Overview

overview

7

Static

static

3

557685d97b...09.exe

windows7-x64

7

557685d97b...09.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-05-2024 09:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe

  • Size

    2.6MB

  • MD5

    4f5003234aa11c43794d7e39a37336ed

  • SHA1

    4fbe24cfd56e3e1524f7099e7d38c4688ab9601c

  • SHA256

    557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09

  • SHA512

    6b70e6a071597121b2fb72e258df71a63c6031e8032930376c075ff94bb66e5924f8751a2f198afaaf166061b49f36ee1d7be4a54b6adccb8438c103e3bb3e16

  • SSDEEP

    49152:3P9XOOTQyCR1e8HkA7pFomV4d4QN3uoxFit39/SZrPfLHkAZ0oI006q/HVFlQE+Y:17EzzzJp0+ojyFALE4hIP/HRXP7x

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 61 IoCs
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 45 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3416
      • C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe
        "C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe"
        2⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2908
        • C:\Windows\SysWOW64\net.exe
          net stop "Kingsoft AntiVirus Service"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
            4⤵
              PID:4552
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF0.bat
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4724
            • C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe
              "C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe"
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:2672
              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:2888
                • C:\Windows\SysWOW64\msiexec.exe
                  msiexec /i vcredist.msi
                  6⤵
                  • Enumerates connected drives
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:3220
          • C:\Windows\Logo1_.exe
            C:\Windows\Logo1_.exe
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Enumerates connected drives
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4620
            • C:\Windows\SysWOW64\net.exe
              net stop "Kingsoft AntiVirus Service"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4032
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                5⤵
                  PID:4536
              • C:\Windows\SysWOW64\net.exe
                net stop "Kingsoft AntiVirus Service"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:3764
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                  5⤵
                    PID:4588
          • C:\Windows\system32\msiexec.exe
            C:\Windows\system32\msiexec.exe /V
            1⤵
            • Enumerates connected drives
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3480
            • C:\Windows\system32\srtasks.exe
              C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
              2⤵
                PID:2692
              • C:\Windows\syswow64\MsiExec.exe
                C:\Windows\syswow64\MsiExec.exe -Embedding 8D35B11D4B23F90F3D0C2D37262B3004
                2⤵
                • Loads dropped DLL
                PID:3832
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious use of AdjustPrivilegeToken
              PID:1204

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Config.Msi\e578cd2.rbs
              Filesize

              50KB

              MD5

              3b6f4f47cd6a39aff2a0331d67a69ea2

              SHA1

              a2541fd6e69fc94cba4884a69977e985b838a5b3

              SHA256

              f04872d6aaee2649ffa418920400fc3d66eb189123af27e2853f0d7ccaf738e4

              SHA512

              3d88203a2f0d7e6a1aa5ddf961f298f4035ac9af9a5db599b6643525358678948a4c6a39fad5251fbf52d785085c479e5c15bec50f4270d440bee39dc2bac38d

              Download Submit

            • C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe
              Filesize

              258KB

              MD5

              c8044983dfdd2ae565568eaf8a7a3a85

              SHA1

              8103582bcda05051a35d239706a9bb596dd2f2eb

              SHA256

              a59b6a0a09b11803a8d59e1cd32eb1231fb223051ca60176ad45e8ccc73120b6

              SHA512

              66c29dbadc33b096de40584d4b730120fa4a8f8810d0769b6bd8d7c6a2b56bfba04e76c3d07815becdd9a4543a5119c89da39b9c8da6c5fb74c0fc53f7036272

              Download Submit

            • C:\Program Files\7-Zip\7z.exe
              Filesize

              577KB

              MD5

              ea533dd10df79daa3267394bae89d90a

              SHA1

              590fb31da4499ea106cb0324e74dc1d7b327fccb

              SHA256

              f4dee6252568d6f080bf3dc64b1116d4715c2a9494ca21dad15ddf8a7210e7d8

              SHA512

              6859ad14a8c324d4003444c4741993e711be4200a7a92f2172713abe7955142cc7aef87472867ce635975717617c6ead4e7bf7cf837834b3f5e85eb0a9fb4fbb

              Download Submit

            • C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
              Filesize

              644KB

              MD5

              11e0853d537d2721ecc655c1fc527e91

              SHA1

              c8e23d103e93073ba7c93374878ae9a9f926c944

              SHA256

              f168cda7cfa0f4f1d8dc26f615772410afe41b43fbc3da3cfe2c249b1eadca30

              SHA512

              3e5af85789e480d355053e9ded02108ae53136aec795d5d37faf1d5426275f7f3729e5583b0a95b3434d5b4452c7382405c0f8bc94e8a65275335c62268e0ee2

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\$$a3BF0.bat
              Filesize

              722B

              MD5

              1306beabf6ffc723f77c37fb6fb1334a

              SHA1

              5d9f90f015e5c35481571960177e48f9290a9f23

              SHA256

              9a4faeb5c6c44be83f2d0da220bf9325f8b185e2c182801017505fa2f0dcff5b

              SHA512

              f99e25abae4fcc004572525a9aaf72862b822e700cd9bf27f1890cc239d83ea0f0ae864c1b90e54669f4066c92fb7f0b6b4b8a2c4fb0ae77d836aea4ab0fe63d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\557685d97b912572a910db8b0994a75c4882120cedf52ba9681c4485afb60a09.exe.exe
              Filesize

