Overview

overview

9

Static

static

3

980d9b1ed0...8b.exe

windows7-x64

9

980d9b1ed0...8b.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 23:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    980d9b1ed07508c2fdb239f770122251dd4aecf7b05a7f0f55efab691d5d248b.exe

  • Size

    482KB

  • MD5

    228bbbc086fec440340d6880230d7149

  • SHA1

    c85f0310a666a5a142a4b32a51a7580961381d91

  • SHA256

    980d9b1ed07508c2fdb239f770122251dd4aecf7b05a7f0f55efab691d5d248b

  • SHA512

    c6e25b9cb8b253853e73a7cd46424e0bb5e0e7f8a93c4c79862e4aff4b165c77a3ebcc308bfdd87c89fb2ce1b19489e0280318f80ef671125b188eb735271b51

  • SSDEEP

    12288:hniMDUlLG4gczO4qsDX15fvSB3nds6lofIdxtcezZ+JdP+NIUyKVWP33pUfFH:huSB3ndX71jNzyKIPHpQH

Score
9/10
persistence

Malware Config

Signatures

  • Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs
  • Detects executables referencing many IR and analysis tools 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 9 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 27 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\980d9b1ed07508c2fdb239f770122251dd4aecf7b05a7f0f55efab691d5d248b.exe
    "C:\Users\Admin\AppData\Local\Temp\980d9b1ed07508c2fdb239f770122251dd4aecf7b05a7f0f55efab691d5d248b.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 356
      2⤵
      • Program crash
      PID:3328
    • C:\Users\Admin\AppData\Local\Temp\980d9b1ed07508c2fdb239f770122251dd4aecf7b05a7f0f55efab691d5d248b.exe
      C:\Users\Admin\AppData\Local\Temp\980d9b1ed07508c2fdb239f770122251dd4aecf7b05a7f0f55efab691d5d248b.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      • System policy modification
      PID:4948
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 324
        3⤵
        • Program crash
        PID:3624
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 668
        3⤵
        • Program crash
        PID:5060
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 768
        3⤵
        • Program crash
        PID:856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 828
        3⤵
        • Program crash
        PID:3224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 928
        3⤵
        • Program crash
        PID:4032
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 948
        3⤵
        • Program crash
        PID:4300
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1072
        3⤵
        • Program crash
        PID:2008
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 1308
        3⤵
        • Program crash
        PID:1616
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5024 -ip 5024
    1⤵
      PID:3248
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4948 -ip 4948
      1⤵
        PID:3964
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4948 -ip 4948
        1⤵
          PID:4844
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4948 -ip 4948
          1⤵
            PID:1096
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4948 -ip 4948
            1⤵
              PID:1924
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4948 -ip 4948
              1⤵
                PID:2808
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4948 -ip 4948
                1⤵
                  PID:4296
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4948 -ip 4948
                  1⤵
                    PID:1936
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4948 -ip 4948
                    1⤵
                      PID:1900
                    • C:\Windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:388
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                          PID:3872
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                        • Modifies Installed Components in the registry
                        • Enumerates connected drives
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of SetWindowsHookEx
                        PID:4728
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                        • Suspicious behavior: AddClipboardFormatListener
                        PID:2996
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                        1⤵
                          PID:3956
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:4400
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:4756
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                          1⤵
                            PID:3752
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4424
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4476
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:4880
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3036
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3156
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:3344

                            Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133541540987519249.txt
                                    Filesize

                                    74KB

                                    MD5

                                    80dffedad36ef4c303579f8c9be9dbd7

                                    SHA1

                                    792ca2a83d616ca82d973ece361ed9e95c95a0d8

                                    SHA256

                                    590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e

                                    SHA512

                                    826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                    Filesize

                                    23KB

                                    MD5

                                    442e94ca14a336439a7a300362d2cd61

                                    SHA1

                                    cf0d5e63813987798aa7b1c97dbe8f16749d5335

                                    SHA256

                                    0a803f6c42933253240516e5843b1b3195516e9dba83cf777ffacb0589cae63f

                                    SHA512

                                    ad2a1b4cba622b2668db86eb8924049ac509740bc474396ec8df94ce7133356e14cbe8ca4f1952de485d78fde243ce4af6eeeea6149f27e2d8367f8eac2c74bd

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1SA07OI6\microsoft.windows[1].xml
                                    Filesize

                                    97B

                                    MD5

                                    fb9854a5b056cc3d006b38bf0eab1b7c

                                    SHA1

                                    0a2b0432e2e9938be1f652c2247827e47b265f44

                                    SHA256

                                    3d454d15255bb82fb8a4cfa40ea848af32395be899aaaf83b6d626a814aa21c2

                                    SHA512

                                    20366182bf5a658b19e3df4eef2fa4e484bdcecc85a893834fbcb2b0ab64100a7694c3dbbdf1597bf3e3a747ede6fe7b81aab5f07653ef40a515edbef90ed00d

                                    Download Submit

                                  • C:\Users\Admin\AppData\Local\Temp\980d9b1ed07508c2fdb239f770122251dd4aecf7b05a7f0f55efab691d5d248b.exe
                                    Filesize

                                    482KB

                                    MD5

                                    ed8a198b288139ab7ddef4deb661a434

                                    SHA1

                                    db95cebd124ff4386438fb74b1575cc84e334d62

                                    SHA256

                                    d3f6c103ce5b5918499d4d607fd4bbce88a372c7b0927578c2cc8071bb707bb2

                                    SHA512

                                    184fbdbbc0e9df2b2b041738dae96b2683bc9918fc059f36d0f84596be6e8ae2a18537f13946be0f2646f263526d769189b941303b8327466cf1b3de28d34629

                                    Download Submit

                                  • memory/3036-145-0x0000026B37510000-0x0000026B37530000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3036-142-0x0000026B37100000-0x0000026B37120000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3036-140-0x0000026B37140000-0x0000026B37160000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3156-163-0x0000022BDBDB0000-0x0000022BDBDD0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3156-165-0x0000022BDC1C0000-0x0000022BDC1E0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/3156-161-0x0000022BDBDF0000-0x0000022BDBE10000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4424-66-0x0000023354DC0000-0x0000023354DE0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4424-61-0x00000233549F0000-0x0000023354A10000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4424-64-0x00000233549B0000-0x00000233549D0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4476-82-0x000002295F7E0000-0x000002295F800000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4476-84-0x000002295F7A0000-0x000002295F7C0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4476-86-0x000002295FDB0000-0x000002295FDD0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4728-30-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/4756-40-0x000002F5CEFA0000-0x000002F5CEFC0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4756-38-0x000002F5CEB90000-0x000002F5CEBB0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4756-36-0x000002F5CEBD0000-0x000002F5CEBF0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4880-110-0x00000265EAD80000-0x00000265EADA0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4880-112-0x00000265EB190000-0x00000265EB1B0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4880-108-0x00000265EADC0000-0x00000265EADE0000-memory.dmp

                                    Filesize

                                    128KB

                                    Download

                                  • memory/4948-23-0x0000000000400000-0x000000000045A000-memory.dmp

                                    Filesize

                                    360KB

                                    Download

                                  • memory/4948-16-0x0000000000400000-0x000000000045A000-memory.dmp

                                    Filesize

                                    360KB

                                    Download

                                  • memory/4948-8-0x0000000000400000-0x000000000045A000-memory.dmp

                                    Filesize

                                    360KB

                                    Download

                                  • memory/4948-9-0x0000000004DF0000-0x0000000004E62000-memory.dmp

                                    Filesize

                                    456KB

                                    Download

                                  • memory/4948-7-0x0000000000400000-0x0000000000472000-memory.dmp

                                    Filesize

                                    456KB

                                    Download

                                  • memory/5024-0-0x0000000000400000-0x0000000000472000-memory.dmp

                                    Filesize

                                    456KB

                                    Download

                                  • memory/5024-6-0x0000000000400000-0x0000000000472000-memory.dmp

                                    Filesize

                                    456KB

                                    Download