Overview

overview

10

Static

static

7

fca100e9b3...71.exe

windows7-x64

10

fca100e9b3...71.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    17-08-2024 07:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fca100e9b3228812f182efa1ea35a55c0be2f7da9c9bc36453b7f4e8c7316e71.exe

  • Size

    91KB

  • MD5

    27b1c4297c47b270d68946b0160f27d6

  • SHA1

    c23f0b6239d8dc4a73455c9d46605c7525a1e200

  • SHA256

    fca100e9b3228812f182efa1ea35a55c0be2f7da9c9bc36453b7f4e8c7316e71

  • SHA512

    89f3c28bf5424843d79d68c798f662bff72eaee5c995fdf4e91c604c9ac7b9bc0e135c1f0787e6dcee7acb5e035a6ae8fb877d6891db49d96d1a76bacc510126

  • SSDEEP

    1536:XRsjdLaslqdBXvTUL0Hnouy8VjORsjdLaslqdBXvTUL0Hnouy8Vje:XOJKqsout9OOJKqsout9e

Score
10/10
discoveryevasionpersistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 18 IoCs
  • Modifies system executable filetype association 2 TTPs 13 IoCs
    persistence
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 20 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\fca100e9b3228812f182efa1ea35a55c0be2f7da9c9bc36453b7f4e8c7316e71.exe
    "C:\Users\Admin\AppData\Local\Temp\fca100e9b3228812f182efa1ea35a55c0be2f7da9c9bc36453b7f4e8c7316e71.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3004
    • C:\Windows\xk.exe
      C:\Windows\xk.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2624
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:3032
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1312
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2304
    • C:\Windows\xk.exe
      C:\Windows\xk.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1128
    • C:\Windows\SysWOW64\IExplorer.exe
      C:\Windows\system32\IExplorer.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2220
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:456
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2140
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1380
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1044
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1780
  • C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Modify Registry

6
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
    Filesize

    240KB

    MD5

    974a7903d04f7a00577170e69f0b5c3c

    SHA1

    2b9bea16151694cca9c8a09d8851b64d2b280d8c

    SHA256

    99fb7a9a2e33afd4bc1e9a39681cf6bd337cee8aa6d970388bbccd2fc3fa9983

    SHA512

    f146b548a3e2cca53c3311ea0d77b2b559a126b09f7862593252222cdaf4f410e0212a9c69816903e833f6f4a139385b8c3f8aaa0f1937c7e1fe827b6cd8b3c6

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT
    Filesize

    240KB

    MD5

    3ca92dbda52addc953ff07f264d13a25

    SHA1

    0504aa072ccfd7814c9f11bbee0d85b204fb423d

    SHA256

    de57f2f3f84501976012321d5ff2e2f46dbbe8513489b376329816100537c38c

    SHA512

    189ebdb9e84194a39e7c975db2374a2eb3db2c654d2b489d7f0b80a44c782c2ed9c7c7c15a42eef14178212634f8113796df20025041b4b6e3bc2946e780867c

    Download Submit

  • C:\Users\Admin\AppData\Local\winlogon.exe
    Filesize

    91KB

    MD5

    27b1c4297c47b270d68946b0160f27d6

    SHA1

    c23f0b6239d8dc4a73455c9d46605c7525a1e200

    SHA256

    fca100e9b3228812f182efa1ea35a55c0be2f7da9c9bc36453b7f4e8c7316e71

    SHA512

    89f3c28bf5424843d79d68c798f662bff72eaee5c995fdf4e91c604c9ac7b9bc0e135c1f0787e6dcee7acb5e035a6ae8fb877d6891db49d96d1a76bacc510126

    Download Submit

  • C:\Windows\xk.exe
    Filesize

    91KB

    MD5

    5b8a96f6d5b5cfb966943fec69e4911e

    SHA1

    badd9840f48f15f33f81dae0f080a6ec962b9bd4

    SHA256

    b08e104d97113179769cb344c9b8fd0906cebf61a2e5b149c7cbf76407acaf82

    SHA512

    c195176a8bac2e198475d3d2a943336fa48590f47df47ef28e07762acb04a885dfd04fb5c6b6d038282a50ecda2a17fba05f61109d1d8e36259df5d48677d001

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
    Filesize

    91KB

    MD5

    f89a5b02666b6bc00879ef94c18978ac

    SHA1

    d8105297492e0c50fb8eb00c2b97694f322da6dd

    SHA256

    7954d09a3bc00cf45df20fe380dea8ba0562a73327e34c01b70a9e504906ddb8

    SHA512

    b66cafee2cbd0d6ca27c81ffd0f87109bd1b444da1bd5a12dacf898d5d5c9dc6dc8fc712f7bf8f42febb03355d92102a91b2a376bf76230990731ffb5dd71b78

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
    Filesize

    91KB

    MD5

    4ba839310a8c87a4a5a5778e86d2e676

    SHA1

    7441036c250de1356ae57367cf3dfac1736a238d

    SHA256

    dd36a4e2cb0377660678c169b2622832962f1689b55d9d0573605b1577a4ef67

    SHA512

    514bde30539c16c1822ce18a8208d59218b60e3cea6b98fe36d9ade4b41d91694d25e186feea7ae87b7b4c467769442e715693a35b614b4a408fb0b571dc14f5

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
    Filesize

    91KB

    MD5

    5775e35e29266ed29fefc7a4c5b2b466

    SHA1

    50585ce311c39a4fbaeab651bea5038e9a2d8d65

    SHA256

    95a3d847dc5185dd31fe9217abeb654cb1b291403526cd01ee7799a85ad22760

    SHA512

    3714f470f099c02e25b73b9a4e093c4db61401840add6683309eee5a7870c7ba2c9a6118b8fe25c4d774d003f92599357768d093f488ba2d2fab1b7c92c30b89

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
    Filesize

    91KB

    MD5

    0e4bba0cc71d34a523910dc31a83c38a

    SHA1

    68095b3ac5dcebb4ff0ce8f7628aa37731215928

    SHA256

    a94b2a51e25ddc1ae1ca8b8d34e68319641fc095f118b3cd3f8aeb4d404cfdb5

    SHA512

    6a3ff5095d6da4ca576e8ece004f22b04e9faab6f07640ac4baa586effdad76dc45ff5905dc7c365f3a827e7255249af63ada7f925b326edd592eada320391cd

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    91KB

    MD5

    62c53b04bb4ece7156efef1f4db5c820

    SHA1

    8f39efd5d60c472c02eccb60a8859311015e325f

    SHA256

    eea4e67d360025f1793b96fb65de86b60a488c15bd39daaa72ad6ca49c9bfca8

    SHA512

    c94c13e43ba2ca34da51a4c7b5b7f8fc507483f0be7569ad006a87e1c4dede0526f16b8ec5342ab78752f9374586b04fe9ff0c9df68f91ab448a9179e982b736

    Download Submit

  • \Windows\SysWOW64\IExplorer.exe
    Filesize

    91KB

    MD5

    11b972170cb2e75875fd4b4168339a83

    SHA1

    4d76efda00a4acfd4076d3d6b6f54fe8f2ce1dbe

    SHA256

    bd25d55850e78945598d2214c24488f500867f70c01476311429380a42f2e479

    SHA512

    0ae9c5704787c98724d2b35b13e60ecf82836be888074687f88df0aca0e878ab97a7340099359d71a4989fff6b94f471bd9b673c4f63500f47e9a15123abc54c

    Download Submit

  • memory/456-226-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/456-222-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1044-258-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1044-264-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1128-199-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1128-210-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1312-137-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1380-255-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1780-274-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2140-239-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2220-216-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2304-173-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2624-116-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2684-299-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3004-424-0x0000000000790000-0x00000000007BF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-256-0x0000000000790000-0x00000000007BF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-257-0x0000000000790000-0x00000000007BF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-270-0x0000000000790000-0x00000000007BF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-194-0x0000000000790000-0x00000000007BF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-426-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-132-0x0000000000790000-0x00000000007BF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-110-0x0000000000790000-0x00000000007BF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-140-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-425-0x0000000000790000-0x00000000007BF000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3004-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/3032-125-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download