General

  • Target

    220815-xemgqshcc9_pw_infected.zip

  • Size

    44KB

  • Sample

    220904-1nep2aggd3

  • MD5

    abbacb0337893cda8dadc6517ce4602c

  • SHA1

    0d2538112c5732e0757cf4c034378913d54832c4

  • SHA256

    76a23c2c0f53fd0360b8eb6b6204a46f011a59a4b9e66adc1507da50f8a45c38

  • SHA512

    42c91eab9a3adc52f88ccf018e3849ce791c47e076b79944018c6e4371f67cd336e44cef9f7457080db0bdb6c58935961778216d3b19c6d2c628684039024704

  • SSDEEP

    768:bmr8e4OR3dImEcuW3Mic+eZgTgBRaVTcguNSf6eiO/+MkG1Z/VpgdRZ:Y8eR3dj3Micz2gDatuo/+MXffgDZ

Malware Config

Extracted

Family

arrowrat

Botnet

TY

C2

91.134.207.23:5337

Mutex

DFDFrcvff45thfgh4t44gjahdfhhhhca

Extracted

Path

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{4e498bc7-105a-4838-9874-dcd808cf5910}\0.0.filtertrie.intermediate.txt

Ransom Note
0 0 ~ zoom~ zooming when you pinch with two fingers on the touchpad~ zoom mode~ zoom level~ zoom lens size~ zoom lens settings~ zoom in~ zoom increment~ zoom in:wux:zoom in~ zoom behavior~ zoom amount~ zone~ zones~ zone automatically~ ypdate~ your work or school~ your work or school domain~ your work or school cloud domain~ your windows mixed reality headset goes to sleep~ your wheel~ your voice~ your voice to improve speech services~ your voice to control your pc~ your videos library~ your update history~ your touchpad~ your touchpad to its default settings~ your timeline~ your sound output device~ your sound input device~ your settings~ your restart~ your recovery key~ your quick actions~ your profile~ your product id~ your picture~ your pictures library~ your phone~ your phone to timeline~ your personalization settings~ your pen's pressure sensitivity~ your pen shortcuts~ your pen settings~ your pc~ your pc recognizes your handwriting~ your pc name~ your pc and help you, or offer to help someone else~ your password~ your passwords on this pc~ your organization to manage your pc~ your offline files~ your notifications~ your network properties~ your network adapter~ your mouse~ your mouse to the end of the taskbar~ your mouse settings~ your microphone~ your lock screen background~ your language list~ your language and keyboard settings~ your info~ your homepage~ your hololens~ your headset sleeps~ your handwriting~ your fingertip~ your files with file history~ your eye tracker~ your email~ your drives~ your documents library~ your diagnostic data~ your device~ your device to your work or school domain~ your device to your work or school cloud domain~ your device password-less~ your device history~ your device from your work or school~ your device easier to hear~ your desktop background~ your country or region~ your cortana devices~ your contacts~ your computer~ your computer's status and resolve issues~ your computer's power settings~ your computer's memory problems~ your computer name~ your computer is on~ your cellular data connection with other devices~ your camera~ your call history~ your calendar~ your button flows as quick actions~ your braille display~ your advertising id~ your account~ your account picture~ your account info~ your accent color~ you, or offer to help someone else~ you use windows~ you use three finger taps on the touchpad~ you use the touchpad~ you use the mouse~ you use four finger taps on the touchpad~ you type~ you touch the screen~ you to enter tablet mode~ you tap with two fingers on the touchpad~ you store offline maps~ you speak with your device~ you sign in~ you send to microsoft~ you scroll with the mouse wheel~ you pinch with two fingers on the touchpad~ you open links~ you move your mouse to the end of the taskbar~ you have a 32-bit or 64-bit version of windows~ you drag with two fingers on the touchpad~ you drag three fingers on the touchpad~ you drag four fingers on the touchpad~ you double-tap the spacebar~ you double-tap shift~ you choose a text suggestion~ you can always say "hey cortana"~ you are right or left handed~ xdevice settings~ xbox performance~ xbox one settings~ xbox one controller settings~ xbox networking~ xbox networking settings~ xbox multiplayer settings~ xbox live~ xbox game bar~ x-device settings~ x menu~ wwin~ wwindows~ wwan~ wupdate~ wupdater~ wudo~ wuapp~ wsr~ writing~ write~ write in the handwriting panel with your fingertip~ workspace~ workspace when i remove my pen from storage~ workspace settings~ workplace settings~ workplace policies~ workplace network~ workplace access~ workgroup this computer is on~ workgroup name~ workflow~ work users~ work settings~ work remotely~ work or school~ work or school users~ work or school domain~ work or school cloud domain~ work network~ work hours~ work folders~ work email~ work account~ words~ words as you type~ words as i type~ word echo~ wondows~ wndows~ wndows update~ wlan~ wlan settings~ without sound~ without signing~ with your network adapter~ with your fingertip~ with your device~ with your computer~ with your computer's power settings~ with windows update~ with windows store apps~ with windows search~ with windows powershell in the win + x menu~ with windows mixed reality~ with windows firewall~ with two fingers on the touchpad~ with the touch keyboard~ with the screen when using the mouse~ with the mouse wheel~ with speech~ with shared folders~ with recording sound~ with quickstart~ with printing~ with playing sound~ with playing movies, tv shows, or videos~ with other devices~ with narrator~ with file history~ with directaccess~ with bluetooth devices~ with background downloads~ wireless~ wireless:wux:wireless~ wireless settings~ wireless display~ wireless display settings~ wireless devices on or off~ wireless controller settings~ wireless adapter problems~ wireless adapter issues~ wipe:wux:wipe~ winupdate~ winsows~ winows~ winows update~ winodws~ winodws update~ winf~ windws~ windws update~ windwos update~ windpws~ window~ windowupdate~ windows~ windowsupdate~ windowsupdates~ windows y~ windows x~ windows when i hover over them~ windows welcome notifications~ windows vpn~ windows version~ windows version:wux:windows version~ windows ups~ windows upo~ windows upgrade~ windows updte~ windows updatw~ windows updats~ windows updatre~ windows update~ windows updates~ windows updates:wux:windows updates~ windows updater~ windows updater:wux:windows updater~ windows updated~ windows update troubleshooter~ windows update settings~ windows update settings:wux:windows update settings~ windows update restart settings~ windows update problems~ windows update policies~ windows update options~ windows update not working~ windows update issues~ windows update history~ windows update delivery settings~ windows update delivery optimization~ windows update broken~ windows updare~ windows updae~ windows updaet~ windows upate~ windows upadte~ windows uop~ windows uodate~ windows uip~ windows udpate~ windows udate~ windows u[~ windows track app launches to improve start and search results~ windows to the sides or corners of the screen~ windows to go startup options~ windows to fill available space~ windows system:wux:windows system~ windows sync activities from this pc to the cloud~ windows suggest ease of access settings~ windows subscription~ windows store apps~ windows spotlight~ windows speech recognition~ windows specifications~ windows sonic~ windows show on the taskbar when using virtual desktops~ windows settings~ windows security settings~ windows search~ windows searches~ windows search:wux:windows search~ windows search settings~ windows s mode settings~ windows restore:wux:windows restore~ windows repair:wux:windows repair~ windows recovery:wux:windows recovery~ windows privacy~ windows powershell in the win + x menu~ windows permissions~ windows pdate~ windows password~ windows online personalization gallery~ windows on taskbar on secondary displays~ windows on taskbar on primary display~ windows mr settings~ windows mobility center~ windows mixed reality~ windows mixed reality settings~ windows mixed reality headset goes to sleep~ windows mixed reality audio settings~ windows manage my default printer~ windows logo key + c~ windows license~ windows is activated~ windows insider settings~ windows insider program settings~ windows ink workspace settings~ windows ink settings~ windows information:wux:windows information~ windows indexer~ windows hello~ windows hello:wux:windows hello~ windows hello setup~ windows hello settings~ windows hello pin~ windows hello fingerprint~ windows hello face~ windows hd color settings~ windows firewall~ windows firewall with advanced security~ windows firewall troubleshooter~ windows fire wall~ windows feedback frequency~ windows features on or off~ windows features appear in~ windows edition~ windows display language~ windows disk management~ windows diagnostics~ windows device manager~ windows defender~ windows defender firewall~ windows credentials~ windows credential manager~ windows collect activities from this pc~ windows cant hear me~ windows can't hear me~ windows backup:wux:windows backup~ windows background images~ windows anywhere settings~ windows animation~ windows and tabs appear when pressing alt+tab~ windows activation~ windows activation settings~ windows activate~ windows 8~ windows 8.1~ windows 7~ windows 64~ windows 32~ windows 10 update~ windows 10 updates:wux:windows 10 updates~ windows 10 restarts~ windows + x~ windown~ windowing~ windowes~ windowa update~ window, show what i can snap next to it~ window, resize any adjacent snapped window~ window version:wux:window version~ window update~ window updates~ window transparency~ window sup~ window supdate~ window layout~ window firewall~ window fill~ window features~ window de~ window color~ window arrangement~ windos update~ windoq~ windopws~ windoiws~ windoews~ windoes~ windoes update~ windiws~ windd~ winddows~ wind up~ win-x~ win-v~ win-c~ win+x~ win+v~ win+g~ win+c~ win x~ win update~ win updates~ win plus x~ win plus c~ win c~ win - x~ win - v~ win - c~ win + x menu~ win + v~ win + c~ wimd~ wimdows~ wiin~ wiindows~ wifi~ wifi settings~ width~ widows update~ widnows update~ wider cursor~ wider caret~ wide cursor~ wide caret~ wi-fi~ wi-fi:wux:wi-fi~ wi-fi settings~ wi-fi networks~ wi fi~ why an action can't be performed~ white theme~ white pointer~ white mouse pointer~ white mouse cursor~ white cursor~ while roaming~ while focus assist was on~ which workgroup this computer is on~ which icons appear on the taskbar~ which folders appear on start~ which files and folders are indexed~ which domain your computer is on~ which apps show notifications~ which apps should not be included in sets~ which apps can run in the background~ which apps can make phone calls~ which apps can control radios~ which apps can access your videos library~ which apps can access your pictures library~ which apps can access your notifications~ which apps can access your microphone~ which apps can access your eye tracker~ which apps can access your email~ which apps can access your documents library~ which apps can access your contacts~ which apps can access your camera~ which apps can access your call history~ which apps can access your calendar~ which apps can access your account info~ which apps can access diagnostic information~ which accounts appear in your timeline~ whether you are right or left handed~ whether to have a touchpad delay~ whether to enter tablet mode when you sign in~ whether the system asks you to enter tablet mode~ where you store offline maps~ where to install apps from~ where is the product key~ when your windows mixed reality headset goes to sleep~ when your headset sleeps~ when you use three finger taps on the touchpad~ when you use the touchpad~ when you use the mouse~ when you use four finger taps on the touchpad~ when you touch the screen~ when you tap with two fingers on the touchpad~ when you sign in~ when you pinch with two fingers on the touchpad~ when you move your mouse to the end of the taskbar~ when you drag with two fingers on the touchpad~ when you drag three fingers on the touchpad~ when you drag four fingers on the touchpad~ when you double-tap the spacebar~ when you double-tap shift~ when you choose a text suggestion~ when using virtual desktops~ when using the touchpad~ when using the mouse~ when using repeat keys~ when using captures~ when typing~ when two keys are pressed at the same time~ when turning on sticky, toggle, or filter keys~ when to turn off the screen~ when to turn off the screen when plugged in~ when to turn off the screen on battery power~ when the sticky keys modifier key is pressed~ when the screen is turned off~ when the pc sleeps~ when the pc sleeps when plugged in~ when the pc sleeps on battery power~ when pressing caps lock, num lock, or scroll lock~ when pressing alt+tab~ when possible~ when plugged in~ when pcs try to connect to my mobile device using usb~ when on battery~ when num lock is on~ when navigating~ when narrator is speaking~ when narrator is on~ when my device is locked~ when lighting changes~ when launching an app from another app~ when keys are pressed~ when i’m using my pen~ when it’s available~ when it's pressed twice in a row~ when it's moving~ when i turn on narrator~ when i snap a window, show what i can snap next to it~ when i resize a snapped window, resize any adjacent snapped window~ when i remove my pen from storage~ when i record~ when i record a game~ when i hover over them~ when enabling sticky keys, toggle keys, or filter keys~ when duplicating screen~ when closing tabs~ when apps access my location~ when a mouse is connected~ wheel~ wheels~ wheel vibration settings~ wheel vibrate~ wheel settings~ wheel haptics settings~ wheel defaults~ wheel default settings~ whats new~ what's new~ what windows show on the taskbar when using virtual desktops~ what windows and tabs appear when pressing alt+tab~ what version of windows do i have:wux:what version of windows do i have~ what is my computer name:wux:what is my computer name~ what i missed while focus assist was on~ what i can snap next to it~ what happens when you use three finger taps on the touchpad~ what happens when you use four finger taps on the touchpad~ what happens when you drag three fingers on the touchpad~ what happens when you drag four fingers on the touchpad~ what cortana can do, see, and use~ what closing the lid does~ what appears when pressing alt+tab~ what appears when launching an app from another app~ wfi~ well your pc recognizes your handwriting~ welcome screen~ welcome screen settings~ welcome notifications~ website~ websites~ websites can use your language list~ website apps~ weblinks~ webcame~ webcam:wux:webcam~ webcam settings~ webcam privacy~ webcam permissions~ web to app link~ web to app linking~ web pages are displayed in tabs~ web links~ web language~ web languages~ web credentials~ web content control~ web cam:wux:web cam~ web browser~ web browsers~ web browser settings~ web apps~ ways i can set up my device to get the most out of windows~ way measurements are displayed~ way currency is displayed~ was on~ warn~ warning~ warnings~ wallpaper~ wallpaper sync~ wallpaper settings~ wait for second keystroke~ wait for repeated keystrokes~ wait for new keystrokes~ wait for keystrokes~ wait for different keystrokes~ wait before accepting keystrokes~ w up~ vpnm~ vpn while roaming~ vpn settings~ vpn over metered networks~ vpn options~ vpn connection~ vpn advanced settings~ vpn advanced options~ vpmn~ volume~ volume settings~ volume of other apps when narrator is speaking~ volume mixer~ volume mixer:wux:volume mixer~ volume level~ volume control~ voice~ voices~ voiceover~ voice volume~ voice tone~ voice to improve speech services~ voice to control your pc~ voice timbre~ voice timber~ voice speed~ voice settings~ voice rate~ voice quality~ voice pitch~ voice for apps~ voice emphasize formatted text~ voice dictation~ voice data~ voice control~ voice agents~ voice agent settings~ voice activation settings~ voice activation privacy settings~ voice activation permissions~ vlue~ vivid~ visual~ visuals~ visual quality of windows mixed reality~ visual feedback when you touch the screen~ visual feedback touch settings~ visual feedback pen settings~ visual feedback on or off~ visual display~ visual cursor for narrator~ visual alerts for audio notifications~ visual alert for audio notifications~ vision~ vision settings~ visible alerts~ virus~ virtual private networks~ virtual private network settings~ virtual desktop~ virtual desktops~ virtual desktop settings~ view~ viewer

Targets

    • Target

      8573d9e75f2c0ef4e69023fc07bee9cb.exe

    • Size

      91KB

    • MD5

      8573d9e75f2c0ef4e69023fc07bee9cb

    • SHA1

      4f3afbab31505056fd71f462bd52f98f3dd9f8ff

    • SHA256

      e5d590f782337416fe7f93aa7f488419f86802500d05ef2fced4ccca7f4e14ae

    • SHA512

      11bbaa8c41989d583ca1af59d8c51b80825634807dfcd8fc50f5e8d3190d224ca48139f70e10a2993b9ae1bca599ee0dd1422af5c716f5441c533c1dedef72e7

    • SSDEEP

      1536:dbRiQM/57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33B:dbRE57SKsstcnZTJQDgWPaySsdH5x

    • ArrowRat

      Remote access tool with various capabilities first seen in late 2021.

    • Modifies Installed Components in the registry

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks