Overview

overview

10

Static

static

3

RX7??????/...??.exe

windows7-x64

7

RX7??????/...??.exe

windows10-1703-x64

10

RX7??????/...??.exe

windows10-2004-x64

7

RX7??????/...??.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    13s
  • max time network
    57s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-06-2024 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RX7??????/RX7??????.exe

  • Size

    9.0MB

  • MD5

    9bb985a8d656695e7145b476f5843d9b

  • SHA1

    692349d245063578785f536eff53e74cb2ed3e8f

  • SHA256

    016c08c41d90c4824da1a0986cb76ff50fd529ad699b6fdb02ce2b9bcdcd7fa1

  • SHA512

    5ea151ae0e88a16e908e5fe5446248095e8aed337617b375dae00cbf01cd7c93153c37315bb20f6579b7a17e908e8f8873577e680a387dc54da535f6c3756430

  • SSDEEP

    98304:bhR4VT3Qs1nkoqshkmafkVsKys31+9KiugFWQJtbGkPQlrW5pDwffds7p8PLC4G/:dmVjTVkoNnekL3wDBP2yiW7LnM/kVa92

Score
7/10
defense_evasionprivilege_escalationupx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 12 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7______.exe
    "C:\Users\Admin\AppData\Local\Temp\RX7______\RX7______.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe
      "C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:208
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SJs8Z_S.msi"
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3472
    • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe
      "C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Users\Admin\AppData\Roaming\Load.exe
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1324
  • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
    C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:500
    • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\KGGouWo.exe
      KGGouWo.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3716
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "iex([Text.Encoding]::Default.GetString([Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Internet Explorer').GetValue($null)))"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3248
        • C:\Windows\SysWOW64\dllhost.exe
          dllhost
          4⤵
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:3724
        • C:\Windows\SysWOW64\dllhost.exe
          dllhost
          4⤵
            PID:3636
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1984
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 99531AAFC5B456B18F46DABF2E20B3D0
        2⤵
        • Drops startup file
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4976
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\SysWOW64\reg.exe" add "HKEY_CLASSES_ROOT\.sysconfig" /ve /d "sysconfig" /f
          3⤵
          • Modifies registry class
          PID:1372
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\SysWOW64\reg.exe" add "HKEY_CLASSES_ROOT\sysconfig\shell\open\command" /ve /d "wscript.exe //E:vbscript ""%1%""" /f
          3⤵
          • Modifies registry class
          PID:4724
      • C:\Windows\Installer\MSI9792.tmp
        "C:\Windows\Installer\MSI9792.tmp" /EnforcedRunAsAdmin /DontWait /dir "C:\Users\Public\Documents\" regsvr32.exe /s C:\Users\Public\Documents\Properties.dll
        2⤵
        • Executes dropped EXE
        • Access Token Manipulation: Create Process with Token
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s C:\Users\Public\Documents\Properties.dll
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1828
          • C:\Windows\system32\regsvr32.exe
            /s C:\Users\Public\Documents\Properties.dll
            4⤵
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:4476

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Access Token Manipulation

    1
    T1134

    Create Process with Token

    1
    T1134.002

    Defense Evasion

    Access Token Manipulation

    1
    T1134

    Create Process with Token

    1
    T1134.002

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    4
    T1012

    System Information Discovery

    4
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e579425.rbs
      Filesize

      1KB

      MD5

      3ce6552cbc2f9c7e76267d6c9ac153b6

      SHA1

      02da7c537725fd6f5799bb6c1fc6a68eda6ace5f

      SHA256

      11465877b71d0a9ba64ef52c379066f7d3bb4e9cdb890773c013038a90e24820

      SHA512

      3f19434351c261cc215017c87f91222fb789155e3afffee82a47fff03cdcbc0f8351f91b6da42fb6a1892b742dda0136ca550ee20c8e9341e2b81072497650ad

      Download Submit
    • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\KGGouWo.exe
      Filesize

