Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    06/04/2024, 06:52

General

  • Target

    updater/enco.exe

  • Size

    6.3MB

  • MD5

    6ff10e6ee4ffb13e6b3365de94c7981c

  • SHA1

    ad109e17485829da8408687de35bc0c0ddd6965e

  • SHA256

    b8ec0b5e43c165b1a244691350172843fa06f083cbc0888f9c138cd7107e1dec

  • SHA512

    1b00c001e4b7f25ba884540b959b93e2d49f9bd6e9a829a07accb2187fc41d414838645dafb3bcf05bc79217312e4ccad71ae7b90dda9a4b88580532f7895fcf

  • SSDEEP

    49152:7m1nUoSLyXmFSbFx8q78C1XXpDYALLRENU9Qd+bukZv5GR2EHxjCZdJdZcDrgDQL:9FSbrB4WXWU9w6ZJMtHE9WbKF0l

Score
6/10

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 31 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\updater\enco.exe
    "C:\Users\Admin\AppData\Local\Temp\updater\enco.exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /Create /Xml "C:\Users\Admin\AppData\Local\Temp\.CR.28129\Avira_Security_Installation.xml" /F /TN "Avira_Security_Installation"
      2⤵
      • Creates scheduled task(s)
      PID:2988
    • C:\Users\Admin\AppData\Local\Temp\.CR.19620\Avira.Spotlight.Bootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\.CR.19620\Avira.Spotlight.Bootstrapper.exe" "C:\Users\Admin\AppData\Local\Temp\.CR.19620\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=enco.exe
      2⤵
      • Checks for any installed AV software in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2552

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\.CR.28129\Avira_Security_Installation.xml

          Filesize

          1KB

          MD5

          e09c9b75391418d9dfde9132d42d8707

          SHA1

          c6320f57e9b4fd19296f61a47c61bbfb09097cfa

          SHA256

          0b88a468fa58b21e21680de328ce0c55bef8cb36f60aa649321a904a35d983ec

          SHA512

          b6bfccd3c14a66c8d624fd3e797ebf9bd1a93a1fc746e8500e765c9aa6b10906cc1491f1f24dfab3f9bbdb2ed17c48f9ab7e3e3e07bf5a7e7e00c335ce9d2288

        • \Users\Admin\AppData\Local\Temp\.CR.19620\AVIRA.COMMON.GUARDS.DLL

          Filesize

          17KB

          MD5

          5b851b4506d10f93b988b4ee8f313824

          SHA1

          213c4928a28e8fbf5dfc06cd5c5415301daf72e5

          SHA256

          28c9ea12476af9b90857564919ab813ba2468f2dd087e482777da9a8d1811fd4

          SHA512

          c8aa2b665c5baeb2e02bcbf86e63e91fd18761b2ac5943650c1824a971586023b01c71fd758157301d41595a50214e95aa0b42a45b9ae3562b5e1a56772077fc

        • \Users\Admin\AppData\Local\Temp\.CR.19620\AVIRA.COMMON.MIXPANEL.DLL

          Filesize

          67KB

          MD5

          b99936185b1d2795ae0cda594f8c6da0

          SHA1

          dd3021a9f2bf588ff420571e0ef8d0ed0f4f76af

          SHA256

          0565243319c9bca86bd96ce75d2ddfb48fc7869eef0986134ba4627a49b3f0bb

          SHA512

          bc92f1b735139007e7ea04e8369af114e93850cc01ae270b826ba601a904eec2fe70a0826f36ff621dd9052388460ca59b464e53e4751c7788cbf3593379e1c9

        • \Users\Admin\AppData\Local\Temp\.CR.19620\AVIRA.SPOTLIGHT.BOOTSTRAPPER.CORE.DLL

          Filesize

          391KB

          MD5

          6ddc8fc93515e76d543ddb070b97cbb5

          SHA1

          fb44e0fbe50e76a9704305ff264ac0b4194750a7

          SHA256

          53ed9a31d6d646297cef5e518442c6de07afe595d8f64db18b3eadaa10eeccb8

          SHA512

          e372c3dc29489d69257b9c0c550fcba4548fdb41c3bc4ff2f81f0791a661acf53add161b4deff694f764ad7bf7cf66c515848cefbc4f4b55629abdbb9eaa82fd

        • \Users\Admin\AppData\Local\Temp\.CR.19620\AVIRA.SPOTLIGHT.BOOTSTRAPPER.ENGINE.DLL

          Filesize

          360KB

          MD5

          7e25210ab468cd9ecb7b0cb89091a2e9

          SHA1

          fe17c651637c0e27ec8ee6a409a4ced5e76d4eec

          SHA256

          7a871e2a7d6814834893229e59874922983a0060b183d3a874d6e8e6906e164d

          SHA512

          a9e48675eb2f75ad07a8b9fefde4fe7393ac1d9d8b3ed513117b2a688875218ab0142f423b77dc8616e8a2f1673f35661627162f50e1489b316c60a1b59ba6d7