              2.6MB

              MD5

              5c82be7ad1775b67916ee19c15b99331

              SHA1

              7dfa98be78249921dd0eedb9a3dd809e7d215c8d

              SHA256

              eb00f891919d4f894ab725b158459db8834470c382dc60cd3c3ee2c6de6da92c

              SHA512

              2c505476c81ad32a4904d57d9214bbaa805891c261e010b08055896dca32cfd426f4d13d14a96022fda9a5d8ecd638d65bc37baefed216a2517f07e9acb6939d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\VCREDI~3.EXE
              Filesize

              2.6MB

              MD5

              1f8e9fec647700b21d45e6cda97c39b7

              SHA1

              037288ee51553f84498ae4873c357d367d1a3667

              SHA256

              9c110c0426f4e75f4384a527f0abe2232fe71f2968eb91278b16b200537d3161

              SHA512

              42f6ca3456951f3e85024444e513f424add6eda9f4807bf84c91dc8ccb623be6a8e83dc40a8b6a1bc2c6fd080f2c51b719ead1422e9d1c1079795ec70953a1ad

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cab
              Filesize

              247KB

              MD5

              aa85aa3738acfe30e197d9dfd5c3428d

              SHA1

              7f3ee53bd967265afe32b31d75b4f6c47363654a

              SHA256

              af3560ef0c55c7e4eff2170c63e7860498b5830e405a3841f96c91601e62e108

              SHA512

              e1bf248d6425f6ba91bf0a1f3d364321b09477af9be2f31f8bf6d92defbaddfbab8f3e6284262742378f1f87d60d06eee3b98fb081e60f9fb6f19c1797489861

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vcredist.msi
              Filesize

              2.7MB

              MD5

              dc1ab7ce3b89fc7cac369d8b246cdafe

              SHA1

              c9a2d5a312f770189c4b65cb500905e4773c14ad

              SHA256

              dde77dd3473d3d07c459f17cd267f96f19264f976f2fcc85b4bbbecf26487560

              SHA512

              e554b8b36a7a853d4e6efb4e6faf2d784f41e8d26edafbb1689a944bf0a7a4b58258d820a3fada1496b8c8d295d8771fc713b29127d54a3fbc317659b7565cbe

              Download Submit

            • C:\Windows\Installer\MSI8EE2.tmp
              Filesize

              28KB

              MD5

              85221b3bcba8dbe4b4a46581aa49f760

              SHA1

              746645c92594bfc739f77812d67cfd85f4b92474

              SHA256

              f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

              SHA512

              060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

              Download Submit

            • C:\Windows\Logo1_.exe
              Filesize

              33KB

              MD5

              e5145dca6e4283892e5857b806110dc4

              SHA1

              a2294df922b27e925e0096f251eb216969f25f2a

              SHA256

              a900f9cfa3fe1e8f781b51a05f514ca3978b9cbd28df123140ccc1731411e042

              SHA512

              c8a29c48476475cb8b4ab183153c5bc38edbfc2724c1569db772d271e6cb576bd88ee6be798213761088de98fc2c7d0de0a7f5d94a892cbe83a62756029cb193

              Download Submit

            • F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\_desktop.ini
              Filesize

              9B

              MD5

              e850d9ceb7ebcc619d731dc2f1377b2b

              SHA1

              a45553c9057075c02e28f90d5e8ea57a0dddbacc

              SHA256

              b682a6e85069777ca22f84b99607acd09640eaa80029d74363c0a5aabddead4c

              SHA512

              be92bd8393d0fe69559ec55e1068fcd77ccc699361a9cb98d467bd51a029c371852b7a1196ad53fa8865e956582e6a4d35f6ac6fea3832058b7a427133b0048c

              Download Submit

            • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
              Filesize

              23.7MB

              MD5

              0b702c76979d2b0aae2f41e48cb77858

              SHA1

              db14562ddac48f3fe1ccfb06b0c67b88a2e68303

              SHA256

              77b03f14755acbc476759309e9392418bbec75ff9443431184563ea6429b001e

              SHA512

              b0ce63f1646102cc19f591e1dea415e21c50773fd19f606a4b7b681b3cfe9f59fc07cf23250adbe683526a6b31e0c23b1c2480ec380875fa4b9d763434dd30be

              Download Submit

            • \??\Volume{b97f693d-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{d622e0d3-182b-46a2-b06f-2c233790ffaf}_OnDiskSnapshotProp
              Filesize

              6KB

              MD5

              e1394081d8feadcd0d1f1e39cda963ca

              SHA1

              4fcc8b2145d143c70f7d6b319657d07fc7b9d9c5

              SHA256

              c28760abe73f2bdada44b56e9fe177134b1595c71d3fd1f6cfa9cfd698c4309a

              SHA512

              ae2ac9062b97570c5a6efb415f081621a3b356ad2170f20d0f00d9239ea6059cfa805736de97163b69515540ff41aea615d6f93a813680393ad452cf01785c54

              Download Submit

            • memory/2908-0-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

              Download

            • memory/2908-10-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

              Download

            • memory/4620-27-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

              Download

            • memory/4620-4142-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

              Download

            • memory/4620-8816-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

              Download