Overview

overview

10

Static

static

3

Expensive 3.1.exe

windows10-1703-x64

10

Expensive 3.1.exe

windows10-2004-x64

10

Expensive 3.1.exe

windows11-21h2-x64

10

Expensive 3.1.exe

android-10-x64

Expensive 3.1.exe

android-11-x64

Expensive 3.1.exe

android-13-x64

Expensive 3.1.exe

android-9-x86

Expensive 3.1.exe

macos-10.15-amd64

1

Expensive 3.1.exe

debian-12-armhf

Expensive 3.1.exe

debian-12-mipsel

Expensive 3.1.exe

debian-9-armhf

Expensive 3.1.exe

debian-9-mips

Expensive 3.1.exe

debian-9-mipsel

Expensive 3.1.exe

ubuntu-18.04-amd64

Expensive 3.1.exe

ubuntu-20.04-amd64

Expensive 3.1.exe

ubuntu-22.04-amd64

Expensive 3.1.exe

ubuntu-24.04-amd64

Analysis

  • max time kernel
    134s
  • max time network
    137s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/07/2024, 14:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Expensive 3.1.exe

  • Size

    343KB

  • MD5

    349469d67bda79cbde42c69d22500043

  • SHA1

    39d538c92e482ceddde34b111b8ee66acc2f0384

  • SHA256

    76567d6429bea0f062e44f8fad032a4f73816a91d1c7420b1d252547ee98046a

  • SHA512

    8492d61db9d0828e20102dfa71ae4235baa213f808139053918b5a324858a2291d9d4eacf263273c44067fff2133f9248ed8eeaf9dbbb60d733e521d0a01a9bc

  • SSDEEP

    6144:+XqQgll2xU4Lt0gCie6VlWT8b93nwZWrkqKQXnYbTY2At:IourPVle8Y3At

Score
10/10
credential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 29 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Expensive 3.1.exe
    "C:\Users\Admin\AppData\Local\Temp\Expensive 3.1.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Discord" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:212
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Discord" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4576
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3156
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:220
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Oracle VirtualBox" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Project.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2060
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "Oracle VirtualBox" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdMicrosoft Project.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:916
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3336
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1808
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2400
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1680
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2856
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3756
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4948
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:608
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Autodesk AutoCAD" /tr "C:\Users\Admin\AppData\Roaming\xdwdMicrosoft SQL Server Management Studio.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:164
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "Discord" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3156
      • C:\Windows\system32\schtasks.exe
        schtASks /deLeTe /F /Tn "Discord"
        3⤵
          PID:5076
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /C taskkill /im explorer.exe /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:652
        • C:\Windows\system32\taskkill.exe
          taskkill /im explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4680
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "Oracle VirtualBox" & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3052
        • C:\Windows\system32\schtasks.exe
          schtASks /deLeTe /F /Tn "Oracle VirtualBox"
          3⤵
            PID:2832
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpFA2F.tmp.bat""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1516
          • C:\Windows\system32\timeout.exe
            timeout 5
            3⤵
            • Delays execution with timeout.exe
            PID:3308
          • C:\Windows\explorer.exe
            explorer.exe
            3⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3512
          • C:\Windows\system32\taskkill.exe
            taskkill /im xdwdMicrosoft SQL Server Management Studio.exe /f
            3⤵
            • Kills process with taskkill
            PID:4072
          • C:\Windows\system32\timeout.exe
            timeout 3
            3⤵
            • Delays execution with timeout.exe
            PID:1808
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4504
      • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:5108

      Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            3
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Event Triggered Execution

            1
            T1546

            AppInit DLLs

            1
            T1546.010

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            3
            T1547

            Active Setup

            1
            T1547.014

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Event Triggered Execution

            1
            T1546

            AppInit DLLs

            1
            T1546.010

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            4
            T1112

            Credential Access

            Credentials from Password Stores

            2
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Windows Credential Manager

            1
            T1555.004

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            4
            T1012

            System Information Discovery

            4
            T1082

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmpFA2F.tmp.bat
              Filesize

              292B

              MD5

              20ba2e08e27d0cdc75d90b0071c6feb8

              SHA1

              f48fe333e8b1e4727fcc6d5b4a0e9e380be760a5

              SHA256

              b45048c3906ab158feacab255842245014a6321865be2d55692e89d8ce6d517f

              SHA512

              4e51b563eec7dcc4a21aa86b95850ed025abb0174ac044754db71d6da02847b8278a643cb748040d7cd84eb2e410ac99678268f5271c8a48e8e9b2e22c570c72

              Download Submit

            • C:\Windows\xdwd.dll
              Filesize

              136KB

              MD5

              16e5a492c9c6ae34c59683be9c51fa31

              SHA1

              97031b41f5c56f371c28ae0d62a2df7d585adaba

              SHA256

              35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

              SHA512

              20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

              Download Submit

            • memory/3512-281-0x0000000002C40000-0x0000000002C41000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4504-71-0x00007FFB22B30000-0x00007FFB22B52000-memory.dmp

              Filesize

              136KB

              Download

            • memory/4704-19-0x00007FFB141D0000-0x00007FFB14BBC000-memory.dmp

              Filesize

              9.9MB

              Download

            • memory/4704-72-0x000000001C020000-0x000000001C096000-memory.dmp

              Filesize

              472KB

              Download

            • memory/4704-73-0x0000000001530000-0x000000000153C000-memory.dmp

              Filesize

              48KB

              Download

            • memory/4704-74-0x0000000002F80000-0x0000000002F9E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/4704-135-0x00007FFB141D3000-0x00007FFB141D4000-memory.dmp

              Filesize

              4KB

              Download

            • memory/4704-256-0x00007FFB141D0000-0x00007FFB14BBC000-memory.dmp

              Filesize

              9.9MB

              Download

            • memory/4704-0-0x0000000000CB0000-0x0000000000D0C000-memory.dmp

              Filesize

              368KB

              Download

            • memory/4704-280-0x00007FFB141D0000-0x00007FFB14BBC000-memory.dmp

              Filesize

              9.9MB

              Download

            • memory/4704-1-0x00007FFB141D3000-0x00007FFB141D4000-memory.dmp

              Filesize

              4KB

              Download

            • memory/5108-285-0x0000014464C00000-0x0000014464D00000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/5108-283-0x0000014464C00000-0x0000014464D00000-memory.dmp

              Filesize

              1024KB

              Download

            • memory/5108-288-0x0000014465180000-0x00000144651A0000-memory.dmp

              Filesize

              128KB

              Download

            • memory/5108-309-0x0000014465300000-0x0000014465320000-memory.dmp

              Filesize

              128KB

              Download