Managed XDR

wextract.exe-.mui — malware analysis report

File info

Filename
wextract.exe-.mui
File type
PE32 executable (GUI) Intel 80386, for MS Windows
File size
1.1 MB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
309fa3eab1730fab633fede80c774b353904994c
SHA256
75d49233fc168fac930cd6a667e71ff7141798c7dd6fade51bb70c7acc6203d1
MD5
8d143c2a353a3082b29fe01ca3659223

Signatures

Resource Development

T1585.001 social_instagram: Connects to Instagram domains (potentially for information gathering)
T1586.001 social_instagram: Connects to Instagram domains (potentially for information gathering)
T1608.005 contacts_url_shortener: Connects to url shortening services
T1585.001 social_facebook: Connects to Facebook domains (potentially for information gathering)
T1585.001 social_twitter: Connects to Twitter domains (potentially for information gathering)
T1586.001 social_facebook: Connects to Facebook domains (potentially for information gathering)
T1586.001 social_twitter: Connects to Twitter domains (potentially for information gathering)

Execution

T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1059 autoit: AutoIt script execution detected
T1047 antivm_wmi: Uses WMI to detect virtual environment
T1047 has_wmi: Executes one or several WMI requests
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Persistence

T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler

Privilege Escalation

T1053.005 persistence_autorun: Makes itself run automatically on Windows startup
T1547.001 persistence_autorun: Makes itself run automatically on Windows startup
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1562.001 disables_security: Disables Windows Security options
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1497.001 antivm_disk_size: Checks the amount of free disk space
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager
T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)

Discovery

T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1497.001 antivm_disk_size: Checks the amount of free disk space
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1082 has_wmi: Executes one or several WMI requests
T1057 has_wmi: Executes one or several WMI requests
T1518 locates_browser: Attempts to identify where browsers are installed
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1135 server_share_info: Retrieves information about each shared resource on a server

Collection

T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)

Command and Control

T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Impact

T1486 modifies_files2: Cryptolocker indicators detected (50 or more files are modified)

Other

creates_many_processes: Spawns a lot of processes (over 70)
creates_in_windows: Creates files in the Windows directory
network_bind: Starts servers listening at None
creates_exe: Creates executable files in the file system
dead_host: Connects to IP addresses that do not respond to requests
create_rpc_bindings: Creates RPC connection
has_pdb: This executable file has a PDB path
creates_suspended_process: Creates suspended process
creates_in_programdata: Creates files in the ProgramData directory
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
writes_data: Writes big amount of data to disk
executes_dropped_exe: Executes dropped exe files
yara_rules: Static rules