Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20/10/2022, 22:53
General
-
Target
5a323ac8f68192c38a384436e9cc48807af358881bc3d584b3b259f671d9e87b.exe
-
Size
45KB
-
MD5
4f0ba6690bbacc38c924108e9280e6de
-
SHA1
4d504f36e3770573686623bd6109c0148443a18c
-
SHA256
5a323ac8f68192c38a384436e9cc48807af358881bc3d584b3b259f671d9e87b
-
SHA512
f1653edb42ef3976c9cfc961067b83dbe384e4cd3ce09fbcd8e4c693ab5825a7bf1f8110fc597e88edc7708a1fd97a550d9ad5216649df4285d7b3e4517cb6df
-
SSDEEP
768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXR:EOxyeFo6NPCAosxYyXdF5oy3VoKR
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
-
Executes dropped EXE 12 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s) 1 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 29 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 21 IoCs
-
Suspicious use of WriteProcessMemory 44 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a323ac8f68192c38a384436e9cc48807af358881bc3d584b3b259f671d9e87b.exe"C:\Users\Admin\AppData\Local\Temp\5a323ac8f68192c38a384436e9cc48807af358881bc3d584b3b259f671d9e87b.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\userinit.exeC:\Windows\system32\userinit.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Explorer.exeExplorer.exe "C:\recycled\SVCHOST.exe"4⤵
-
-
-
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5a323ac8f68192c38a384436e9cc48807af358881bc3d584b3b259f671d9e87b.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD57895496ec6f59ee93a4eea469fd342a7
SHA1cae679f95fe5adc1bb545c143c969bc4ed0e438e
SHA25631aa23f5ca35ffbab867b4c36ce922bc82cd16a012efab686609ff0711a8c8eb
SHA5126d5329ffbd18858f8226c2d58c911dfc5ab74a8c1519327b77a92c52169d7b11ca994e3b5c259f4e589dcd295bed1b2df5debef1ad63b7f79958428f1a1db82a
-
Filesize
45KB
MD57895496ec6f59ee93a4eea469fd342a7
SHA1cae679f95fe5adc1bb545c143c969bc4ed0e438e
SHA25631aa23f5ca35ffbab867b4c36ce922bc82cd16a012efab686609ff0711a8c8eb
SHA5126d5329ffbd18858f8226c2d58c911dfc5ab74a8c1519327b77a92c52169d7b11ca994e3b5c259f4e589dcd295bed1b2df5debef1ad63b7f79958428f1a1db82a
-
Filesize
45KB
MD57895496ec6f59ee93a4eea469fd342a7
SHA1cae679f95fe5adc1bb545c143c969bc4ed0e438e
SHA25631aa23f5ca35ffbab867b4c36ce922bc82cd16a012efab686609ff0711a8c8eb
SHA5126d5329ffbd18858f8226c2d58c911dfc5ab74a8c1519327b77a92c52169d7b11ca994e3b5c259f4e589dcd295bed1b2df5debef1ad63b7f79958428f1a1db82a
-
Filesize
45KB
MD57895496ec6f59ee93a4eea469fd342a7
SHA1cae679f95fe5adc1bb545c143c969bc4ed0e438e
SHA25631aa23f5ca35ffbab867b4c36ce922bc82cd16a012efab686609ff0711a8c8eb
SHA5126d5329ffbd18858f8226c2d58c911dfc5ab74a8c1519327b77a92c52169d7b11ca994e3b5c259f4e589dcd295bed1b2df5debef1ad63b7f79958428f1a1db82a
-
Filesize
45KB
MD5668faf5581b39115537e326c2632c9af
SHA1e1a4246576e1cdf2bea742d20b9a7e4f209d93e0
SHA256513c0630d1739b6c3a52f2399c3c3ab5f9ef1ab98b05c3e378034ccd48bcb0f9
SHA512861778f4c80ad237a5ab0cc27eeace87aa195a82ef7a3462955155aaed179b4d41bc76c220e9a0035e3720a1d8aa0e4354541bfcf05df17b2027707872661b0c
-
Filesize
45KB
MD5668faf5581b39115537e326c2632c9af
SHA1e1a4246576e1cdf2bea742d20b9a7e4f209d93e0
SHA256513c0630d1739b6c3a52f2399c3c3ab5f9ef1ab98b05c3e378034ccd48bcb0f9
SHA512861778f4c80ad237a5ab0cc27eeace87aa195a82ef7a3462955155aaed179b4d41bc76c220e9a0035e3720a1d8aa0e4354541bfcf05df17b2027707872661b0c
-
Filesize
45KB
MD5668faf5581b39115537e326c2632c9af
SHA1e1a4246576e1cdf2bea742d20b9a7e4f209d93e0
