Overview

overview

10

Static

static

7

1534415939...87.exe

windows7-x64

1534415939...87.exe

windows10-2004-x64

Analysis

  • max time kernel
    98s
  • max time network
    99s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14-09-2024 09:32

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    153441593965f380c830ea303ab0ed5848e80e9b8a04b2d0a43c295cc49fbf87.exe

  • Size

    1.1MB

  • MD5

    fb684a3f9bbd6b74e432a7ce5fba272b

  • SHA1

    401906ba1767b901c4dfbeca1b786aceece5372a

  • SHA256

    153441593965f380c830ea303ab0ed5848e80e9b8a04b2d0a43c295cc49fbf87

  • SHA512

    2ba198fb88822d02b9586b847df42f82a58894c3a058bfc0de1b603da52470ec95cd8d37a34e8634bc225d0913891fec9bc498c49a314639768f10044b9192a2

  • SSDEEP

    24576:5j8B3KleK6hPJ06jLEVPeTUlDKqVoNkU2uGp7mDYqwQeQFAtVqK0rU:Nw3KLAPJrjQeADK6oNGuqCvkQitEY

Score
10/10
credential_accessdefense_evasiondiscoveryevasionpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Disables taskbar notifications via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 9 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 15 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies data under HKEY_USERS 10 IoCs
  • Modifies registry class 11 IoCs
  • NTFS ADS 1 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\153441593965f380c830ea303ab0ed5848e80e9b8a04b2d0a43c295cc49fbf87.exe
    "C:\Users\Admin\AppData\Local\Temp\153441593965f380c830ea303ab0ed5848e80e9b8a04b2d0a43c295cc49fbf87.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies data under HKEY_USERS
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2312
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c (echo interface set interface "WLAN" enabled && echo interface set interface "±¾µØÍøÂç" enabled && echo interface set interface "±¾µØÍøÂç 2" enabled && echo interface set interface "ÒÔÌ«Íø" enabled ) | netsh
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" ( echo interface set interface "WLAN" enabled && echo interface set interface "±¾µØÍøÂç" enabled && echo interface set interface "±¾µØÍøÂç 2" enabled && echo interface set interface "ÒÔÌ«Íø" enabled )"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2744
      • C:\Windows\SysWOW64\netsh.exe
        netsh
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2772
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c regedit /s C:\Users\Admin\AppData\Local\Temp\baidu.reg
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\regedit.exe
        regedit /s C:\Users\Admin\AppData\Local\Temp\baidu.reg
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Runs .reg file with regedit
        PID:2780
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c rd /s /q "%programfiles%\SysCeo";"%programfiles(x86)%\SysCeo"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2932
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del /s /q /f "%systemroot%\Help\dcold.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2720
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del /s /q /f "%userprofile%\Desktop\Çý¶¯×ܲÃ.lnk";"%homedrive%\Users\Public\Desktop\Çý¶¯×ܲÃ.lnk"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2600
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del /s /q /f "%homedrive%\ProgramData\Microsoft\Windows\Start Menu\Çý¶¯ÏÂÔØ.lnk"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1908
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c rd /s /q "%homedrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Çý¶¯×ܲÃ"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2684
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c rd /s /q "%homedrive%\ProgramData\Microsoft\Windows\Start Menu\Programs\Çý¶¯×ܲÃ2.0"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3064
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c regedit /s C:\Users\Admin\AppData\Local\Temp\Windows7_YH.REG
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Windows\SysWOW64\regedit.exe
        regedit /s C:\Users\Admin\AppData\Local\Temp\Windows7_YH.REG
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Runs .reg file with regedit
        PID:2796
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\AppData\Local\Temp\FXSAPIDebugLogFile.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2852
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\AppData\Local\Temp\~DF946307F7E1CDAD29.TMP
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2008
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\AppData\Local\Temp\PVfxMILgMS\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2128
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\AppData\Local\Temp\PVfxMILgMS\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3012
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\AppData\Local\Temp\PVfxMILgMS\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1356
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Upgrade 2345Explorer Task" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:3024
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "Upgrade 2345Explorer Task" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2036
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Execute 2345Pinyin MiniPage Task" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:1768
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "Execute 2345Pinyin MiniPage Task" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2536
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Pinyin_2345Upgrade Task" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:2300
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "Pinyin_2345Upgrade Task" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:976
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "KuGou Service Task Scheduler" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:1348
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "KuGou Service Task Scheduler" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:864
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "WpsUpdateTask_Administrator" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:1576
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "WpsUpdateTask_Administrator" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1892
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Pic_2345Upgrade Task" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:1772
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "Pic_2345Upgrade Task" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3020
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "360ZipUpdater" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:1752
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "360ZipUpdater" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2148
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "QQBrowser Updater Task" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:652
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "QQBrowser Updater Task" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1008
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "QQBrowser Updater Task(Core)" /f
      2⤵
      • Indicator Removal: Clear Persistence
      • System Location Discovery: System Language Discovery
      PID:2360
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /delete /tn "QQBrowser Updater Task(Core)" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1684
    • C:\Windows\SysWOW64\ctfmon.exe
      C:\Windows\SysWOW64\ctfmon.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1496
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\Favorites\Links for United States
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2728
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\Favorites\Microsoft Websites
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2720
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\Favorites\MSN Websites
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c DEL /S /Q /F C:\Users\Admin\Favorites\Windows Live
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3064
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1724
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2452

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Event Triggered Execution

      1
      T1546

      Netsh Helper DLL

      1
      T1546.007

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      1
      T1562

      Disable or Modify Tools

      1
      T1562.001

      Indicator Removal

      2
      T1070

      Clear Persistence

      1
      T1070.009

      File Deletion

      1
      T1070.004

      Modify Registry

      6
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Peripheral Device Discovery

      1
      T1120

      Query Registry

      1
      T1012

      System Information Discovery

      3
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\AutoSoft\Main.jpg
        Filesize

        19KB

        MD5

        f40d147c8a0028b0b6eb9ef26dd56a5e

        SHA1

        a51a802b98bccb11e62d8dfd3ba8894342de1abf

        SHA256

        760f22e3a1fa0b52a91a8a2b1a3b1c3c88a6cf3f52ac27f21f5f8abdd01c9ffa

        SHA512

        b28149cdb19cb675499c65b214abb13d4a4d72369707617e360e3cafddfe7dd87aedd4aec7122b9ca4b92d1e448aa19d877053461e8c5355db4fb63c70073ab5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\AutoSoft\Progress.gif
        Filesize

        74KB

        MD5

        39216a24e615a402304bfa1a77c6dffd

        SHA1

        71394af3279365d748d406671a825c8cced2eb60

        SHA256

        acd117ae727666402e8fdfb29aec89abbd8341435bbea0f860d4210d52c50ef1

        SHA512

        b8a71ded49ddfa2eaf1cf5d8d61125092f6ad94f09eaa89091fa81cd966018f31b8b399feaea401caf2e93998d8f8376038637171e34dafcaae07a64f8da1c7f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\AutoSoft\succes.jpg
        Filesize

        5KB

        MD5

        642733a7bd04b267df22f128f54c6ed3

        SHA1

        2dc5d38b0155092c5883cee66884eb10adc4a5f3

        SHA256

        fa8dc47742ee0190c8c7f2cc35f92793b3f142e5994f58d08610b51e2184c611

        SHA512

        32efccc39b7f822ae30e7dcc47ce6b5391002caa503328a46aecf32dc8fd050acb18414d4aa76198ef40531315f3b56fa10b8e6b7176f26ef4b3e1ba55a64c30

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Windows7_YH.REG
        Filesize

        1KB

        MD5

        a0f4d266b566cc51131170a6d9d303f7

        SHA1

        b5fa5636d518a10ea062cc9c5c17c9e7e343ce63

        SHA256

        5fd3973a56ca89d237e47fa2c6a9976650dcc71dc2256cad07977484429575c6

        SHA512

        d25dfede4790148f55589e39d66540a6affc606302290051f2c2c289f8037f56125164b37f126ff60266285267154189357d22b7dc8ea6e42a7ced57f522bc1b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\baidu.reg
        Filesize

        752B

        MD5

        f4a0f95f1785a0f1b2f83d04abd37e4a

        SHA1

        794ef0460cc1f55cbde0bb74c74b991eee153cbb

        SHA256

        f18ada26b94f662da2e3a9b800a851d86e9450d25cdcc2e8ea84565c803b59fa

        SHA512

        e1f5e3f4b3fd1af418624047b530a4eedfa42011b3788fa7d7d305f3b1484caabcfedfbcb66972eec16e1e4786b6eb2ac0f8382562a70aa12dd3d4dc16250aa7

        Download Submit

      • memory/2312-25-0x0000000002E70000-0x0000000003270000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/2312-0-0x0000000001300000-0x0000000001556000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2312-51-0x0000000001300000-0x0000000001556000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2312-53-0x0000000002E70000-0x0000000003270000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/2312-55-0x0000000001300000-0x0000000001556000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2312-58-0x0000000001300000-0x0000000001556000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2312-62-0x0000000001300000-0x0000000001556000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2312-83-0x0000000001300000-0x0000000001556000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/2312-81-0x0000000002E70000-0x0000000003270000-memory.dmp

        Filesize

        4.0MB

        Download