Overview

overview

7

Static

static

3

557685d97b...09.exe

windows7-x64

7

557685d97b...09.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    28-05-2024 09:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe

  • Size

    2.6MB

  • MD5

    4f5003234aa11c43794d7e39a37336ed

  • SHA1

    4fbe24cfd56e3e1524f7099e7d38c4688ab9601c

  • SHA256

    557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09

  • SHA512

    6b70e6a071597121b2fb72e258df71a63c6031e8032930376c075ff94bb66e5924f8751a2f198afaaf166061b49f36ee1d7be4a54b6adccb8438c103e3bb3e16

  • SSDEEP

    49152:3P9XOOTQyCR1e8HkA7pFomV4d4QN3uoxFit39/SZrPfLHkAZ0oI006q/HVFlQE+Y:17EzzzJp0+ojyFALE4hIP/HRXP7x

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 58 IoCs
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 56 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1188
      • C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe
        "C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2156
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:2196
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c C:\Users\Admin\AppData\Local\Temp\$$a20BA.bat
            3⤵
            • Deletes itself
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2880
            • C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe
              "C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:2484
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:2472
                • C:\Windows\SysWOW64\msiexec.exe
                  msiexec /i vcredist.msi
                  6⤵
                  • Enumerates connected drives
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:2324
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2480
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2548
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:2620
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:2380
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:2464
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Enumerates connected drives
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:880
            • C:\Windows\syswow64\MsiExec.exe
              C:\Windows\syswow64\MsiExec.exe -Embedding 5753FCFC27D0861547DC71C2D9E12700
              2⤵
              • Loads dropped DLL
              PID:2020
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2580
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000055C" "000000000000005C"
            1⤵
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:2276

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
            Filesize

            258KB

            MD5

            c8044983dfdd2ae565568eaf8a7a3a85

            SHA1

            8103582bcda05051a35d239706a9bb596dd2f2eb

            SHA256

            a59b6a0a09b11803a8d59e1cd32eb1231fb223051ca60176ad45e8ccc73120b6

            SHA512

            66c29dbadc33b096de40584d4b730120fa4a8f8810d0769b6bd8d7c6a2b56bfba04e76c3d07815becdd9a4543a5119c89da39b9c8da6c5fb74c0fc53f7036272

            Download Submit

          • C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe
            Filesize

            478KB

            MD5

            5264aab343fc1f53c29d1065346d0010

            SHA1

            db43bc0b28b4ada0c5635db50fd0b64410ab76ad

            SHA256

            d33d56847b353c8207a43aa01cc75527328ebf4bba669e90e29266d1b6fb57dd

            SHA512

            bb4ba1f7c5cae56cef564dd99f1a1fd3e2c656f8004f689a22ea641d886cbb3a19dde3dce5be4cf8cee4ce190170fd8c5390cb9c7c40ae54109559685119a958

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\$$a20BA.bat
            Filesize

            722B

            MD5

            cf9ddfb4314bc72fbfc520ddd728245e

            SHA1

            a6e52688430d3c6c66c0332f7e23397f97dd0e33

            SHA256

            61dbdcd38c24fc63fc22d944f7d595f7ce68cadb91ea8e29060e94026a869daf

            SHA512

            c8efba5d567c961ff8188411046e2e8a8e77a2d8da4dc5804d67281b2a1dab512d6f143037266f787899e4971029284f602ad8ae8095107046f8536b51a99493

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe.exe
            Filesize

            2.6MB

            MD5

            5c82be7ad1775b67916ee19c15b99331

            SHA1

            7dfa98be78249921dd0eedb9a3dd809e7d215c8d

            SHA256

            eb00f891919d4f894ab725b158459db8834470c382dc60cd3c3ee2c6de6da92c

            SHA512

            2c505476c81ad32a4904d57d9214bbaa805891c261e010b08055896dca32cfd426f4d13d14a96022fda9a5d8ecd638d65bc37baefed216a2517f07e9acb6939d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab
            Filesize

            247KB

            MD5

            aa85aa3738acfe30e197d9dfd5c3428d

            SHA1

            7f3ee53bd967265afe32b31d75b4f6c47363654a

            SHA256

            af3560ef0c55c7e4eff2170c63e7860498b5830e405a3841f96c91601e62e108

            SHA512

            e1bf248d6425f6ba91bf0a1f3d364321b09477af9be2f31f8bf6d92defbaddfbab8f3e6284262742378f1f87d60d06eee3b98fb081e60f9fb6f19c1797489861

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi
            Filesize

            2.7MB

            MD5

            dc1ab7ce3b89fc7cac369d8b246cdafe

            SHA1

            c9a2d5a312f770189c4b65cb500905e4773c14ad

            SHA256

            dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560

            SHA512

            e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe

            Download Submit

          • C:\Windows\Installer\MSI5D6C.tmp
            Filesize

            28KB

            MD5

            85221b3bcba8dbe4b4a46581aa49f760

            SHA1

            746645c92594bfc739f77812d67cfd85f4b92474

            SHA256

            f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

            SHA512

            060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

            Download Submit

          • C:\Windows\Logo1_.exe
            Filesize

            33KB

            MD5

            e5145dca6e4283892e5857b806110dc4

            SHA1

            a2294df922b27e925e0096f251eb216969f25f2a

            SHA256

            a900f9cfa3fe1e8f781b51a05f514ca3978b9cbd28df123140ccc1731411e042

            SHA512

            c8a29c48476475cb8b4ab183153c5bc38edbfc2724c1569db772d271e6cb576bd88ee6be798213761088de98fc2c7d0de0a7f5d94a892cbe83a62756029cb193

            Download Submit

          • F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\_desktop.ini
            Filesize

            9B

            MD5

            e850d9ceb7ebcc619d731dc2f1377b2b

            SHA1

            a45553c9057075c02e28f90d5e8ea57a0dddbacc

            SHA256

            b682a6e85069777ca22f84b99607acd09640eaa80029d74363c0a5aabddead4c

            SHA512

            be92bd8393d0fe69559ec55e1068fcd77ccc699361a9cb98d467bd51a029c371852b7a1196ad53fa8865e956582e6a4d35f6ac6fea3832058b7a427133b0048c

            Download Submit

          • \Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
            Filesize

            2.6MB

            MD5

            1f8e9fec647700b21d45e6cda97c39b7

            SHA1

            037288ee51553f84498ae4873c357d367d1a3667

            SHA256

            9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161

            SHA512

            42f6ca3456951f3e85024444e513f424add6eda9f4807bf84c91dc8ccb623be6a8e83dc40a8b6a1bc2c6fd080f2c51b719ead1422e9d1c1079795ec70953a1ad

            Download Submit

          • memory/1188-29-0x0000000002E50000-0x0000000002E51000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1764-0-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

            Download

          • memory/1764-17-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

            Download

          • memory/2480-47-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

            Download

          • memory/2480-3087-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

            Download

          • memory/2480-19-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

            Download

          • memory/2480-4252-0x0000000000400000-0x0000000000440000-memory.dmp

            Filesize

            256KB

            Download