Overview

overview

8

Static

static

7

8bb5de3966...0N.exe

windows7-x64

8

8bb5de3966...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    73s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21-07-2024 07:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8bb5de396611f142f328ef2fa6990400N.exe

  • Size

    232KB

  • MD5

    8bb5de396611f142f328ef2fa6990400

  • SHA1

    4d2f9fe3cba1cab89f522a646a1591a7630186db

  • SHA256

    d084dcae942a3b6b27b8b85fc44b9c81334132ba6ea271d58ae45625e8b25f4f

  • SHA512

    cf7fd9a173914b0458e3c48560d88790e485717c56ff05df3912e6ec5bc1c421e6beef454e7b2f2badaa0297080da77f7ef9363cf4f5a5b4ddffbb1652cc7fd8

  • SSDEEP

    3072:2r+Fu+gOSmvuVQL9KpjbbNC8vM7Mh8nWmEw7/8kuuc+BxWhJ+UV05M1:RSm26UbbZvMgrmEs7eVMM1

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 60 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 2 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 26 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 27 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bb5de396611f142f328ef2fa6990400N.exe
    "C:\Users\Admin\AppData\Local\Temp\8bb5de396611f142f328ef2fa6990400N.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2824
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops autorun.inf file
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3000
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3028
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1744
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:612
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000038C" "00000000000005A0"
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1332

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f7697fd.rbs
    Filesize

    7KB

    MD5

    0945df3280d2edfd8d8e63badf0ff985

    SHA1

    b3537963c5d4bc28694abc031fb4f8d9f73ab933

    SHA256

    92cf290c3d5ea4d33fbfcaa9ae511f7b93052731f0b81df9a9343ce0bb16de01

    SHA512

    a78a4badb88c0f693400d08410a4a78c62affa1dfbc43260b83c4baa1ba4186dff832404ee8d046f09ceb8e253c4543d02523b1021e8f570ac6429631a9089f3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    034b6351253f7c9194c04567fe701bec

    SHA1

    db5cb348159159196f8c665f3f06a6bf944667b1

    SHA256

    db333927c49d4a480d01688aa118510d157bdaa9f1d140da987b48f18355567c

    SHA512

    4ba885d960cdedbad50104989c20fa55fe74098c5ec1124dd0697b60fd57049365ee46681e95c43ab3f4d6d7a9937a7d3170abc010de667702f884d6d93ccd99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab6AC6.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar6AD9.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Windows\AE 0124 BE.msi
    Filesize

    232KB

    MD5

    81c0a159dea085a06e23a9a915a90cff

    SHA1

    709146f18808c65ed22585ff75d8403b212a0fef

    SHA256

    481b9932ef5d4de7e4c1c8b7524e34177f3008e620c5196012e5ed1689201bd9

    SHA512

    bf6698e6a3d46526e619dd21da3f36e4f1719d9343f7eeb2590888237362a60a16d23cc27c6bb2fd910d99bc2710bc2562d64308e84617334ec0aa972c276d54

    Download Submit

  • C:\Windows\Msvbvm60.dll
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • \??\c:\B1uv3nth3x1.diz
    Filesize

    21B

    MD5

    9cceaa243c5d161e1ce41c7dad1903dd

    SHA1

    e3da72675df53fffa781d4377d1d62116eafb35b

    SHA256

    814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

    SHA512

    af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

    Download Submit

  • \Windows\SysWOW64\drivers\winlogon.exe
    Filesize

    48KB

    MD5

    a2651cf270a4bc62dddb4899b4905c2c

    SHA1

    9e8224927840274f75fedf18651297e1490ffa63

    SHA256

    923afcc3a47d6e5728391bfcc7105c1471cb0f2a31de5dd10e61e080e9ea4219

    SHA512

    255a12a7eb73fab5b9fbd202dcbe0a32494e81b5d0a089d2bc2d7354271fa0c5964b9b49dc3f5f82b1a31069c806b859c16a45654a88d361eddb97f63bbcf8ad

    Download Submit

  • memory/2260-626-0x0000000001BD0000-0x0000000001BDB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-95-0x0000000003520000-0x000000000352B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-76-0x0000000001BD0000-0x0000000001BDB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-75-0x0000000001BD0000-0x0000000001BDB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-630-0x0000000003520000-0x000000000352B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-58-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-624-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-625-0x0000000001BD0000-0x0000000001BDB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-94-0x0000000003520000-0x000000000352B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2260-629-0x0000000003520000-0x000000000352B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2268-627-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2268-308-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2268-649-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2268-650-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2268-96-0x0000000003740000-0x000000000374B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2796-80-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2796-13-0x00000000038E0000-0x0000000003CEB000-memory.dmp

    Filesize

    4.0MB

    Download

  • memory/2796-45-0x0000000003830000-0x000000000383B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2796-57-0x0000000003830000-0x000000000383B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2796-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/3000-104-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download

  • memory/3028-105-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

    Download