000-0x000001F9E2620000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4400-76-0x000001F9E2200000-0x000001F9E2220000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4400-74-0x000001F9E2240000-0x000001F9E2260000-memory.dmp

                            Filesize

                            128KB

                            Download