Overview

overview

8

Static

static

7

8bb5de3966...0N.exe

windows7-x64

8

8bb5de3966...0N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-07-2024 07:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8bb5de396611f142f328ef2fa6990400N.exe

  • Size

    232KB

  • MD5

    8bb5de396611f142f328ef2fa6990400

  • SHA1

    4d2f9fe3cba1cab89f522a646a1591a7630186db

  • SHA256

    d084dcae942a3b6b27b8b85fc44b9c81334132ba6ea271d58ae45625e8b25f4f

  • SHA512

    cf7fd9a173914b0458e3c48560d88790e485717c56ff05df3912e6ec5bc1c421e6beef454e7b2f2badaa0297080da77f7ef9363cf4f5a5b4ddffbb1652cc7fd8

  • SSDEEP

    3072:2r+Fu+gOSmvuVQL9KpjbbNC8vM7Mh8nWmEw7/8kuuc+BxWhJ+UV05M1:RSm26UbbZvMgrmEs7eVMM1

Score
8/10
upx

Malware Config

Signatures

  • Drops file in Drivers directory 39 IoCs
  • Manipulates Digital Signatures 2 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 1 IoCs
  • Drops desktop.ini file(s) 57 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 25 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bb5de396611f142f328ef2fa6990400N.exe
    "C:\Users\Admin\AppData\Local\Temp\8bb5de396611f142f328ef2fa6990400N.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\System32\msiexec.exe" /i "C:\Windows\AE 0124 BE.msi"
      2⤵
      • Blocklisted process makes network request
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:212
    • C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      2⤵
      • Drops file in Drivers directory
      • Checks computer location settings
      • Executes dropped EXE
      • Drops autorun.inf file
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3224
      • C:\Windows\AE 0124 BE.exe
        "C:\Windows\AE 0124 BE.exe"
        3⤵
        • Drops file in Drivers directory
        • Manipulates Digital Signatures
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops desktop.ini file(s)
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\SysWOW64\drivers\winlogon.exe
          "C:\Windows\System32\drivers\winlogon.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:1108
      • C:\Windows\SysWOW64\drivers\winlogon.exe
        "C:\Windows\System32\drivers\winlogon.exe"
        3⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4612
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2432
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e62a39e.rbs
      Filesize

      8KB

      MD5

      20c50a3500e5949c0d3904498d12ff2e

      SHA1

      c9c54e6db97b0073aee86326d6e3f482035408f4

      SHA256

      46b10702793d0cd2b04fbc6cb8efe8c5c8daaea6ddfb61fbd00675cc77e3e8aa

      SHA512

      dd2603a0955b082f4d6424ebf0207653dad92a4ddfbe142a74e5fa2652aaf14508cb5ac293f1cd83ee10821089ed032dccb47dcffc9a11a3b86b1a1021771928

      Download Submit

    • C:\Windows\AE 0124 BE.msi
      Filesize

      232KB

      MD5

      81c0a159dea085a06e23a9a915a90cff

      SHA1

      709146f18808c65ed22585ff75d8403b212a0fef

      SHA256

      481b9932ef5d4de7e4c1c8b7524e34177f3008e620c5196012e5ed1689201bd9

      SHA512

      bf6698e6a3d46526e619dd21da3f36e4f1719d9343f7eeb2590888237362a60a16d23cc27c6bb2fd910d99bc2710bc2562d64308e84617334ec0aa972c276d54

      Download Submit

    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
      Filesize

      155KB

      MD5

      7a077dd91e544d4f0401ee3416a08624

      SHA1

      e8cb25defdfdc552758fda6d580f62a6e2f966ea

      SHA256

      8a56b34a933ba4729e99356c36d4294e4be17c286b3fe0eacbf5aca52babf73c

      SHA512

      f6986f53caac052cc8fea75f710847f1e82e5f8faa2eb1f8ec439812ae6b43b7dbf36152addd9d0229e5d339bf441701114790c2c809ac29d6f3d21537c0840e

      Download Submit

    • C:\Windows\Msvbvm60.dll
      Filesize

      1.4MB

      MD5

      25f62c02619174b35851b0e0455b3d94

      SHA1

      4e8ee85157f1769f6e3f61c0acbe59072209da71

      SHA256

      898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

      SHA512

      f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

      Download Submit

    • C:\Windows\SysWOW64\drivers\winlogon.exe
      Filesize

      48KB

      MD5

      a2651cf270a4bc62dddb4899b4905c2c

      SHA1

      9e8224927840274f75fedf18651297e1490ffa63

      SHA256

      923afcc3a47d6e5728391bfcc7105c1471cb0f2a31de5dd10e61e080e9ea4219

      SHA512

      255a12a7eb73fab5b9fbd202dcbe0a32494e81b5d0a089d2bc2d7354271fa0c5964b9b49dc3f5f82b1a31069c806b859c16a45654a88d361eddb97f63bbcf8ad

      Download Submit

    • C:\Windows\Temp\{3679A274-5F14-4E1E-BCFA-0172FB172A79}-MicrosoftEdgeUpdateSetup_X86_1.3.187.41.exe
      Filesize

      166KB

      MD5

      7f5222e6b9f2189b4fa7a39dcd8685e4

      SHA1

      7b0ab0f31fa4652c0acb22dc689e29bbe6f9d49e

      SHA256

      29b8cd0b8981fe5d8ef27f051bf07985e0fcb9c9099ecd603ae58a284e793804

      SHA512

      7c6e5c635f71fcf65e8d239aca6812f06bdf04ce4ac58612b59b08c7c67b743f23240c40fdc6f81fecc65f8eca21a7c3b24e76c5f6fdaadbf3c1f3ce7b16b9d8

      Download Submit

    • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
      Filesize

      23.7MB

      MD5

      fc7472215cf7e8bb52f3cc9eada69612

      SHA1

      38f6c7ffb3348815d2cec256a4d09eae61e25335

      SHA256

      750e93ae6c82e4b93d00d9b5ddc3574834e1b55ab48b65670c425969d7d3d76c

      SHA512

      475aca12c90ceedc61a5aa2eb0ccefbcd14ce40adc3d7de8c8594f843b26d7fd291f8f26120f4cde499bbd3b121d3ed2fbf7f1f8638c3292587f77b9263f089d

      Download Submit

    • \??\Volume{05030275-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{53711a5a-4de9-4363-802a-9d780ed58888}_OnDiskSnapshotProp
      Filesize

      6KB

      MD5

      b55b3a6b8e6ccdf794c762c2ac6ef7e8

      SHA1

      1ae9ab76b152ec6eb5e5902ce2a362b39d180bd1

      SHA256

      290a9cdeac608dea5ee0bc3873d6bd921e0c04f3d646316cc8d609d7bd6b0b2d

      SHA512

      04852ba795307664cdad87a9fac354457fa524f1cf833955b4adbb04d85074b10b3f1ba05d47dd96784d14231264b22f8788ef9636ca71d1d9e113793d09e04e

      Download Submit

    • \??\c:\B1uv3nth3x1.diz
      Filesize

      21B

      MD5

      9cceaa243c5d161e1ce41c7dad1903dd

      SHA1

      e3da72675df53fffa781d4377d1d62116eafb35b

      SHA256

      814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

      SHA512

      af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

      Download Submit

    • memory/1108-91-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1108-88-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2528-0-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2528-59-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2816-322-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3224-272-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/4612-85-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download