        • \Users\Admin\AppData\Local\Temp\.CR.19620\AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE

          Filesize

          1.5MB

          MD5

          dd1e66288a585847ab7ae22370077a68

          SHA1

          4758fc02c40fdb2c5ba46fca20e1fece3958d313

          SHA256

          6f603b1450d2d6c70d9670b04c1c12acd82289a64a3136c466d381ba961fd594

          SHA512

          d4b936adcb60a30e91d19f7adffe2367a4608392296e8608439494a28e35f9f6f9dd8d3c08a3abbb7c4b23120f3dcf3687429ef69f824cbb24c614a2c7970ec0

        • \Users\Admin\AppData\Local\Temp\.CR.19620\AVIRA.SPOTLIGHT.BOOTSTRAPPER.LOGGING.DLL

          Filesize

          166KB

          MD5

          e965cabfd0878bb82062b32714b836a4

          SHA1

          5d3deaba03c40c32e68328ff9f04034fa174cce6

          SHA256

          54ab6e6a8b5db759592a66b56a5fa6bca1b78cb9dd99e73c331cadcf246893f6

          SHA512

          b5e0901faba3e30acc6675ffa62085e1cbed06efa786d5391ee070d5fd95dac113948879cd4b249b84ba3a0cb6f8d2388fd0a7728b453f0ffb0294a80abc7d68

        • \Users\Admin\AppData\Local\Temp\.CR.19620\AVIRA.SPOTLIGHT.BOOTSTRAPPER.REACTIVE.DLL

          Filesize

          205KB

          MD5

          7e1abdfc735b040bbe17aa1f1aeb4a16

          SHA1

          946834c5a5acd43badb866f5752fb13d9236dfab

          SHA256

          46a0c1c829e4b3cf521124c600b676b2437aaf5e34f30bb980def7be152a635a

          SHA512

          014ca9477f4c6d7920532b51d7dc0ff4450397c60b43237549c72aceb120946aff19f90bdfad145a284d10cb5c372e586588b4771f6db6e91b9126751526c948

        • \Users\Admin\AppData\Local\Temp\.CR.19620\DRYIOC.DLL

          Filesize

          440KB

          MD5

          714e25424a8aaa63d7ca6ab89019da1b

          SHA1

          509b65ba6c41095b7f33d7c5c80f6d4fc7b18586

          SHA256

          61bbf93454a27b7c4b73a5735a546a544c46e8e85dda8d93994d4d79938b9dcc

          SHA512

          73fa85df955d2534bb03e17a798cbc3b6cb5499a8d3dba952a1fc8c7f9994a8001b355efc159d4353363ced880f23d00ebe8023d8d6401163ff8497bb582738f

        • \Users\Admin\AppData\Local\Temp\.CR.19620\DRYIOC.MEFATTRIBUTEDMODEL.DLL

          Filesize

          70KB

          MD5

          d78c583cb692427a10527a014962ee01

          SHA1

          4bab8f272f8bc6183ef6f82b6747cdfeddf12d10

          SHA256

          0621244e268938b4bb1cc76bb2a1b0181ee5cf59005534d08f89eba79f900b05

          SHA512

          a3ff15876fc297149ceb693052a47ad6f361c9f0e860005aa59684d405657b23f3879f487b42ecb41883793b881275ce458cabddb5bbb5bcaeb2e01a9d4ff607

        • \Users\Admin\AppData\Local\Temp\.CR.19620\DRYIOCATTRIBUTES.DLL

          Filesize

          32KB

          MD5

          894402ba3f2225a71c4747d9928c566a

          SHA1

          b6ad87444277e2f1ff58a3aedac91021512466ce

          SHA256

          52cbbd4703e4e4cdac01615fcc623acce13113960eb45965d28d636d827315f7

          SHA512

          683849be5b0b930a71698519b07bba5df02a6ed2de84b1482dc747e380e1b51b6b3df7d65ca181579915d6c2ad649bd1f6e60d0386350af377185534f3d93cb4

        • \Users\Admin\AppData\Local\Temp\.CR.19620\EN-US\AVIRA.SPOTLIGHT.BOOTSTRAPPER.RESOURCES.DLL

          Filesize

          25KB

          MD5

          c4fd37101f93a28897549198019046ec

          SHA1

          f7ba115a2d225afa0c1220208203aeafc77e8797

          SHA256

          2d559a2ab503cd2722df043190d5ea5d06ada933420fb35939d32dec783e7375

          SHA512

          2271edb4c2b0ae287a1850de66569341eed105e8e49acec8c8512132dfa7cb74cbd8cc39fc1d54eda092c2bbcacc7f40e1214e8d6f42abbbfe2a11c190beba0a

