Overview

overview

8

Static

static

7

2bd22ad9b7...03.exe

windows7-x64

8

2bd22ad9b7...03.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 20:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2bd22ad9b740574dc0bc7dbe25b1a307e78db82b1b9dfaee1217eacce82a9b03.exe

  • Size

    608KB

  • MD5

    edd6c5d895f0e31271e0c2715ffd37c0

  • SHA1

    9194bc41a854f847213cd70b9d1e423b4f7ba738

  • SHA256

    2bd22ad9b740574dc0bc7dbe25b1a307e78db82b1b9dfaee1217eacce82a9b03

  • SHA512

    51fed922b30072dd5029185531103b89b4510dc949a38f308494dd1225e5b28df2547cf19e7d014f50ceed037116b5f9d6790ea6f7494f42181cff666e048e9b

  • SSDEEP

    6144:KVj/9nGx+cUgEcmI5qpYDb1MV+w1ILKcmSsP/vSJBl5nNWHR2Nvqld2CCBhW:6D9nGygEcmIopMbv1OcmSsPWBl5Fqui

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 39 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 1 IoCs
  • Drops desktop.ini file(s) 57 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bd22ad9b740574dc0bc7dbe25b1a307e78db82b1b9dfaee1217eacce82a9b03.exe
    "C:\Users\Admin\AppData\Local\Temp\2bd22ad9b740574dc0bc7dbe25b1a307e78db82b1b9dfaee1217eacce82a9b03.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:4668
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes dropped EXE
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2304
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1172
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4784
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4592
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\AE 0124 BE.msi
    Filesize

    608KB

    MD5

    300754b416af515d18fe4ae46662c768

    SHA1

    e4cf5a0e68693cf2ea54eb993f169256948a76d2

    SHA256

    1bacccc42d02f548cce6480c5c05e21240b9c11b2394cc239ac27c751edb0606

    SHA512

    5632ccb4b37177083e208494d88090dc9fc43a8241d0d5d5d7df43fcc7356dd76f66148e0df1e2c90fd816b312e2961945f60cdc3209fc4bf7005286cddd7ecd

    Download Submit

  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
    Filesize

    155KB

    MD5

    d5737f51a147de6b84ca4e7fd88a346f

    SHA1

    717407eef8a94dda373f5e2ef479776c392082ac

    SHA256

    932720c76a3acf3a28a698d7854152a985fb09db17089f3112d7e0b0e0678b4b

    SHA512

    3b3bfab5ecec1a679a7a554674a0b730b3a303217d0d7b65c282c6a02e7c8df2ae68b32c601e7304c35f10b9c2f150dfcf035675d8b20ed34b64d7ad7473038e

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.4MB

    MD5

    25f62c02619174b35851b0e0455b3d94

    SHA1

    4e8ee85157f1769f6e3f61c0acbe59072209da71

    SHA256

    898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

    SHA512

    f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

    Download Submit

  • C:\Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    312KB

    MD5

    57abd14e28ef1567ac71c6ddccd0fed0

    SHA1

    5262a625551026c82f655a935b92d7cac581ee32

    SHA256

    9ac5fcd79b0b9c8ee46b29a87da8c330a873206cfc5b011d504494f368fe3b77

    SHA512

    d1eb00a871b4facf7b7b2cd890cf79e31560a275734feb01e717d6bd32e4f042393613df46b26b8b1fddcee682aab43171db9e7d91651ab30110b5c52219edc0

    Download Submit

  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
    Filesize

    23.7MB

    MD5

    73aa9969bc61d343ead83e90dcab60b0

    SHA1

    b2e79b7024511b1a2af7a7ca9cdd1f8e317778e7

    SHA256

    b44c7915c9cc68774f52f1dca729a687ac2882f3a6a78beb4488a0a5667936ce

    SHA512

    4e36196e294b0b227e0437f770fda29d67a3912090437298478979038a6de5f8388e1ad03a9e907f822af294bb5441f76231fec29bde2db18e7c76f8a59b492d

    Download Submit

  • \??\Volume{03e1a52c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5f908c6f-e101-4109-b263-874f208a1495}_OnDiskSnapshotProp
    Filesize

    6KB

    MD5

    e1037490452fb9b22b038200ac22f38e

    SHA1

    d37cc554f31e70a670db381235c1e0d06ff34d26

    SHA256

    41293d7dced4adbacfe36ae4f40f43d6cc5c951bfd6cfe01d52d886de84bc6fc

    SHA512

    56c12fc0ee075163f6fefc196f67193b582e665fc2944b4ff15fd488a495379b3cfb1dc2c3865c085be85a99da9b1540a2ecf4e0bcf2110fb8e217212bc6d693

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • memory/1172-93-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1172-95-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2304-254-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2692-0-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2692-62-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2756-255-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2756-72-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2756-499-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4784-86-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

    Download