Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
11-05-2021 13:46
Static task
static1
Behavioral task
behavioral1
Sample
4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe
Resource
win10v20210410
General
-
Target
4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe
-
Size
623KB
-
MD5
6cfb969b2b61fab4bcb4c3b33c987014
-
SHA1
79e74d1e8fae81b2b1c37769627ac46947f0bc76
-
SHA256
4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23
-
SHA512
50af7576b9f6237794dcb0ea1b8c6fcddfc405c7423b9829801cdb9f6ec82b1bff3e4282c0204c96be379bff6007ecfc262c6fd38431ab3f5a9a83197b1644c6
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\fUEoQQYA\\ukcksYks.exe," 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\fUEoQQYA\\ukcksYks.exe," 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe -
Modifies visibility of file extensions in Explorer 2 TTPs
-
Executes dropped EXE 4 IoCs
Processes:
amMwQgQA.exeukcksYks.exeMsAgUMEU.exechoco.exepid process 584 amMwQgQA.exe 1192 ukcksYks.exe 1640 MsAgUMEU.exe 2576 choco.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ukcksYks.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation ukcksYks.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
ukcksYks.exeMsAgUMEU.exe4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exeamMwQgQA.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ukcksYks.exe = "C:\\ProgramData\\fUEoQQYA\\ukcksYks.exe" ukcksYks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ukcksYks.exe = "C:\\ProgramData\\fUEoQQYA\\ukcksYks.exe" MsAgUMEU.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\amMwQgQA.exe = "C:\\Users\\Admin\\ucUUgIsY\\amMwQgQA.exe" 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ukcksYks.exe = "C:\\ProgramData\\fUEoQQYA\\ukcksYks.exe" 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\amMwQgQA.exe = "C:\\Users\\Admin\\ucUUgIsY\\amMwQgQA.exe" amMwQgQA.exe -
Drops file in System32 directory 6 IoCs
Processes:
MsAgUMEU.exeukcksYks.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\ucUUgIsY MsAgUMEU.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\ucUUgIsY\amMwQgQA MsAgUMEU.exe File created C:\Windows\SysWOW64\shell32.dll.exe ukcksYks.exe File opened for modification C:\Windows\SysWOW64\sheBlockUninstall.bmp ukcksYks.exe File opened for modification C:\Windows\SysWOW64\sheJoinEnter.jpg ukcksYks.exe File opened for modification C:\Windows\SysWOW64\sheUnlockRedo.pdf ukcksYks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exeukcksYks.exepid process 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ukcksYks.exepid process 1192 ukcksYks.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
ukcksYks.exepid process 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe 1192 ukcksYks.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.execmd.exedescription pid process target process PID 3152 wrote to memory of 584 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe amMwQgQA.exe PID 3152 wrote to memory of 584 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe amMwQgQA.exe PID 3152 wrote to memory of 584 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe amMwQgQA.exe PID 3152 wrote to memory of 1192 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe ukcksYks.exe PID 3152 wrote to memory of 1192 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe ukcksYks.exe PID 3152 wrote to memory of 1192 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe ukcksYks.exe PID 3152 wrote to memory of 2196 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe cmd.exe PID 3152 wrote to memory of 2196 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe cmd.exe PID 3152 wrote to memory of 2196 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe cmd.exe PID 3152 wrote to memory of 2532 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe PID 3152 wrote to memory of 2532 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe PID 3152 wrote to memory of 2532 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe PID 2196 wrote to memory of 2576 2196 cmd.exe choco.exe PID 2196 wrote to memory of 2576 2196 cmd.exe choco.exe PID 3152 wrote to memory of 2824 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe PID 3152 wrote to memory of 2824 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe PID 3152 wrote to memory of 2824 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe PID 3152 wrote to memory of 3584 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe PID 3152 wrote to memory of 3584 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe PID 3152 wrote to memory of 3584 3152 4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe"C:\Users\Admin\AppData\Local\Temp\4a394a5f68be6704adc8bac0ac9c3ef89e3295b9fd26c92363ae95ff2a8f8d23.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\ucUUgIsY\amMwQgQA.exe"C:\Users\Admin\ucUUgIsY\amMwQgQA.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\fUEoQQYA\ukcksYks.exe"C:\ProgramData\fUEoQQYA\ukcksYks.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\choco.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\choco.exeC:\Users\Admin\AppData\Local\Temp\choco.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 12⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f2⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 22⤵
- Modifies registry key
-
C:\ProgramData\OEIEcwAM\MsAgUMEU.exeC:\ProgramData\OEIEcwAM\MsAgUMEU.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\OEIEcwAM\MsAgUMEU.exeMD5
0608348c21afd005dc50c9c90ebfc896
SHA1fc449d5dca4311062f18133a238344aede10de63
SHA256d8b1f9de1e409513beb9cc684c054a139439d1a7190658c9dbcf74f14eb92a2b
SHA5121d44470d5ae6b9dae18fa3e84e82ec1668f19ca2a575ccbffc10ac2a55be50a3bc67758e60bd4bb6a3b11abdd322545b3fbf7a5068585e4d44f26385f78d15fe
-
C:\ProgramData\OEIEcwAM\MsAgUMEU.exeMD5
0608348c21afd005dc50c9c90ebfc896
SHA1fc449d5dca4311062f18133a238344aede10de63
SHA256d8b1f9de1e409513beb9cc684c054a139439d1a7190658c9dbcf74f14eb92a2b
SHA5121d44470d5ae6b9dae18fa3e84e82ec1668f19ca2a575ccbffc10ac2a55be50a3bc67758e60bd4bb6a3b11abdd322545b3fbf7a5068585e4d44f26385f78d15fe
-
C:\ProgramData\fUEoQQYA\ukcksYks.exeMD5
c64aea81544ca5e9a1a143b21932b6d1
SHA1393bf58bf444c1d3dba5d4ffd9969223cde1ca0a
SHA256a021621e007468773555510cc943a18c9a5053be88b8947ac2a1c807ee2d2087
SHA512dc7cc10e0ca6b746735401c06d55085107b039aeee2f9708e7a6f2bf6be956c2fe5318f71c1fb64e63070a195eeaf06615b2617b6385a10088fec86a28f8c7c0
-
C:\ProgramData\fUEoQQYA\ukcksYks.exeMD5
c64aea81544ca5e9a1a143b21932b6d1
SHA1393bf58bf444c1d3dba5d4ffd9969223cde1ca0a
SHA256a021621e007468773555510cc943a18c9a5053be88b8947ac2a1c807ee2d2087
SHA512dc7cc10e0ca6b746735401c06d55085107b039aeee2f9708e7a6f2bf6be956c2fe5318f71c1fb64e63070a195eeaf06615b2617b6385a10088fec86a28f8c7c0
-
C:\Users\Admin\AppData\Local\Temp\choco.exeMD5
c258b25b6ec8f09230e272033ad4b2fa
SHA1c4e862d33fe8915818d9e58d428c7324a436f97f
SHA25629f612bb3cc7a9712baaae62b49b0c03a661280b8bf0177b2713a13c016d0b32
SHA51221f7da9bf267f4cb897d9475f8a6f32e6f7e777c3f761b739da4038d44c2786030bc46ab54a8832205d1fb1fe944d7005eb34ddad3700c4c79bcdb932191b90c
-
C:\Users\Admin\AppData\Local\Temp\choco.exeMD5
c258b25b6ec8f09230e272033ad4b2fa
SHA1c4e862d33fe8915818d9e58d428c7324a436f97f
SHA25629f612bb3cc7a9712baaae62b49b0c03a661280b8bf0177b2713a13c016d0b32
SHA51221f7da9bf267f4cb897d9475f8a6f32e6f7e777c3f761b739da4038d44c2786030bc46ab54a8832205d1fb1fe944d7005eb34ddad3700c4c79bcdb932191b90c
-
C:\Users\Admin\ucUUgIsY\amMwQgQA.exeMD5
a9e12201232171a2299f73192c9f6771
SHA1359d34908da3e15d7a4ef175ebcbdfd955d86e01
SHA25631a4bb8d6e0bb0822f48e99bdb9e4ce3b9df30a0bd0d781633816e949b0741e1
SHA5124720d1deca638ff49e487399d1c94912a8bf75dfc6082bf7952e90184f313ff25e4c8b3ea030f3aacaf6b15ad86d843bc6424e0c28337291a35ef4d29da9598e
-
C:\Users\Admin\ucUUgIsY\amMwQgQA.exeMD5
a9e12201232171a2299f73192c9f6771
SHA1359d34908da3e15d7a4ef175ebcbdfd955d86e01
SHA25631a4bb8d6e0bb0822f48e99bdb9e4ce3b9df30a0bd0d781633816e949b0741e1
SHA5124720d1deca638ff49e487399d1c94912a8bf75dfc6082bf7952e90184f313ff25e4c8b3ea030f3aacaf6b15ad86d843bc6424e0c28337291a35ef4d29da9598e
-
memory/584-114-0x0000000000000000-mapping.dmp
-
memory/1192-117-0x0000000000000000-mapping.dmp
-
memory/2196-122-0x0000000000000000-mapping.dmp
-
memory/2532-123-0x0000000000000000-mapping.dmp
-
memory/2576-124-0x0000000000000000-mapping.dmp
-
memory/2576-129-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/2576-131-0x000000001B620000-0x000000001B622000-memory.dmpFilesize
8KB
-
memory/2824-126-0x0000000000000000-mapping.dmp
-
memory/3584-127-0x0000000000000000-mapping.dmp