Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    04/04/2024, 23:03

General

  • Target

    93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe

  • Size

    1.1MB

  • MD5

    29d044809809aabd82305ce04ac88736

  • SHA1

    683b89f68681730e2828be556d5c687cc1a4a2bf

  • SHA256

    93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c

  • SHA512

    a7517d7e12962ee42ff42fb941bc6756238cb9f157e8f14958563fc43f9929db8b3a76fd944d7136e21b5bc85178c76b2ba0e412ceb828a74e5b5e78b735c286

  • SSDEEP

    12288:Lkt3OB1IWL78Z8L7JQQRfOBkkt3OB9JQQRnOBHIWL7JQQRZOBrOB1IWL7JQQRZOV:4eB1BRWBZeBbROBHDRABqB1DRAB19

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs
  • UPX dump on OEP (original entry point) 61 IoCs
  • Disables RegEdit via registry modification 5 IoCs
  • Sets file execution options in registry 2 TTPs 20 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 8 IoCs
  • Modifies system executable filetype association 2 TTPs 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 10 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 43 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 20 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe
    "C:\Users\Admin\AppData\Local\Temp\93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\64746\service.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\64746\service.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Sets file execution options in registry
      • Drops startup file
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2656
    • C:\Windows\35838\smss.exe
      "C:\Windows\35838\smss.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Sets file execution options in registry
      • Drops startup file
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2412
    • C:\Windows\35838\system.exe
      "C:\Windows\35838\system.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Sets file execution options in registry
      • Drops startup file
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2824
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\64746\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\64746\winlogon.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Sets file execution options in registry
      • Drops startup file
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:300
    • C:\Windows\lsass.exe
      "C:\Windows\lsass.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Sets file execution options in registry
      • Drops startup file
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\35838\system.exe

    Filesize

    1.1MB

    MD5

    29d044809809aabd82305ce04ac88736

    SHA1

    683b89f68681730e2828be556d5c687cc1a4a2bf

    SHA256

    93d67529cf14412f253e3ffc005e235733a4fea83e999f77fac31a0f581a867c

    SHA512

    a7517d7e12962ee42ff42fb941bc6756238cb9f157e8f14958563fc43f9929db8b3a76fd944d7136e21b5bc85178c76b2ba0e412ceb828a74e5b5e78b735c286

  • C:\Windows\MoonLight.txt

    Filesize

    176B

    MD5

    56473592d37a13c9098b21cb442e60fd

    SHA1

    6f0f49440289a6cef1d93e8c785747a3fb318688

    SHA256

    acdcb1f96825ca74387ebe03f2a12291f7678da2cf6092607aea2dab6982cf35

    SHA512

    6c635dc4f1ce55b54e39992531b0a4024c213af7fc3ab0f5b2642a932cb2201e7037a60e37c7aad42308ab7a84f0a2c655391935749d76f02ae7c3afd765dd2a

  • C:\Windows\SysWOW64\crtsys.dll

    Filesize

    120B

    MD5

    9ae4a469cf7e668ccde8c0fa0a906282

    SHA1

    eded194c39a8ecd19da33a338bfe43a1266a8d53

    SHA256

    7f3ee2d2827fa3c2e8ef5f073c40a52f79acf1d8c26d6812c19fb985e3736a22

    SHA512

    fcc863ce54dd4dad2464b8551a7e224467a0c0785d511fa2af28490913560113cf0541690cd65d1f12f063df3866233ba80262cd281f7ef5346bd323bef3ee2b

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.1MB

    MD5

    b128bc57cc86fe69c2ea4e1fa881609c

    SHA1

    ff902939b3a48de09a518c5b64cc8f198a33e9a5

    SHA256

    d5cb68a9ec8f4b3ced5e1ab7cdacecd21bc5ed38a03ba8cfe5d1e7ce50aab737

    SHA512

    e0436ea39aed9ee6075e82a8586a82660db15c30e940560dfad4c620b60324c7719175a5a8439b1d13639c29197100cd7357032284b45183df05bbad588a0e0d

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    71023e7fffa6a0be2de4f19868caeedc

    SHA1

    be49b39cbe8ea9b0d2aaa4541e0faf1a690eede3

    SHA256

    2a71378796a7c5978c19bb90bd6fde1aa2c541f490239b8c62fb5895db23414c

    SHA512

    473522fdfe66facec49dc55abd9eeca864931016df7459666d4cd7100d5d2c1146faa4c97f62673f1283b7a678ff3f69290f61064254f09619611d1441f602f0

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    1c7fd53a5274e107f1f99a135ac4c33b

    SHA1

    1d1c8b328bfa5a8358e018fb92c66f22a825e682

    SHA256

    7fd00a20410c651b482440352e7d4ffce4b7155595053584e3acc80b0f12014c

    SHA512

    ece3d35b7f3b695d9b4034b22bb3bcdd4f12b19349f4c016f4b307ca9347389f6f04a508c6df31cbdd624056f701df6e312872ae8e0f1a33cdd4a8ae379b1bb0

  • C:\Windows\system\msvbvm60.dll

    Filesize

    320KB

    MD5

    e127fa7006e40320de8026258097ea02

    SHA1

    65dcfb4003ed722ba670661bc90470141457ca65

    SHA256

    a2051f9d1420d3d80cdb03b6219c0ec0c55b59a7a2eecfc6b9685639d2bfa29d

    SHA512

    32be160316820bb6fab46f6d103d3cabe876e2a18d852a766a7cf005be8da4d593d2df82948f2f5a6488d04c7fcd46a726368d210c83df3555eb5eeb517704f3

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

  • C:\Windows\system\msvbvm60.dll

    Filesize

    1.3MB

    MD5

    a80d803cc767cf411cf17145423da49c

    SHA1

    4b1c2b04ee012e54d2933c70758e872a7e0c4097

    SHA256

    3e42e1fb91cd42bab7dac50c45af1da6f860931ffee77828a82033d7a2f5e6b4

    SHA512

    b5349e4d0e7102721a21abd0a50e6c5cd3ea1eaa77f530aac65b23a7755342b55fe3405281007e346b78e022c5247be0d9271275316bca6d37fbca9e89c74975

  • memory/300-1061-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-924-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-1032-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-982-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-950-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-810-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-257-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-1008-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-899-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-1089-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-1116-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-872-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/300-842-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2352-819-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-870-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-897-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-1141-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-813-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-808-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-1114-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-1087-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-1055-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-67-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-840-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-1006-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-980-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-948-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2412-922-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2604-102-0x00000000030B0000-0x00000000030DA000-memory.dmp

    Filesize

    168KB

  • memory/2604-51-0x00000000030B0000-0x00000000030DA000-memory.dmp

    Filesize

    168KB

  • memory/2604-314-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2604-65-0x00000000030B0000-0x00000000030DA000-memory.dmp

    Filesize

    168KB

  • memory/2604-52-0x00000000030B0000-0x00000000030DA000-memory.dmp

    Filesize

    168KB

  • memory/2604-811-0x00000000030B0000-0x00000000030DA000-memory.dmp

    Filesize

    168KB

  • memory/2604-253-0x00000000030B0000-0x00000000030DA000-memory.dmp

    Filesize

    168KB

  • memory/2604-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-812-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-53-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-947-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-1054-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-979-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-807-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-1113-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-1140-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-1004-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-865-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-839-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-1086-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-1029-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-921-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2656-896-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-871-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-809-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-1056-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-1031-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-841-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-1007-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-1088-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-108-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-981-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-832-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-1115-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-898-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-949-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-923-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2824-1142-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB