Overview

overview

10

Static

static

10

b81be1a34b...bc.exe

windows7-x64

10

b81be1a34b...bc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 03:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b81be1a34bffe8b5f17c91fec9894e3fde43e59012aa59bfce266f5c0b042bbc.exe
  • Size 457KB
  • Sample240614-dp8ceaxapj
  • SHA256 b81be1a34bffe8b5f17c91fec9894e3fde43e59012aa59bfce266f5c0b042bbc
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Detects executables built or packed with MPress PE compressor 28 IoCs
  • UPX dump on OEP (original entry point) 28 IoCs
  • Disables use of System Restore points 1 TTPs
    evasion
  • Sets file execution options in registry 2 TTPs 6 IoCs
    persistence
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 42 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b81be1a34bffe8b5f17c91fec9894e3fde43e59012aa59bfce266f5c0b042bbc.exe
    "C:\Users\Admin\AppData\Local\Temp\b81be1a34bffe8b5f17c91fec9894e3fde43e59012aa59bfce266f5c0b042bbc.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:212
    • C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
      "C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:3588
    • C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
      "C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:1720
    • C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
      "C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Sets file execution options in registry
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1196
    • C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
      "C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of SetWindowsHookEx
      PID:4220
    • C:\Windows\lsass.exe
      "C:\Windows\lsass.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3496
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
    1⤵
      PID:3652

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          3
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          3
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Winlogon Helper DLL

          1
          T1547.004

          Event Triggered Execution

          1
          T1546

          Change Default File Association

          1
          T1546.001

          Defense Evasion

          Hide Artifacts

          2
          T1564

          Hidden Files and Directories

          2
          T1564.001

          Modify Registry

          6
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          1
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          CHQ3L4K.exe
          • Path C:\Windows\CHQ3L4K.exe
          • Size 457KB
          • SHA256 a7cc7eab5835899bda402600ff7be32c2bdb2d1453b3e4f6f2a7fed8cd96bb97
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          CHQ3L4K.exe
          • Path C:\Windows\CHQ3L4K.exe
          • Size 457KB
          • SHA256 a63228eeb31442ba90e84f71e05b06363e84255fbd5b9c54ca57b63039543d80
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ETC8M6S.exe
          • Path C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\ETC8M6S.exe
          • Size 457KB
          • SHA256 0c5cf0b6ac10d805618bf1ce263bbd24b0a114575b4c32fde167d519029498a0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          regedit.cmd
          • Path C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd
          • Size 457KB
          • SHA256 b81be1a34bffe8b5f17c91fec9894e3fde43e59012aa59bfce266f5c0b042bbc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          service.exe
          • Path C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
          • Size 457KB
          • SHA256 b4f31009a0ee98bfca9012d05545b5e0e108a9e6e22a556807bc25cc94874bcf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          smss.exe
          • Path C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
          • Size 457KB
          • SHA256 23ac33562d51aa8c25f5d2d8ad4b40fd1866c16876d605bffc938ce9f2d2b307
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          system.exe
          • Path C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
          • Size 457KB
          • SHA256 ff9c550d65f6fb5eb2697040eb4db288f1b62011bebf7661016798dd2d67e315
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          winlogon.exe
          • Path C:\Windows\RXG6H0S.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
          • Size 457KB
          • SHA256 8ae115733ab630a11e5131cf673a7a67649b0300360330e36d32a3c2aabb9d09
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          GXW5G1YCHQ3L4K.exe
          • Path C:\Windows\SysWOW64\GXW5G1YCHQ3L4K.exe
          • Size 457KB
          • SHA256 11b327828a9b7a6ce86f9367d6dc1b6a5cbf5c500d00a17b7e913be9778d63a6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MLO0U8H.exe
          • Path C:\Windows\SysWOW64\MLO0U8H.exe
          • Size 457KB
          • SHA256 dce99eb5412b83242156a723cca732319db0077c204cecd654b53f5fc843d997
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          GXW5G1Y.cmd
          • Path C:\Windows\SysWOW64\VNO0R1E\GXW5G1Y.cmd
          • Size 457KB
          • SHA256 ba85c78592328c7b535e07073710bfcfd78318465c73598a07008bfe61432730
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          GXW5G1Y.cmd
          • Path C:\Windows\SysWOW64\VNO0R1E\GXW5G1Y.cmd
          • Size 457KB
          • SHA256 cc9d21a24892196b03a263a231e1db6a2053317ecd6b0a29193b53ef0a4ca8d4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          systear.dll
          • Path C:\Windows\SysWOW64\systear.dll
          • Size 141B
          • SHA256 7775bdb528979f231c1e2cab575f81ec11ccfbe8e87798aa87b0de214d223bb3
          • MD5 SHA1 SHA512
          Submit Download

          UWJ0R2W.exe
          • Path C:\Windows\UWJ0R2W.exe
          • Size 457KB
          • SHA256 38c2bdd1b57b75b7cbd40565fa3829882a3ea9db4d4abc7411c77b1dd331c799
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          UWJ0R2W.exe
          • Path C:\Windows\UWJ0R2W.exe
          • Size 457KB
          • SHA256 a2e087d21883e77b7ca07c1288334f6cc5231390a353924e7a75820d5c9ba731
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cypreg.dll
          • Path C:\Windows\cypreg.dll
          • Size 361KB
          • SHA256 7abb33f7c8b31a0d47e0633d982be7bb3c3cf4182b6f9c44f20571117d919a96
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cypreg.dll
          • Path C:\Windows\cypreg.dll
          • Size 361KB
          • SHA256 6a4bf06e7d1c2ec235003c0a21c41fbd4505b0f60b419af144ee6a1c9a9a7610
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lsass.exe
          • Path C:\Windows\lsass.exe
          • Size 457KB
          • SHA256 4dde5a8385ae010361b95d1b6cbec27a3972b04b41cf6099d09afabc861095e0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lsass.exe
          • Path C:\Windows\lsass.exe
          • Size 457KB
          • SHA256 84810f119bc8728a8ffc48a48d1019ffd659c445c82e064db4695bae40b47259
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          moonlight.dll
          • Path C:\Windows\moonlight.dll
          • Size 65KB
          • SHA256 4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          onceinabluemoon.mid
          • Path C:\Windows\onceinabluemoon.mid
          • Size 8KB
          • SHA256 c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvbvm60.dll
          • Path C:\Windows\system\msvbvm60.dll
          • Size 1.4MB
          • SHA256 c91e9718a7ddf97a0a3006751af147415b1cc97e037d908d9d883b3942187a1a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvbvm60.dll
          • Path C:\Windows\system\msvbvm60.dll
          • Size 1.4MB
          • SHA256 86a9eb67eca6d722a633e967a25866b874560ba49a49d024e9584f3db5a1a14e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvbvm60.dll
          • Path C:\Windows\system\msvbvm60.dll
          • Size 1.4MB
          • SHA256 9cc8df5d085d4115090418d4e024e416545080611bd55d8d688a1e05293113e7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/212-258-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/212-0-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/1196-88-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/1196-313-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/1720-84-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/1720-312-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/3496-288-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/3496-315-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/3588-63-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/3588-311-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/4220-143-0x0000000000400000-0x0000000000478000-memory.dmp
          Download

          memory/4220-314-0x0000000000400000-0x0000000000478000-memory.dmp
          Download