Overview

overview

8

Static

static

7

1341312bfb...0N.exe

windows7-x64

8

1341312bfb...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 11:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1341312bfb3c34ef6e32177a2cc55c70N.exe

  • Size

    276KB

  • MD5

    1341312bfb3c34ef6e32177a2cc55c70

  • SHA1

    18c8ca4d187cfa1c6b903767ea17e62975942266

  • SHA256

    71dd258ceb35ca8e3cfc692f294c8971a92c35fae0098cf3342d511448b2044a

  • SHA512

    7386b373102f43facf1e4c571f0657e5461fc3825c1081437a35392b8d310867c7522dc5c781a76abe790760ebab964a2a47bc3a9169dc2255604bc957076704

  • SSDEEP

    3072:PiVj/n1Y4p4gMRIO8uwBKEQ+cULflQnL5lV+N6uDiNt0Uy6wg4uh1o7l:KVj/9nGx+cUgust0QSSo7l

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 60 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 2 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1341312bfb3c34ef6e32177a2cc55c70N.exe
    "C:\Users\Admin\AppData\Local\Temp\1341312bfb3c34ef6e32177a2cc55c70N.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2692
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops autorun.inf file
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:2408
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1448
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1004
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:732
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000558" "0000000000000320"
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9bb42a0fe87814aa7b8f7a2fa029f514

    SHA1

    a59ef5c29c74cf0d12716cb3fd44bab4f12a40d7

    SHA256

    d600e3798f02a131393f020b3c3e8fec51d3a2bc872599e7c5970ec433455617

    SHA512

    6d12d48cda257a981dc084de42fe65fb8fb03601751c2f87780e37bf00000b75b3176a2690433d5482a235752e3d95085c129eec6b1199280fb237dfbb849fc7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabD857.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarD86A.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\AE 0124 BE.msi
    Filesize

    276KB

    MD5

    3ae31e2e4ac9828e2cbf4a34be6e287c

    SHA1

    0f922ef93743eb0bb9d85e49f66beeee5816a0eb

    SHA256

    e30ea11a857dfb07bcd65d9480b837ec9e194318b515aba7b19b94e12dcffcc0

    SHA512

    15fa607215aa77a7e5a0e9e2ce1a916eaee443352b6408fd16371733742727e035c33d2fd2463b0d1f3d698644a92f23969c4c89e260b5347e84ffb972bcc270

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • \Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    312KB

    MD5

    ebae75c9c80e9fcf9c7db14d0fd38a06

    SHA1

    1de444dc0a8cb50183ca5087d3be4cc7ab5b17bc

    SHA256

    223406bbd32afe4ff161d3987d704d27ee5ea0fcf3e7fe6d15abd32659674640

    SHA512

    4007b2b74de7d12fbc050ce1d9921a4655e7a17d505cd494a9414dcc7134e574f9afbe7364c9f7cdb65d8671ec9a194be5fa47371995585cb32bec6b00776a15

    Download Submit

  • memory/652-578-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/652-571-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/652-579-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/652-175-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/652-174-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/652-86-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1448-158-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2408-157-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2972-84-0x00000000005C0000-0x00000000005CA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2972-181-0x0000000003750000-0x000000000375A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2972-61-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2972-85-0x00000000005C0000-0x00000000005CA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2972-120-0x0000000003750000-0x000000000375A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2972-173-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2972-180-0x0000000003750000-0x000000000375A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2972-176-0x00000000005C0000-0x00000000005CA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3056-77-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3056-59-0x0000000003C10000-0x0000000003C1A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3056-60-0x0000000003C10000-0x0000000003C1A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3056-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3056-35-0x0000000003510000-0x0000000003525000-memory.dmp

    Filesize

    84KB

    Download

  • memory/3056-13-0x0000000003960000-0x0000000003BD8000-memory.dmp

    Filesize

    2.5MB

    Download