        • \Users\Admin\AppData\Local\Temp\.CR.19620\MICROSOFT.WINDOWS.SHELL.DLL

          Filesize

          162KB

          MD5

          fc28af3ae489397c01dfefa207d7eb04

          SHA1

          071de4a61de6e49fe4a4e9a974feffda0e371324

          SHA256

          a8d4bb9664c12a00e389638aa0351ee14fc3d373812dc2da07df39635179d984

          SHA512

          8f0fe83ff35eb60911786d64a2e3cde93d15f8596042912e5a0571cb51c4b4e621fc10af04df3c3ece9db421b106dfe835117b21b33096ca8e28038bdd063329

        • \Users\Admin\AppData\Local\Temp\.CR.19620\PRODUCTLABEL.COMMON.DLL

          Filesize

          180KB

          MD5

          86272e56e4749850707c3fb7c267e5ce

          SHA1

          25ed4b5e6a33722250c6698319ab12ec5ac1f6a1

          SHA256

          b28bd1a97a5b6da7fca999c25429975759d41db4725082337302a4de4c233ad9

          SHA512

          e6b36be5c81b4d22696565e3315dffb5386cb7d26f41084dc2f820bbcd6e036b470ce288529e78b0076364437148c5c5c42dba548a9901f02754aa6e77cc490a

        • \Users\Admin\AppData\Local\Temp\.CR.19620\PRODUCTLABEL.DLL

          Filesize

          301KB

          MD5

          0bc5514ed84904412e594305f34b3ec1

          SHA1

          c70a893441363b13866def2a06670bead74f25d3

          SHA256

          b86a57a8c2bca3f0e617fc47a5aed5e0e4444cfa7614f44ed9dd4401d15a381b

          SHA512

          a9cb019bf6ebb68a4843b47b13872d8ffcda615334308f6d56431c3eace184ef8f945f1e3a66ac9afde2c88da1f570a0d1eb70d56a9b1bf3086eb2186610e464

        • memory/2552-30-0x0000000000A60000-0x0000000000A90000-memory.dmp

          Filesize

          192KB

        • memory/2552-11-0x0000000000200000-0x0000000000270000-memory.dmp

          Filesize

          448KB

        • memory/2552-27-0x0000000004CD0000-0x0000000004D10000-memory.dmp

          Filesize

          256KB

        • memory/2552-23-0x0000000000710000-0x0000000000726000-memory.dmp

          Filesize

          88KB

        • memory/2552-33-0x0000000000A60000-0x0000000000A90000-memory.dmp

          Filesize

          192KB

        • memory/2552-17-0x00000000042F0000-0x0000000004354000-memory.dmp

          Filesize

          400KB

        • memory/2552-36-0x00000000048C0000-0x000000000490E000-memory.dmp

          Filesize

          312KB

        • memory/2552-20-0x00000000043C0000-0x000000000441C000-memory.dmp

          Filesize

          368KB

        • memory/2552-41-0x0000000004A20000-0x0000000004A4C000-memory.dmp

          Filesize

          176KB

        • memory/2552-44-0x0000000004A50000-0x0000000004A86000-memory.dmp

          Filesize

          216KB

        • memory/2552-14-0x0000000000350000-0x000000000037C000-memory.dmp

          Filesize

          176KB

        • memory/2552-26-0x0000000000790000-0x000000000079C000-memory.dmp

          Filesize

          48KB

        • memory/2552-47-0x0000000004360000-0x0000000004374000-memory.dmp

          Filesize

          80KB

        • memory/2552-8-0x0000000074590000-0x0000000074C7E000-memory.dmp

          Filesize

          6.9MB

        • memory/2552-50-0x0000000004870000-0x000000000487A000-memory.dmp

          Filesize

          40KB

        • memory/2552-7-0x00000000003D0000-0x000000000055A000-memory.dmp

          Filesize

          1.5MB

        • memory/2552-53-0x0000000004AA0000-0x0000000004AA8000-memory.dmp

          Filesize

          32KB

        • memory/2552-54-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

          Filesize

          40KB

        • memory/2552-55-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

          Filesize

          40KB

        • memory/2552-56-0x0000000004CD0000-0x0000000004D10000-memory.dmp

          Filesize

          256KB

        • memory/2552-57-0x0000000004CD0000-0x0000000004D10000-memory.dmp

          Filesize

          256KB

        • memory/2552-58-0x0000000074590000-0x0000000074C7E000-memory.dmp

          Filesize

          6.9MB

        • memory/2552-59-0x0000000004CD0000-0x0000000004D10000-memory.dmp

          Filesize

          256KB

        • memory/2552-60-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

          Filesize

          40KB