      98KB

      MD5

      2770fcbc1d50ed765b051fb0affe9249

      SHA1

      2242bb12a364598e32b93cbb54dd3c0c0594894c

      SHA256

      cf366c91bd917fe5dbcea610fb8506b657bfebbdc5c74eb99ba8ee0cf458def2

      SHA512

      206ad4d97b81ae10eb711622ae6a5dd4039a59b8498e4be281de207b27025cbf720503f66a3d97f88230f2085e15e94b863a968ed4a41455955fa26210e5cb1f

      Download Submit
    • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
      Filesize

      288KB

      MD5

      13b4967e75327d14361a84faa3c2316d

      SHA1

      2a5ac66f0ec8ab642d5137b4faed376f2f3c684e

      SHA256

      2e93234d52d1332a3aabde393ec66aa1a357336350563f12f29c4285f9946e59

      SHA512

      fd113eaabd451729e2ab87f6aacbf47bbe196c34847b27d115f0f30dc4533d250890647ec1e71cdde40262364eb09cbdc3abc1d19a77664204fe2dc4c042f979

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe
      Filesize

      1.4MB

      MD5

      c4efb271c645d5a113c348ffa4b69724

      SHA1

      a6cd25cb6f7b952be89cc86976eb76bb4e6c3c72

      SHA256

      37f48b8f4a5cbe718477001f4869ed04c7f9b8dae7870ab80e7ef36fc00be0c1

      SHA512

      8fb88d24452f14b82aed26ab6aa28d16a4b77b50b75e919e486ade7320513e5fe66a85e8861ffbd6f78bf81c64407078109e97dddda42662d3b0bbd61e93a790

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe
      Filesize

      9.3MB

      MD5

      a8b40d4763f08d51bfed24d0bf258d0a

      SHA1

      2d949f75673e7489ccdabb266134a951dbf5586f

      SHA256

      e4a80728e6f8efdefc6f75560196ceda43d8835b1038feccd6b132cbc6ff6b5b

      SHA512

      7ad834243e35af6ecdafe253bffc7b80d2020737e92ad0a82fbb881fde4506c7e6759e05e114ece6c91eda6f3877d4b6ede4a11d73ec4b20b383648b5f42f5c9

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SJs8Z_S.msi
      Filesize

      1.7MB

      MD5

      1a9ec16d6fa353519ac078f899b404c2

      SHA1

      11d99d3b6de198433fcfb8b22e754af0a3b400f9

      SHA256

      968fbcc7f09c15075a7fe3c7e079c478f4e2a58590bf83141c18328589b6aded

      SHA512

      2a941e12049ed124a058b3cbf6698de7ce3430965ffb5b391340f433f422dda96d788f65643790c9a21f53482577a49b43e3ad3b39a62a805fecb7fc3b76f115

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_geauowfb.ui2.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Load.exe
      Filesize

      1.2MB

      MD5

      e541172f456ea5acf9ccfd33b4051fc1

      SHA1

      60193ac3cb3f6063cf432776c3d8bd22a549bd49

      SHA256

      3badf2601b723bbf99d19027dc0d8756228be0557f45e9b3e2e48fd211bc3823

      SHA512

      f08cbf9d3658a3aa8e7c8d62e49aed80f8cd280d53e074ccc65314d2c9bf940ea7efa567eefa68d7b9af0eb9d5e0720dc83e3da3cfef112458c199353ccac597

      Download Submit
    • C:\Users\Public\Documents\Properties.dll
      Filesize

      731KB

      MD5

      60922574639b3dc592a6b42321dea9f5

      SHA1

      042ae7a3bce4873626a1d86db854566bcbb46fec

      SHA256

      3357eb473e3d2872ff58e832533ba1d615f30503a77d3b4a3960e8d3c5a81ab6

      SHA512

      4f3b0a0b5f9ed3529b1e57d589e4186af1a283abe87151c2da8e4bedb8ee6011c97aeba98b764e1c8199745ace7043df933e23a49ee59fe3d0d8635eb829f98a

