Overview

overview

8

Static

static

3

7092574d38...in.exe

windows7-x64

8

7092574d38...in.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 14:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe

  • Size

    482KB

  • MD5

    25d72d34f52ba14ada5c72c9eff02463

  • SHA1

    098c93ddab6367c98aa99768e2da6867dd09efa1

  • SHA256

    8744e6236ee0b20a5f3c67b2de79a0e7089ef99ab1328a3040e229233bc4899b

  • SHA512

    f272f873e9eb8452393ad1d5944aed253711bbb4f0a7f3b0ce138c2129942293330df93056a2d3753e6d6ddcecc50df2f910e45d37baa6c456d018ee5c66c6f5

  • SSDEEP

    12288:ksZKAFyMOm0WWVjQOr7omnx552mZeCUfFv:kq0nm0hS5mnb52m9Qv

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 356
      2⤵
      • Program crash
      PID:4680
    • C:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe
      C:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • System policy modification
      PID:3036
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 332
        3⤵
        • Program crash
        PID:3512
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 668
        3⤵
        • Program crash
        PID:3676
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 800
        3⤵
        • Program crash
        PID:4580
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 844
        3⤵
        • Program crash
        PID:5048
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 788
        3⤵
        • Program crash
        PID:2952
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 788
        3⤵
        • Program crash
        PID:4008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1072
        3⤵
        • Program crash
        PID:1272
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1292
        3⤵
        • Program crash
        PID:4016
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3828 -ip 3828
    1⤵
      PID:1436
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3036 -ip 3036
      1⤵
        PID:1276
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3036 -ip 3036
        1⤵
          PID:3968
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3036 -ip 3036
          1⤵
            PID:4776
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3036 -ip 3036
            1⤵
              PID:4364
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3036 -ip 3036
              1⤵
                PID:4036
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3036 -ip 3036
                1⤵
                  PID:3048
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3036 -ip 3036
                  1⤵
                    PID:1104
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3036 -ip 3036
                    1⤵
                      PID:3096
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3300
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:2644
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:2540
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                        • Suspicious behavior: AddClipboardFormatListener
                        PID:2444
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:2992
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:1688
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:4548
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                          1⤵
                            PID:4932
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3360
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1368
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4696
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:2704
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:1500

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\8VBVX8VN\microsoft.windows[1].xml
                            Filesize

                            97B

                            MD5

                            8ac4d213b6b3beac6a352535e60a34c8

                            SHA1

                            defe9fb706a2c397800e4c4987d3fc4c23ac2398

                            SHA256

                            069cde6d3c9bac2415b31dc44b4dce558d142bf23b3fc33c2567cec3be21f642

                            SHA512

                            ded514d0213f2637dec9bef4372ad89d427ffc1e16a0bf170a803570131b8b5bd22a3a17c83d2cabfcf49dd4481e57479c654f2e76ec4d818d6bdfd3a7da854c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe
                            Filesize

                            482KB

                            MD5

                            0e8eb2c5488276f31108ccb7809fdbd4

                            SHA1

                            d927791ee1cae5196b1a91644de7b879c89414e2

                            SHA256

                            a25f9aa2a90f3527e9275cb824481d69dd672f57d5317cc0470f91a7dbedd211

                            SHA512

                            0fbeef6e002b5e4dbe3c82f1ac39b3a08d832caec84d7fdca6b8640bcfcb5361bacda3e03c719a6622a483c9d29d508cf09a4ac5e04a7379721d430d4584a517

                            Download Submit

                          • memory/1368-81-0x000001EC57740000-0x000001EC57760000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1368-83-0x000001EC57700000-0x000001EC57720000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1368-85-0x000001EC57B00000-0x000001EC57B20000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1500-148-0x000001AE34B00000-0x000001AE34B20000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1500-144-0x000001AE34740000-0x000001AE34760000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/1500-146-0x000001AE34700000-0x000001AE34720000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2540-26-0x00000000029F0000-0x00000000029F1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/2704-128-0x000001CE2F5C0000-0x000001CE2F5E0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2704-126-0x000001CE2F1B0000-0x000001CE2F1D0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/2704-123-0x000001CE2F1F0000-0x000001CE2F210000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3036-24-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/3036-16-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/3036-9-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                            Download

                          • memory/3036-8-0x0000000004DA0000-0x0000000004E12000-memory.dmp

                            Filesize

                            456KB

                            Download

                          • memory/3036-7-0x0000000000400000-0x0000000000472000-memory.dmp

                            Filesize

                            456KB

                            Download

                          • memory/3360-63-0x0000021203560000-0x0000021203580000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3360-66-0x0000021203970000-0x0000021203990000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3360-60-0x00000212035A0000-0x00000212035C0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/3828-0-0x0000000000400000-0x0000000000472000-memory.dmp

                            Filesize

                            456KB

                            Download

                          • memory/3828-6-0x0000000000400000-0x0000000000472000-memory.dmp

                            Filesize

                            456KB

                            Download

                          • memory/4548-38-0x0000021244EF0000-0x0000021244F10000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4548-36-0x00000212447E0000-0x0000021244800000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4548-33-0x0000021244B20000-0x0000021244B40000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4696-102-0x00000211D0FE0000-0x00000211D1000000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4696-106-0x00000219D26C0000-0x00000219D26E0000-memory.dmp

                            Filesize

                            128KB

                            Download

                          • memory/4696-104-0x00000211D0FA0000-0x00000211D0FC0000-memory.dmp

                            Filesize

                            128KB

                            Download