Analysis
-
max time kernel
151s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 12:46
Static task
static1
Behavioral task
behavioral1
Sample
6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe
Resource
win10v20210410
General
-
Target
6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe
-
Size
626KB
-
MD5
9e10b8240003873cfe523f78ec5f693d
-
SHA1
a902ef719ebcd1e7eca41d41f8985bea7f345406
-
SHA256
6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b
-
SHA512
bdcf32ad849638cdc4b09b7c0af5738676271e61391e0b86bf709b975aea2958b8015b4fb661b6917412cbd27fe1b2753d6fc487983e1acadbc307f7784c488c
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\LYMwkwww\\AsYEUgAY.exe," 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\LYMwkwww\\AsYEUgAY.exe," 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe -
Modifies visibility of file extensions in Explorer 2 TTPs
-
Executes dropped EXE 4 IoCs
Processes:
nOMIkYkQ.exeAsYEUgAY.exedswUEwQA.execver.exepid process 1908 nOMIkYkQ.exe 2572 AsYEUgAY.exe 3992 dswUEwQA.exe 3848 cver.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
nOMIkYkQ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation nOMIkYkQ.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exenOMIkYkQ.exeAsYEUgAY.exedswUEwQA.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\nOMIkYkQ.exe = "C:\\Users\\Admin\\xOYUUMAA\\nOMIkYkQ.exe" 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AsYEUgAY.exe = "C:\\ProgramData\\LYMwkwww\\AsYEUgAY.exe" 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\nOMIkYkQ.exe = "C:\\Users\\Admin\\xOYUUMAA\\nOMIkYkQ.exe" nOMIkYkQ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AsYEUgAY.exe = "C:\\ProgramData\\LYMwkwww\\AsYEUgAY.exe" AsYEUgAY.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AsYEUgAY.exe = "C:\\ProgramData\\LYMwkwww\\AsYEUgAY.exe" dswUEwQA.exe -
Drops file in System32 directory 4 IoCs
Processes:
nOMIkYkQ.exedswUEwQA.exedescription ioc process File created C:\Windows\SysWOW64\shell32.dll.exe nOMIkYkQ.exe File opened for modification C:\Windows\SysWOW64\sheEnableRedo.zip nOMIkYkQ.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\xOYUUMAA dswUEwQA.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\xOYUUMAA\nOMIkYkQ dswUEwQA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exenOMIkYkQ.exepid process 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
nOMIkYkQ.exepid process 1908 nOMIkYkQ.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
nOMIkYkQ.exepid process 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe 1908 nOMIkYkQ.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.execmd.exedescription pid process target process PID 1892 wrote to memory of 1908 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe nOMIkYkQ.exe PID 1892 wrote to memory of 1908 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe nOMIkYkQ.exe PID 1892 wrote to memory of 1908 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe nOMIkYkQ.exe PID 1892 wrote to memory of 2572 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe AsYEUgAY.exe PID 1892 wrote to memory of 2572 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe AsYEUgAY.exe PID 1892 wrote to memory of 2572 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe AsYEUgAY.exe PID 1892 wrote to memory of 3564 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe cmd.exe PID 1892 wrote to memory of 3564 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe cmd.exe PID 1892 wrote to memory of 3564 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe cmd.exe PID 1892 wrote to memory of 8 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 1892 wrote to memory of 8 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 1892 wrote to memory of 8 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 1892 wrote to memory of 4068 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 1892 wrote to memory of 4068 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 1892 wrote to memory of 4068 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 1892 wrote to memory of 1112 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 1892 wrote to memory of 1112 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 1892 wrote to memory of 1112 1892 6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe reg.exe PID 3564 wrote to memory of 3848 3564 cmd.exe cver.exe PID 3564 wrote to memory of 3848 3564 cmd.exe cver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe"C:\Users\Admin\AppData\Local\Temp\6aa81273480d8316e91582e10a203628d3944b8ec50aaf9450b6cc9ead32081b.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\xOYUUMAA\nOMIkYkQ.exe"C:\Users\Admin\xOYUUMAA\nOMIkYkQ.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\ProgramData\LYMwkwww\AsYEUgAY.exe"C:\ProgramData\LYMwkwww\AsYEUgAY.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cver.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cver.exeC:\Users\Admin\AppData\Local\Temp\cver.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
C:\ProgramData\XYwAwkIE\dswUEwQA.exeC:\ProgramData\XYwAwkIE\dswUEwQA.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\LYMwkwww\AsYEUgAY.exeMD5
79d79df6ab1126b77edaa346b42e8fef
SHA15da75a4a3fcbf09e2487193e4c853720cf09fb2a
SHA2565c6e3d8046c8e767c85e1adbbed2b8443b94857adef2d6129b2c783fde3d428f
SHA512c61a5c5f626abe6d835dd11d8705152e325aaa379398a370d507b94d7ac67be36b88d806a5c24f44dc8528cc5541e80bab27c248a9cb5a9f99efeb75a8936bbc
-
C:\ProgramData\LYMwkwww\AsYEUgAY.exeMD5
79d79df6ab1126b77edaa346b42e8fef
SHA15da75a4a3fcbf09e2487193e4c853720cf09fb2a
SHA2565c6e3d8046c8e767c85e1adbbed2b8443b94857adef2d6129b2c783fde3d428f
SHA512c61a5c5f626abe6d835dd11d8705152e325aaa379398a370d507b94d7ac67be36b88d806a5c24f44dc8528cc5541e80bab27c248a9cb5a9f99efeb75a8936bbc
-
C:\ProgramData\XYwAwkIE\dswUEwQA.exeMD5
59593c16a83b019f962ce4bd3d931a8a
SHA1493d263f87e1070dce4e84e061e3f873007e73ce
SHA2569f2bcfc6975e343679608bd01eaf7efa454384bde11e4ee2b26e5d92f1e96653
SHA512690f53ac2866e4267ab786b23d613810ec846683fac73b92af83398ec83eb57aaa4c6082c5fb7bdfe71bf07ab479dfd3c6e25161728a0bdb377740c0c4141b3e
-
C:\ProgramData\XYwAwkIE\dswUEwQA.exeMD5
59593c16a83b019f962ce4bd3d931a8a
SHA1493d263f87e1070dce4e84e061e3f873007e73ce
SHA2569f2bcfc6975e343679608bd01eaf7efa454384bde11e4ee2b26e5d92f1e96653
SHA512690f53ac2866e4267ab786b23d613810ec846683fac73b92af83398ec83eb57aaa4c6082c5fb7bdfe71bf07ab479dfd3c6e25161728a0bdb377740c0c4141b3e
-
C:\Users\Admin\AppData\Local\Temp\cver.exeMD5
0d0b992d2d4b7619f49ee0458d3469b1
SHA15d9835b408a231902654d516b48843890f4130e5
SHA25655c3f3f02b48a1e69d8b58d195c53f2d604acd890d09d7310272dcd289cf2d94
SHA5128435b079d408689fabb3d8713c2d4b86f85f1b9bc4bc79427ee0ae069fafd23a703d71d481a1515bb98a31b90171a75a97c1ec6a9df63170a4961940e04494b7
-
C:\Users\Admin\AppData\Local\Temp\cver.exeMD5
0d0b992d2d4b7619f49ee0458d3469b1
SHA15d9835b408a231902654d516b48843890f4130e5
SHA25655c3f3f02b48a1e69d8b58d195c53f2d604acd890d09d7310272dcd289cf2d94
SHA5128435b079d408689fabb3d8713c2d4b86f85f1b9bc4bc79427ee0ae069fafd23a703d71d481a1515bb98a31b90171a75a97c1ec6a9df63170a4961940e04494b7
-
C:\Users\Admin\xOYUUMAA\nOMIkYkQ.exeMD5
12e12f0622279e2520cdebe2c6ed8311
SHA18df9696311037cc2a5e291a4cc40d4339e2f18d7
SHA256bfd37e45734183db8f76bd48b2f269d17fdba1b21331fa20a66266c132c8cf88
SHA512f81875c4230e3df4ba8cb8ce1b49029463e2143a8ed81b4a71c2ef1351d84eb02827f5c75a59846d5896e662aa286f13ceb91278fcf5713faf68bf6c47559488
-
C:\Users\Admin\xOYUUMAA\nOMIkYkQ.exeMD5
12e12f0622279e2520cdebe2c6ed8311
SHA18df9696311037cc2a5e291a4cc40d4339e2f18d7
SHA256bfd37e45734183db8f76bd48b2f269d17fdba1b21331fa20a66266c132c8cf88
SHA512f81875c4230e3df4ba8cb8ce1b49029463e2143a8ed81b4a71c2ef1351d84eb02827f5c75a59846d5896e662aa286f13ceb91278fcf5713faf68bf6c47559488
-
memory/8-123-0x0000000000000000-mapping.dmp
-
memory/1112-125-0x0000000000000000-mapping.dmp
-
memory/1908-114-0x0000000000000000-mapping.dmp
-
memory/2572-117-0x0000000000000000-mapping.dmp
-
memory/3564-122-0x0000000000000000-mapping.dmp
-
memory/3848-126-0x0000000000000000-mapping.dmp
-
memory/3848-129-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/3848-131-0x000000001BB00000-0x000000001BB02000-memory.dmpFilesize
8KB
-
memory/4068-124-0x0000000000000000-mapping.dmp