SHA256513c0630d1739b6c3a52f2399c3c3ab5f9ef1ab98b05c3e378034ccd48bcb0f9
SHA512861778f4c80ad237a5ab0cc27eeace87aa195a82ef7a3462955155aaed179b4d41bc76c220e9a0035e3720a1d8aa0e4354541bfcf05df17b2027707872661b0c
-
Filesize
45KB
MD5668faf5581b39115537e326c2632c9af
SHA1e1a4246576e1cdf2bea742d20b9a7e4f209d93e0
SHA256513c0630d1739b6c3a52f2399c3c3ab5f9ef1ab98b05c3e378034ccd48bcb0f9
SHA512861778f4c80ad237a5ab0cc27eeace87aa195a82ef7a3462955155aaed179b4d41bc76c220e9a0035e3720a1d8aa0e4354541bfcf05df17b2027707872661b0c
-
Filesize
45KB
MD54ff61eccbcd8085f764adfbef22e6b72
SHA111fef70d484099a0d1c467f0c1703824d5bd8c6a
SHA256b72f869ca51be022121dd9848f14a6bf1495dba4c934c437b963fa9658f8e7d5
SHA512f424c4dc991bdf4ccf8249b451b2c806d8b7f1bcf4b792be043cb5c40822fb0ce949a0c3102fcae6e8497266903283d544ba4834fbe30ace65de889c11463ed6
-
Filesize
45KB
MD54ff61eccbcd8085f764adfbef22e6b72
SHA111fef70d484099a0d1c467f0c1703824d5bd8c6a
SHA256b72f869ca51be022121dd9848f14a6bf1495dba4c934c437b963fa9658f8e7d5
SHA512f424c4dc991bdf4ccf8249b451b2c806d8b7f1bcf4b792be043cb5c40822fb0ce949a0c3102fcae6e8497266903283d544ba4834fbe30ace65de889c11463ed6
-
Filesize
45KB
MD54ff61eccbcd8085f764adfbef22e6b72
SHA111fef70d484099a0d1c467f0c1703824d5bd8c6a
SHA256b72f869ca51be022121dd9848f14a6bf1495dba4c934c437b963fa9658f8e7d5
SHA512f424c4dc991bdf4ccf8249b451b2c806d8b7f1bcf4b792be043cb5c40822fb0ce949a0c3102fcae6e8497266903283d544ba4834fbe30ace65de889c11463ed6
-
Filesize
45KB
MD54ff61eccbcd8085f764adfbef22e6b72
SHA111fef70d484099a0d1c467f0c1703824d5bd8c6a
SHA256b72f869ca51be022121dd9848f14a6bf1495dba4c934c437b963fa9658f8e7d5
SHA512f424c4dc991bdf4ccf8249b451b2c806d8b7f1bcf4b792be043cb5c40822fb0ce949a0c3102fcae6e8497266903283d544ba4834fbe30ace65de889c11463ed6
-
Filesize
65B
MD5ad0b0b4416f06af436328a3c12dc491b
SHA1743c7ad130780de78ccbf75aa6f84298720ad3fa
SHA25623521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416
SHA512884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
1KB
MD50269b6347e473980c5378044ac67aa1f
SHA1c3334de50e320ad8bce8398acff95c363d039245
SHA25668f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2
SHA512e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b
-
Filesize
2B
MD52b9d4fa85c8e82132bde46b143040142
SHA1a02431cf7c501a5b368c91e41283419d8fa9fb03
SHA2564658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142
SHA512c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be
-
Filesize
45KB
MD57895496ec6f59ee93a4eea469fd342a7
SHA1cae679f95fe5adc1bb545c143c969bc4ed0e438e
SHA25631aa23f5ca35ffbab867b4c36ce922bc82cd16a012efab686609ff0711a8c8eb
SHA5126d5329ffbd18858f8226c2d58c911dfc5ab74a8c1519327b77a92c52169d7b11ca994e3b5c259f4e589dcd295bed1b2df5debef1ad63b7f79958428f1a1db82a
-
Filesize
45KB
MD5668faf5581b39115537e326c2632c9af
SHA1e1a4246576e1cdf2bea742d20b9a7e4f209d93e0
SHA256513c0630d1739b6c3a52f2399c3c3ab5f9ef1ab98b05c3e378034ccd48bcb0f9
SHA512861778f4c80ad237a5ab0cc27eeace87aa195a82ef7a3462955155aaed179b4d41bc76c220e9a0035e3720a1d8aa0e4354541bfcf05df17b2027707872661b0c
-
Filesize
45KB
MD54ff61eccbcd8085f764adfbef22e6b72
SHA111fef70d484099a0d1c467f0c1703824d5bd8c6a
SHA256b72f869ca51be022121dd9848f14a6bf1495dba4c934c437b963fa9658f8e7d5
SHA512f424c4dc991bdf4ccf8249b451b2c806d8b7f1bcf4b792be043cb5c40822fb0ce949a0c3102fcae6e8497266903283d544ba4834fbe30ace65de889c11463ed6
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB