Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 01:10

General

  • Target

    9dc78a7c0120787631185f55bbed144e82c19e8eb0c2a66e445ed40db2ee4d99.exe

  • Size

    292KB

  • MD5

    a273044943723ee8f98fc5212a5176b2

  • SHA1

    83840f7c21ba99a59cbad0c3a80cdf4fb2d5460b

  • SHA256

    9dc78a7c0120787631185f55bbed144e82c19e8eb0c2a66e445ed40db2ee4d99

  • SHA512

    e3b7f6fd0a1bd922d091dafce5fa73b55a85917aa18a0067b7dc4e89501de916029c35ed46677e4bf24012c97f5347e32c119721bf866ba947bdf4a95660112e

  • SSDEEP

    3072:2r+Fu6eC0VjywzvcXcSqviamCIngQMTqGMWH2EZjg1wmxNAntKHzvtCQj:E5vcXgvibeqGNWE9+7AnAHzvtB

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 9 IoCs
  • Drops file in Drivers directory 60 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 10 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Blocklisted process makes network request 4 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\9dc78a7c0120787631185f55bbed144e82c19e8eb0c2a66e445ed40db2ee4d99.exe
    "C:\Users\Admin\AppData\Local\Temp\9dc78a7c0120787631185f55bbed144e82c19e8eb0c2a66e445ed40db2ee4d99.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Loads dropped DLL
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2308
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops autorun.inf file
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1676
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2668
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:560
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1492
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000584" "00000000000005B0"
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2584

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE

          Filesize

          1KB

          MD5

          cba2426f2aafe31899569ace05e89796

          SHA1

          3bfb16faefd762b18f033cb2de6ceb77db9d2390

          SHA256

          a465febe8a024e3cdb548a3731b2ea60c7b2919e941a24b9a42890b2b039b85a

          SHA512

          395cce81a7966f02c49129586815b833c8acfe6efbb8795e56548f32819270c654074622b7fa880121ce7fbd29725af6f69f89b8c7e02c64d1bbffbfe0620c68

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956

          Filesize

          1KB

          MD5

          fc1193c6345ac35188aa3de0f824ceb7

          SHA1

          8fb5606f5380ac6ace7bb4e7c71b6750362e8c5f

          SHA256

          bdfb8faff4c0c0a15c642890a5544bd32f930f55ca199470dbd4736a32d6e200

          SHA512

          480a3ad52cf215db3cede6ad93293f8f031c2cb7a190c6f4cbcd0f3eb06f5c81c7f13d304a495945192e759ab5403245acef7be0149b8615ce2b194927f3dec4

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE

          Filesize

          264B

          MD5

          b8a58cd133572987e15e802c42d02f39

          SHA1

          074ac74fef858a7a7aa5d827e61772fcb704845a

          SHA256

          df018540d799eb444ea8d4067e916662f901ac5163af3cb0e3a6e1012987c7e7

          SHA512

          08fcc89ecacc1eccbbdffe7c1f1f1bc2be745bfb81b98a350d6525207c4c4611d3f5f390b20139e80fed8ca0a914c2786b2d6825c745779dac094a1c638f48be

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          35459eda750ee5ce6b9f99fc5b56f519

          SHA1

          999f0f37ff67c731c9fa1c7ef5df0cba57b370fa

          SHA256

          c2ac1469638581ae41b78f13d5dd6d508f471ac0ecacadc9302d85a120e48097

          SHA512

          afd0836f6a79b1f19d76b1a898f2ec673ee11820c592eaf06a84d8951f8cb9b8b26f22cb5bc50e278717926335da4529bb3fb6411385313ff8becca3ae36710f

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956

          Filesize

          252B

          MD5

          ba73765ee919ddd61052f416cab82eff

          SHA1

          c7f513591f11a4225a8a87ea4556c3ebf7beb4b8

          SHA256

          3a664179a435ead5165cbfa77acb3081619a0d3cc61a95dcdb6fe4beed7c68ad

          SHA512

          bc67614375414cde7cccf12f0c911d068b843d3e17beb28441420ded7b5060d6f48932f890b059a7765a3882b7d01b48f620eeb4015bc3a3b1c3517eb6acd94f

        • C:\Users\Admin\AppData\Local\Temp\Cab14DA.tmp

          Filesize

          65KB

          MD5

          ac05d27423a85adc1622c714f2cb6184

          SHA1

          b0fe2b1abddb97837ea0195be70ab2ff14d43198

          SHA256

          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

          SHA512

          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

        • C:\Users\Admin\AppData\Local\Temp\Tar14ED.tmp

          Filesize

          171KB

          MD5

          9c0c641c06238516f27941aa1166d427

          SHA1

          64cd549fb8cf014fcd9312aa7a5b023847b6c977

          SHA256

          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

          SHA512

          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

        • C:\Users\Admin\AppData\Local\Temp\Tar18AE.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • C:\Windows\AE 0124 BE.msi

          Filesize

          292KB

          MD5

          5509e489819927ce83d9cdb410aa17dc

          SHA1

          87dab44eb3da7d0b538593b1ca854712f41d6b8e

          SHA256

          2a033498341bf9e3db3df3f46cf183c6fb5a9d86313cefb39271bfdd8b7dd834

          SHA512

          d82198c6667522cbd3789ff7f723c5a0c708a161443692ba6f3662aae77a64ca7fbbe802a1690c555444d3e7a1e0bab9d75f1b0a139be7dd14e71c18d4a38c50

        • C:\Windows\Msvbvm60.dll

          Filesize

          1.3MB

          MD5

          5343a19c618bc515ceb1695586c6c137

          SHA1

          4dedae8cbde066f31c8e6b52c0baa3f8b1117742

          SHA256

          2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

          SHA512

          708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

        • \??\c:\B1uv3nth3x1.diz

          Filesize

          21B

          MD5

          9cceaa243c5d161e1ce41c7dad1903dd

          SHA1

          e3da72675df53fffa781d4377d1d62116eafb35b

          SHA256

          814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

          SHA512

          af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

        • \Windows\SysWOW64\drivers\winlogon.exe

          Filesize

          48KB

          MD5

          833e9f4555d6dd92739f161eab2516a3

          SHA1

          f946f93117471d4fff1350a8b024f03b46de4ccd

          SHA256

          786d08a766f02b62f6a5886238867b73e0bb5fe28cf0c0bf31ed9c820444dbeb

          SHA512

          618f0ba39f7e5b251fac5c135bdf182dfadbb086d63983ddbaf1726c02a19d562c5504bacf042dcd72a982257a2af958257b1ab9b82f7f19b41f094e0f84df0a

        • \Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll

          Filesize

          16KB

          MD5

          e1eeb7e26ab04075eecc7275239b20b3

          SHA1

          ba62b37d4233b88948fdc2ffed08f3c82e8627f1

          SHA256

          d6cdf961c6d2712fe1958815e51a30960d79fff1e97788b7741627dba972e8f7

          SHA512

          dd64909c983794c8ac6c33b74711a89b3b33e4429bb5a3a2a2b4e38f5d74902b1589a97014a35fbaf97b469fa57a11314c02d68e1db0934de5244308699fc262

        • memory/1676-119-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2224-53-0x0000000004680000-0x000000000468B000-memory.dmp

          Filesize

          44KB

        • memory/2224-13-0x0000000003AE0000-0x000000000459A000-memory.dmp

          Filesize

          10.7MB

        • memory/2224-116-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2224-0-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2224-52-0x0000000004680000-0x000000000468B000-memory.dmp

          Filesize

          44KB

        • memory/2340-546-0x00000000003E0000-0x00000000003EB000-memory.dmp

          Filesize

          44KB

        • memory/2340-75-0x0000000003490000-0x0000000003F4A000-memory.dmp

          Filesize

          10.7MB

        • memory/2340-547-0x00000000003E0000-0x00000000003EB000-memory.dmp

          Filesize

          44KB

        • memory/2340-67-0x00000000003E0000-0x00000000003EB000-memory.dmp

          Filesize

          44KB

        • memory/2340-69-0x00000000003E0000-0x00000000003EB000-memory.dmp

          Filesize

          44KB

        • memory/2340-536-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2536-102-0x0000000004540000-0x000000000454B000-memory.dmp

          Filesize

          44KB

        • memory/2536-376-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2536-76-0x0000000003300000-0x0000000003DBA000-memory.dmp

          Filesize

          10.7MB

        • memory/2536-103-0x0000000004540000-0x000000000454B000-memory.dmp

          Filesize

          44KB

        • memory/2536-71-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2536-548-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2536-550-0x0000000004540000-0x000000000454B000-memory.dmp

          Filesize

          44KB

        • memory/2536-569-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB

        • memory/2536-568-0x0000000072940000-0x0000000072A93000-memory.dmp

          Filesize

          1.3MB

        • memory/2668-142-0x0000000000400000-0x000000000040B000-memory.dmp

          Filesize

          44KB