Overview

overview

8

Static

static

3

dc01538945...da.exe

windows7-x64

8

dc01538945...da.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    146s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/02/2024, 04:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc01538945b1121e18f1f6656d55e8fa8cec0aed2e9015e476c55df7811497da.exe

  • Size

    779KB

  • MD5

    cd8e731337d332787b69e21222e13beb

  • SHA1

    3e745c12f803da6de8546bd7b976edc751cd050d

  • SHA256

    dc01538945b1121e18f1f6656d55e8fa8cec0aed2e9015e476c55df7811497da

  • SHA512

    adcd4e0235911a2a9915524b079f0bfe1c92f297b10f180e34f55953b1682a4f44c6b87c7a33c5a643b8a433e095ffdab493d01c1a65558ff32ecfe97ab43e34

  • SSDEEP

    12288:xPJTcmjRN6KSYqk5lvgKTgt9awhBcxetWmBVRTqeRKwpNtW4fo:lJ4m9iyv28whSw7BVRTwwpK

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc01538945b1121e18f1f6656d55e8fa8cec0aed2e9015e476c55df7811497da.exe
    "C:\Users\Admin\AppData\Local\Temp\dc01538945b1121e18f1f6656d55e8fa8cec0aed2e9015e476c55df7811497da.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 324
      2⤵
      • Program crash
      PID:4932
    • C:\Users\Admin\AppData\Local\Temp\dc01538945b1121e18f1f6656d55e8fa8cec0aed2e9015e476c55df7811497da.exe
      C:\Users\Admin\AppData\Local\Temp\dc01538945b1121e18f1f6656d55e8fa8cec0aed2e9015e476c55df7811497da.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • System policy modification
      PID:4952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 332
        3⤵
        • Program crash
        PID:2284
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 668
        3⤵
        • Program crash
        PID:540
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 800
        3⤵
        • Program crash
        PID:1104
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 840
        3⤵
        • Program crash
        PID:400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 932
        3⤵
        • Program crash
        PID:2100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 932
        3⤵
        • Program crash
        PID:5012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 696
        3⤵
        • Program crash
        PID:3576
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 1296
        3⤵
        • Program crash
        PID:1384
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2712 -ip 2712
    1⤵
      PID:720
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4952 -ip 4952
      1⤵
        PID:3088
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4952 -ip 4952
        1⤵
          PID:680
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4952 -ip 4952
          1⤵
            PID:4476
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4952 -ip 4952
            1⤵
              PID:1116
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4952 -ip 4952
              1⤵
                PID:4912
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4952 -ip 4952
                1⤵
                  PID:216
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4952 -ip 4952
                  1⤵
                    PID:4028
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4952 -ip 4952
                    1⤵
                      PID:1536
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1556
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:4216
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:2016
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                        • Suspicious behavior: AddClipboardFormatListener
                        PID:3620
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:2456
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:4792
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:2432
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                          1⤵
                            PID:1540
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4208
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4128
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4092
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2324
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1516

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\519VF3KE\microsoft.windows[1].xml
                            Filesize

                            97B

                            MD5

                            daa6646f1a81c61f62f3181f2a279c4d

                            SHA1

                            113975d5d6d6329f29778345f2fd3f516e9d61a0

                            SHA256

                            a43e0d0f211be25fda5b9607028e92970b4712dfe2596c6ca6ce0b529e7c871e

                            SHA512

                            e5ba46d1e023a760ef61aef2cd189da084d7defbef68fa891115c077625db1651cc40a3dcc3f8bc9241ac36d5ed8d45d2b57d23587855dc22aa155443e0f895e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\dc01538945b1121e18f1f6656d55e8fa8cec0aed2e9015e476c55df7811497da.exe
                            Filesize

                            779KB

                            MD5

                            4fd76bf8edab202d4327827d265e45e7

                            SHA1

                            e7924a8e300b38e5ecce52cd4d6ebbe55b3ad222

                            SHA256

                            6abbfd158cb63c51ebdd02996eca98a85baa1e61f919c54e5c1366b6bc0c8098

                            SHA512

                            6578b1ca37079492431b4223e80cddfd7efa4700dd3d6f46ecd83cfe10d5813ad912418ac1774e469295c4189b5b9f14fd0375174dbbf0c3eded33b49c3b1796

                            Download Submit

                          • memory/1516-138-0x0000020D838F0000-0x0000020D83910000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1516-135-0x0000020D831A0000-0x0000020D831C0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1516-133-0x0000020D831E0000-0x0000020D83200000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2016-26-0x0000000004D70000-0x0000000004D71000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2324-112-0x00000247852E0000-0x0000024785300000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2324-117-0x00000247858C0000-0x00000247858E0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2324-114-0x00000247852A0000-0x00000247852C0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2432-35-0x000002C376890000-0x000002C3768B0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2432-37-0x000002C376EA0000-0x000002C376EC0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2432-33-0x000002C3768D0000-0x000002C3768F0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2712-6-0x0000000000400000-0x000000000047C000-memory.dmp

                            Filesize

                            496KB

                            Download

                          • memory/2712-0-0x0000000000400000-0x000000000047C000-memory.dmp

                            Filesize

                            496KB

                            Download

                          • memory/4092-94-0x0000019828F00000-0x0000019828F20000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4092-93-0x00000198288F0000-0x0000019828910000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4092-91-0x0000019828930000-0x0000019828950000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4128-73-0x000002390CA00000-0x000002390CA20000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4128-75-0x000002390C7B0000-0x000002390C7D0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4128-77-0x000002390CDC0000-0x000002390CDE0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4208-59-0x000002AB8C9E0000-0x000002AB8CA00000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4208-57-0x000002AB8C3D0000-0x000002AB8C3F0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4208-55-0x000002AB8C620000-0x000002AB8C640000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4952-23-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/4952-16-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/4952-9-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/4952-8-0x00000000016A0000-0x000000000171C000-memory.dmp

                            Filesize

                            496KB

                            Download

                          • memory/4952-7-0x0000000000400000-0x000000000047C000-memory.dmp

                            Filesize

                            496KB

                            Download