      Download Submit
    • C:\Windows\Installer\MSI948F.tmp
      Filesize

      436KB

      MD5

      5788efa607d26332d6d7f5e6a1f6bd6f

      SHA1

      e7749843cc3e89bc81649087de4ad44c93d48bc6

      SHA256

      9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

      SHA512

      ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

      Download Submit
    • C:\Windows\Installer\MSI9792.tmp
      Filesize

      389KB

      MD5

      377c83c6f0f37653ff911dc06e6c4274

      SHA1

      ce1e53b5bf0a220346ab7379b93c4341c24fdd8a

      SHA256

      c290a133b60220479acf0469781de847eb7e4a6b0c92de45ee9223be5e0ca769

      SHA512

      47bed026ef3d3e1a88a8cec3e0e2904029ec6f2e0ed9bb8d8836564fa713e882cf9bbf0d1e1dc7887072804578edd6af21b047d579f85f27bba733a20125fdd8

      Download Submit
    • memory/1828-185-0x0000000000800000-0x0000000000916000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/1828-93-0x0000000000800000-0x0000000000916000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/3248-109-0x0000000005710000-0x0000000005A64000-memory.dmp
      Filesize

      3.3MB

      Download
    • memory/3248-111-0x0000000005CF0000-0x0000000005D3C000-memory.dmp
      Filesize

      304KB

      Download
    • memory/3248-99-0x00000000055A0000-0x0000000005606000-memory.dmp
      Filesize

      408KB

      Download
    • memory/3248-98-0x0000000004E40000-0x0000000004EA6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/3248-96-0x0000000004EC0000-0x00000000054E8000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/3248-70-0x00000000023E0000-0x0000000002416000-memory.dmp
      Filesize

      216KB

      Download
    • memory/3248-110-0x0000000005CA0000-0x0000000005CBE000-memory.dmp
      Filesize

      120KB

      Download
    • memory/3248-114-0x0000000006E80000-0x0000000006EF1000-memory.dmp
      Filesize

      452KB

      Download
    • memory/3248-113-0x00000000061E0000-0x00000000061FA000-memory.dmp
      Filesize

      104KB

      Download
    • memory/3248-112-0x00000000075F0000-0x0000000007C6A000-memory.dmp
      Filesize

      6.5MB

      Download
    • memory/3248-97-0x0000000004D20000-0x0000000004D42000-memory.dmp
      Filesize

      136KB

      Download
    • memory/3636-167-0x0000000000CE0000-0x0000000000CFC000-memory.dmp
      Filesize

      112KB

      Download
    • memory/3636-119-0x0000000000CE0000-0x0000000000CFC000-memory.dmp
      Filesize

      112KB

      Download
    • memory/3636-118-0x0000000000CE0000-0x0000000000CFC000-memory.dmp
      Filesize

      112KB

      Download
    • memory/3724-123-0x0000000000CE0000-0x0000000000D20000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3724-124-0x0000000000CE0000-0x0000000000D20000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3724-116-0x0000000000CE0000-0x0000000000D20000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3724-115-0x0000000000CE0000-0x0000000000D20000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3724-117-0x0000000000CE0000-0x0000000000D20000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3724-120-0x0000000000CE0000-0x0000000000D20000-memory.dmp
      Filesize

      256KB

      Download
    • memory/4476-131-0x00000000027A0000-0x00000000027EE000-memory.dmp
      Filesize

      312KB

      Download
    • memory/4476-136-0x00000000027A0000-0x00000000027EE000-memory.dmp
      Filesize

      312KB

      Download
    • memory/4476-138-0x00000000027A0000-0x00000000027EE000-memory.dmp
      Filesize

      312KB

      Download
    • memory/4476-137-0x00000000027A0000-0x00000000027EE000-memory.dmp
      Filesize

      312KB

      Download
    • memory/4476-157-0x00007FF800640000-0x00007FF800756000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/4476-95-0x00007FF800640000-0x00007FF800756000-memory.dmp
      Filesize

      1.1MB

      Download