Overview

overview

10

Static

static

3

RX7??????/...??.exe

windows7-x64

7

RX7??????/...??.exe

windows10-1703-x64

10

RX7??????/...??.exe

windows10-2004-x64

7

RX7??????/...??.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    299s
  • max time network
    301s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29-06-2024 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RX7??????/RX7??????.exe

  • Size

    9.0MB

  • MD5

    9bb985a8d656695e7145b476f5843d9b

  • SHA1

    692349d245063578785f536eff53e74cb2ed3e8f

  • SHA256

    016c08c41d90c4824da1a0986cb76ff50fd529ad699b6fdb02ce2b9bcdcd7fa1

  • SHA512

    5ea151ae0e88a16e908e5fe5446248095e8aed337617b375dae00cbf01cd7c93153c37315bb20f6579b7a17e908e8f8873577e680a387dc54da535f6c3756430

  • SSDEEP

    98304:bhR4VT3Qs1nkoqshkmafkVsKys31+9KiugFWQJtbGkPQlrW5pDwffds7p8PLC4G/:dmVjTVkoNnekL3wDBP2yiW7LnM/kVa92

Score
7/10
defense_evasionprivilege_escalationupx

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Blocklisted process makes network request 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 16 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7______.exe
    "C:\Users\Admin\AppData\Local\Temp\RX7______\RX7______.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe
      "C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe"
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SJs8Z_S.msi"
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:3364
    • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe
      "C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Users\Admin\AppData\Roaming\Load.exe
        "C:\Users\Admin\AppData\Roaming\Load.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3036
  • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
    C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\KGGouWo.exe
      KGGouWo.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4956
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "iex([Text.Encoding]::Default.GetString([Microsoft.Win32.Registry]::CurrentUser.OpenSubKey('Software\Microsoft\Internet Explorer').GetValue($null)))"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2080
        • C:\Windows\SysWOW64\dllhost.exe
          dllhost
          4⤵
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:3712
        • C:\Windows\SysWOW64\dllhost.exe
          dllhost
          4⤵
            PID:3616
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 47B60760C1AC09DF13F69EB1315A2E0C
        2⤵
        • Drops startup file
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3124
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\SysWOW64\reg.exe" add "HKEY_CLASSES_ROOT\.sysconfig" /ve /d "sysconfig" /f
          3⤵
          • Modifies registry class
          PID:3780
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\SysWOW64\reg.exe" add "HKEY_CLASSES_ROOT\sysconfig\shell\open\command" /ve /d "wscript.exe //E:vbscript ""%1%""" /f
          3⤵
          • Modifies registry class
          PID:2780
      • C:\Windows\Installer\MSI5BA2.tmp
        "C:\Windows\Installer\MSI5BA2.tmp" /EnforcedRunAsAdmin /DontWait /dir "C:\Users\Public\Documents\" regsvr32.exe /s C:\Users\Public\Documents\Properties.dll
        2⤵
        • Executes dropped EXE
        • Access Token Manipulation: Create Process with Token
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s C:\Users\Public\Documents\Properties.dll
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:3868
          • C:\Windows\system32\regsvr32.exe
            /s C:\Users\Public\Documents\Properties.dll
            4⤵
            • Loads dropped DLL
            • Enumerates connected drives
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:2908

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Access Token Manipulation

    1
    T1134

    Create Process with Token

    1
    T1134.002

    Defense Evasion

    Access Token Manipulation

    1
    T1134

    Create Process with Token

    1
    T1134.002

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    3
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    3
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e57594e.rbs
      Filesize

      1KB

      MD5

      3ce6552cbc2f9c7e76267d6c9ac153b6

      SHA1

      02da7c537725fd6f5799bb6c1fc6a68eda6ace5f

      SHA256

      11465877b71d0a9ba64ef52c379066f7d3bb4e9cdb890773c013038a90e24820

      SHA512

      3f19434351c261cc215017c87f91222fb789155e3afffee82a47fff03cdcbc0f8351f91b6da42fb6a1892b742dda0136ca550ee20c8e9341e2b81072497650ad

      Download Submit
    • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\KGGouWo.exe
      Filesize

