Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    147s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01-07-2024 18:03

General

  • Target

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe

  • Size

    669KB

  • MD5

    ead18f3a909685922d7213714ea9a183

  • SHA1

    1270bd7fd62acc00447b30f066bb23f4745869bf

  • SHA256

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

  • SHA512

    6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

  • SSDEEP

    6144:bLUHLyHlwFjxDi2nEZkQ4NXxp0XMgkBWPqdN/jGdfYY7SRA7j4YlvfYAAjJ:4uFi02nEZh4jp0XLuxGdgTm73vL

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\9be88c2b-9aaf-42fc-955a-d7a56ed4ba73" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:3040
    • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
      "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --ForNetRes "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1 IsNotAutoStart IsNotTask
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
          "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2536 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1744
      • C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
        "C:\Users\Admin\AppData\Local\Temp\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe" --Service 2608 "FsnDCf1u1wJvLcqbFxxtOchBf2V2lgtk24oM5mt2" 0h7mFQcjRC3pDgsRcrWZ7K7bdAgvgDos224DmXt1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
    Filesize

    1KB

    MD5

    2365869258df7a66a2121b802ca4afd9

    SHA1

    73acc30a2edeb9d6830de559bb8a74f35168135d

    SHA256

    d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed

    SHA512

    795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
    Filesize

    436B

    MD5

    1bfe0a81db078ea084ff82fe545176fe

    SHA1

    50b116f578bd272922fa8eae94f7b02fd3b88384

    SHA256

    5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

    SHA512

    37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
    Filesize

    174B

    MD5

    1b6d9b63308a497a87389b51a3938ef7

    SHA1

    55eb39965cb3d405427c85a28c785a30bde0c80b

    SHA256

    bef045fa6e27c7c1e700bba44f0191efe9b97a292fafa8dcd3fc02e69dea1dc3

    SHA512

    a7026a2ecee46430539dd8e99a98f9213805faeb68dc8e11847854a6e6473977c7916ba33a7f472086648f3db09461abd41b5c8f1e74ecdccd71860ac77a8616

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    eca54a70a14b8d68b6ed29a1005012d6

    SHA1

    eebeb894ffdcfde2ca255582ac5faa6f8c55d81a

    SHA256

    f5d581beb412df4afdde6ee5d5505894bce453b16954fa218fe8967363835684

    SHA512

    7c85dc770b23928dddd42e73a570838bfa0f738f6422a7278427427baeb1f66a475720218bd036177169b23cffda1d8a3e16bf5808530ad9ddd961a8a0d9f863

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
    Filesize

    170B

    MD5

    6f9add997d48421eeb132eda9693be5d

    SHA1

    9d63233a7ec0afa4a69ea5c35ae6abaf06692df5

    SHA256

    ceff40872193fac73fb5d2af8ddf34fa8b30a0c91d525e059037f979d2f75299

    SHA512

    c31944f2e13b1f60797d843b98b25227dae2b74091e5890991c537176efaa460b4fc3749930eb5ed512aefacb6d1abe9e9292bae727943ebc9ec55f9c03d7a90

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    1fa4191e92d075389021880bbacd80d8

    SHA1

    2f38a9a34d4aa0a1047638c5513fa6fc7b4116fd

    SHA256

    adbc48aed31b533d86a9b862562f338afaac4d9ca5a67315b89e4283a6f5437c

    SHA512

    9c114875a312f9f3612f44c345ec426c0535695191006bd36848be9589022e3529808a2949c5571914427dc8ab4ec27662812234f46a573ccc4787fda40469b8

  • C:\Users\Admin\AppData\Local\9be88c2b-9aaf-42fc-955a-d7a56ed4ba73\5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
    Filesize

    669KB

    MD5

    ead18f3a909685922d7213714ea9a183

    SHA1

    1270bd7fd62acc00447b30f066bb23f4745869bf

    SHA256

    5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18

    SHA512

    6e532d9c3d186e4dac38823ae9152056346e283613f0caf088b21a1b3e5f4f6cf3bad8c407168b1072895a386e3be0b8c11ad1cb326d3d3ff0eb8562052def91

  • C:\Users\Admin\AppData\Local\Temp\Tar3BD9.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1680-68-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/1680-97-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/1744-85-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/1744-94-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2216-44-0x00000000002D0000-0x00000000003D0000-memory.dmp
    Filesize

    1024KB

  • memory/2216-39-0x0000000003D50000-0x0000000003DF9000-memory.dmp
    Filesize

    676KB

  • memory/2216-42-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2216-2-0x00000000002D0000-0x00000000003D0000-memory.dmp
    Filesize

    1024KB

  • memory/2216-0-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2216-3-0x0000000000400000-0x0000000000476000-memory.dmp
    Filesize

    472KB

  • memory/2216-41-0x0000000003D50000-0x0000000003DF9000-memory.dmp
    Filesize

    676KB

  • memory/2216-45-0x0000000000400000-0x0000000000476000-memory.dmp
    Filesize

    472KB

  • memory/2536-66-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2536-95-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2608-64-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2608-67-0x00000000028E0000-0x0000000002989000-memory.dmp
    Filesize

    676KB

  • memory/2608-65-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2608-47-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2608-63-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB

  • memory/2608-43-0x0000000000400000-0x00000000004A9000-memory.dmp
    Filesize

    676KB