Analysis
- max time kernel
151s - max time network
124s - platform
windows7_x64 - resource
win7v20210408 - submitted
05/05/2021, 08:07
Static task
static1
Behavioral task
behavioral1
Sample
a83af189_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a83af189_by_Libranalysis.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target a83af189_by_Libranalysis.exe
- Size 1.6MB
- Sample210505-e8d6dz4jfn
- SHA256 9d1077e6f08763e2eda061f1ac773bd7dbe36bb6aa547abe75163dc46de442cd
- MD5 a83af1893775bd6ac6c4c08aa62e7394
- SHA1 a129913be9171734126055c82bcf56ccbbf98315
- SHA512 838d5a43fb43660b19beb89614e79fcdf92d0b3304a7958b726b760edfe4382d081cd59185f7ce2153443879c491cf1d6255f0bad821111122e91c5da72fca24
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\jUssokss\\wCgUcMMQ.exe," a83af189_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\ProgramData\\jUssokss\\wCgUcMMQ.exe," a83af189_by_Libranalysis.exe - Modifies visibility of file extensions in Explorer 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 1164 uOYMAkwk.exe 1176 wCgUcMMQ.exe 1784 KSgIcAws.exe 1368 setup.exe - Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\StopDeny.png.exe uOYMAkwk.exe File created C:\Users\Admin\Pictures\AssertFind.png.exe uOYMAkwk.exe File created C:\Users\Admin\Pictures\BackupStart.png.exe uOYMAkwk.exe File created C:\Users\Admin\Pictures\InstallOptimize.png.exe uOYMAkwk.exe File created C:\Users\Admin\Pictures\ReceiveEnter.png.exe uOYMAkwk.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation uOYMAkwk.exe - Loads dropped DLL 17 IoCs
pid Process 1096 a83af189_by_Libranalysis.exe 1096 a83af189_by_Libranalysis.exe 1096 a83af189_by_Libranalysis.exe 1096 a83af189_by_Libranalysis.exe 848 cmd.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wCgUcMMQ.exe = "C:\\ProgramData\\jUssokss\\wCgUcMMQ.exe" KSgIcAws.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\uOYMAkwk.exe = "C:\\Users\\Admin\\fkUggMQQ\\uOYMAkwk.exe" a83af189_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wCgUcMMQ.exe = "C:\\ProgramData\\jUssokss\\wCgUcMMQ.exe" a83af189_by_Libranalysis.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\uOYMAkwk.exe = "C:\\Users\\Admin\\fkUggMQQ\\uOYMAkwk.exe" uOYMAkwk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wCgUcMMQ.exe = "C:\\ProgramData\\jUssokss\\wCgUcMMQ.exe" wCgUcMMQ.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\fkUggMQQ KSgIcAws.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\fkUggMQQ\uOYMAkwk KSgIcAws.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico uOYMAkwk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 3 IoCs
pid Process 1240 reg.exe 1552 reg.exe 1388 reg.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1096 a83af189_by_Libranalysis.exe 1096 a83af189_by_Libranalysis.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1164 uOYMAkwk.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe 1164 uOYMAkwk.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1164 1096 a83af189_by_Libranalysis.exe 26 PID 1096 wrote to memory of 1164 1096 a83af189_by_Libranalysis.exe 26 PID 1096 wrote to memory of 1164 1096 a83af189_by_Libranalysis.exe 26 PID 1096 wrote to memory of 1164 1096 a83af189_by_Libranalysis.exe 26 PID 1096 wrote to memory of 1176 1096 a83af189_by_Libranalysis.exe 27 PID 1096 wrote to memory of 1176 1096 a83af189_by_Libranalysis.exe 27 PID 1096 wrote to memory of 1176 1096 a83af189_by_Libranalysis.exe 27 PID 1096 wrote to memory of 1176 1096 a83af189_by_Libranalysis.exe 27 PID 1096 wrote to memory of 848 1096 a83af189_by_Libranalysis.exe 29 PID 1096 wrote to memory of 848 1096 a83af189_by_Libranalysis.exe 29 PID 1096 wrote to memory of 848 1096 a83af189_by_Libranalysis.exe 29 PID 1096 wrote to memory of 848 1096 a83af189_by_Libranalysis.exe 29 PID 1096 wrote to memory of 1240 1096 a83af189_by_Libranalysis.exe 32 PID 1096 wrote to memory of 1240 1096 a83af189_by_Libranalysis.exe 32 PID 1096 wrote to memory of 1240 1096 a83af189_by_Libranalysis.exe 32 PID 1096 wrote to memory of 1240 1096 a83af189_by_Libranalysis.exe 32 PID 1096 wrote to memory of 1552 1096 a83af189_by_Libranalysis.exe 33 PID 1096 wrote to memory of 1552 1096 a83af189_by_Libranalysis.exe 33 PID 1096 wrote to memory of 1552 1096 a83af189_by_Libranalysis.exe 33 PID 1096 wrote to memory of 1552 1096 a83af189_by_Libranalysis.exe 33 PID 1096 wrote to memory of 1388 1096 a83af189_by_Libranalysis.exe 35 PID 1096 wrote to memory of 1388 1096 a83af189_by_Libranalysis.exe 35 PID 1096 wrote to memory of 1388 1096 a83af189_by_Libranalysis.exe 35 PID 1096 wrote to memory of 1388 1096 a83af189_by_Libranalysis.exe 35 PID 848 wrote to memory of 1368 848 cmd.exe 31 PID 848 wrote to memory of 1368 848 cmd.exe 31 PID 848 wrote to memory of 1368 848 cmd.exe 31 PID 848 wrote to memory of 1368 848 cmd.exe 31 PID 848 wrote to memory of 1368 848 cmd.exe 31 PID 848 wrote to memory of 1368 848 cmd.exe 31 PID 848 wrote to memory of 1368 848 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\a83af189_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\a83af189_by_Libranalysis.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\fkUggMQQ\uOYMAkwk.exe"C:\Users\Admin\fkUggMQQ\uOYMAkwk.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:1164
-
-
C:\ProgramData\jUssokss\wCgUcMMQ.exe"C:\ProgramData\jUssokss\wCgUcMMQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1176
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\setup.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe3⤵
- Executes dropped EXE
PID:1368
-
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
PID:1240
-
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
PID:1552
-
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
PID:1388
-
-
C:\ProgramData\ZkcIwcow\KSgIcAws.exeC:\ProgramData\ZkcIwcow\KSgIcAws.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1784