      98KB

      MD5

      2770fcbc1d50ed765b051fb0affe9249

      SHA1

      2242bb12a364598e32b93cbb54dd3c0c0594894c

      SHA256

      cf366c91bd917fe5dbcea610fb8506b657bfebbdc5c74eb99ba8ee0cf458def2

      SHA512

      206ad4d97b81ae10eb711622ae6a5dd4039a59b8498e4be281de207b27025cbf720503f66a3d97f88230f2085e15e94b863a968ed4a41455955fa26210e5cb1f

      Download Submit
    • C:\Users\Admin\AppData\Local\Microsoft\PaneTool\PaneTool.exe
      Filesize

      288KB

      MD5

      13b4967e75327d14361a84faa3c2316d

      SHA1

      2a5ac66f0ec8ab642d5137b4faed376f2f3c684e

      SHA256

      2e93234d52d1332a3aabde393ec66aa1a357336350563f12f29c4285f9946e59

      SHA512

      fd113eaabd451729e2ab87f6aacbf47bbe196c34847b27d115f0f30dc4533d250890647ec1e71cdde40262364eb09cbdc3abc1d19a77664204fe2dc4c042f979

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\RX7______\Liux.exe
      Filesize

      1.4MB

      MD5

      c4efb271c645d5a113c348ffa4b69724

      SHA1

      a6cd25cb6f7b952be89cc86976eb76bb4e6c3c72

      SHA256

      37f48b8f4a5cbe718477001f4869ed04c7f9b8dae7870ab80e7ef36fc00be0c1

      SHA512

      8fb88d24452f14b82aed26ab6aa28d16a4b77b50b75e919e486ade7320513e5fe66a85e8861ffbd6f78bf81c64407078109e97dddda42662d3b0bbd61e93a790

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\RX7______\RX7远程管理.exe
      Filesize

      9.3MB

      MD5

      a8b40d4763f08d51bfed24d0bf258d0a

      SHA1

      2d949f75673e7489ccdabb266134a951dbf5586f

      SHA256

      e4a80728e6f8efdefc6f75560196ceda43d8835b1038feccd6b132cbc6ff6b5b

      SHA512

      7ad834243e35af6ecdafe253bffc7b80d2020737e92ad0a82fbb881fde4506c7e6759e05e114ece6c91eda6f3877d4b6ede4a11d73ec4b20b383648b5f42f5c9

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\SJs8Z_S.msi
      Filesize

      1.7MB

      MD5

      1a9ec16d6fa353519ac078f899b404c2

      SHA1

      11d99d3b6de198433fcfb8b22e754af0a3b400f9

      SHA256

      968fbcc7f09c15075a7fe3c7e079c478f4e2a58590bf83141c18328589b6aded

      SHA512

      2a941e12049ed124a058b3cbf6698de7ce3430965ffb5b391340f433f422dda96d788f65643790c9a21f53482577a49b43e3ad3b39a62a805fecb7fc3b76f115

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nzktv0jc.h45.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit
    • C:\Users\Admin\AppData\Roaming\Load.exe
      Filesize

      1.2MB

      MD5

      e541172f456ea5acf9ccfd33b4051fc1

      SHA1

      60193ac3cb3f6063cf432776c3d8bd22a549bd49

      SHA256

      3badf2601b723bbf99d19027dc0d8756228be0557f45e9b3e2e48fd211bc3823

      SHA512

      f08cbf9d3658a3aa8e7c8d62e49aed80f8cd280d53e074ccc65314d2c9bf940ea7efa567eefa68d7b9af0eb9d5e0720dc83e3da3cfef112458c199353ccac597

      Download Submit
    • C:\Users\Public\Documents\Properties.dll
      Filesize

      731KB

      MD5

      60922574639b3dc592a6b42321dea9f5

      SHA1

      042ae7a3bce4873626a1d86db854566bcbb46fec

      SHA256

      3357eb473e3d2872ff58e832533ba1d615f30503a77d3b4a3960e8d3c5a81ab6

      SHA512

      4f3b0a0b5f9ed3529b1e57d589e4186af1a283abe87151c2da8e4bedb8ee6011c97aeba98b764e1c8199745ace7043df933e23a49ee59fe3d0d8635eb829f98a

      Download Submit
    • C:\Windows\Installer\MSI59B9.tmp
      Filesize

      436KB

      MD5

      5788efa607d26332d6d7f5e6a1f6bd6f

      SHA1

      e7749843cc3e89bc81649087de4ad44c93d48bc6

      SHA256

      9fc2608c9e5ef5a88dd91c82660fa297144ba6bbf4602140d638de7233a4625d

      SHA512

      ce472ca4f956da4160cfd9b9051455974e24dd8b23a0b7b197afd1f7552e37980809e523bedc0d4c2f4c9cb6ef300b221e6404e6e6a1b789b67756550ddd2104

      Download Submit
    • C:\Windows\Installer\MSI5BA2.tmp
      Filesize

      389KB

      MD5

      377c83c6f0f37653ff911dc06e6c4274

      SHA1

      ce1e53b5bf0a220346ab7379b93c4341c24fdd8a

      SHA256

      c290a133b60220479acf0469781de847eb7e4a6b0c92de45ee9223be5e0ca769

      SHA512

      47bed026ef3d3e1a88a8cec3e0e2904029ec6f2e0ed9bb8d8836564fa713e882cf9bbf0d1e1dc7887072804578edd6af21b047d579f85f27bba733a20125fdd8

      Download Submit
    • memory/1916-26-0x0000000003720000-0x0000000003721000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2080-111-0x0000000006850000-0x000000000686E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/2080-112-0x0000000006880000-0x00000000068CC000-memory.dmp
      Filesize

      304KB

      Download
    • memory/2080-98-0x0000000005D20000-0x000000000634A000-memory.dmp
      Filesize

      6.2MB

      Download
    • memory/2080-99-0x0000000005AD0000-0x0000000005AF2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/2080-101-0x0000000005BE0000-0x0000000005C46000-memory.dmp
      Filesize

      408KB

      Download
    • memory/2080-100-0x0000000005B70000-0x0000000005BD6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/2080-115-0x0000000007A40000-0x0000000007AB1000-memory.dmp
      Filesize

      452KB

      Download
    • memory/2080-110-0x0000000006350000-0x00000000066A7000-memory.dmp
      Filesize

      3.3MB

      Download
    • memory/2080-72-0x0000000003060000-0x0000000003096000-memory.dmp
      Filesize

      216KB

      Download
    • memory/2080-113-0x00000000081A0000-0x000000000881A000-memory.dmp
      Filesize

      6.5MB

      Download
    • memory/2080-114-0x0000000006DA0000-0x0000000006DBA000-memory.dmp
      Filesize

      104KB

      Download
    • memory/2908-132-0x0000000002AD0000-0x0000000002B1E000-memory.dmp
      Filesize

      312KB

      Download
    • memory/2908-97-0x00007FFF21AC0000-0x00007FFF21BD6000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/2908-159-0x00007FFF21AC0000-0x00007FFF21BD6000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/2908-138-0x0000000002AD0000-0x0000000002B1E000-memory.dmp
      Filesize

      312KB

      Download
    • memory/2908-139-0x0000000002AD0000-0x0000000002B1E000-memory.dmp
      Filesize

      312KB

      Download
    • memory/2908-137-0x0000000002AD0000-0x0000000002B1E000-memory.dmp
      Filesize

      312KB

      Download
    • memory/3616-120-0x0000000000980000-0x000000000099C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/3616-119-0x0000000000980000-0x000000000099C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/3616-168-0x0000000000980000-0x000000000099C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/3712-124-0x0000000000980000-0x00000000009C0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3712-116-0x0000000000980000-0x00000000009C0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3712-125-0x0000000000980000-0x00000000009C0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3712-117-0x0000000000980000-0x00000000009C0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3712-118-0x0000000000980000-0x00000000009C0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3712-121-0x0000000000980000-0x00000000009C0000-memory.dmp
      Filesize

      256KB

      Download
    • memory/3868-96-0x0000000002B80000-0x0000000002C96000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/3868-173-0x0000000002B80000-0x0000000002C96000-memory.dmp
      Filesize

      1.1MB

      Download