Analysis

  • max time kernel
    37s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 02:02

General

  • Target

    d6eb2aa7073347eb2e2945dde3060989d6c1236d2cb9004e4b890963f2ac3091.exe

  • Size

    255KB

  • MD5

    56d4d2d9375e2130d5dd72f84f82c311

  • SHA1

    cfc2258551d49bd5f239664532ec2cb8b1a8b95e

  • SHA256

    d6eb2aa7073347eb2e2945dde3060989d6c1236d2cb9004e4b890963f2ac3091

  • SHA512

    7c7d367042f48fc3a3b525cb4088f97276f566fe9f1367d7d6502382efb91ce6462e92d3a5b62b723f089a998a0d105a598b32742f8125c9230dfe28c9ba1a42

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJR:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIq

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 3 IoCs
  • Windows security modification 2 TTPs 6 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in System32 directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6eb2aa7073347eb2e2945dde3060989d6c1236d2cb9004e4b890963f2ac3091.exe
    "C:\Users\Admin\AppData\Local\Temp\d6eb2aa7073347eb2e2945dde3060989d6c1236d2cb9004e4b890963f2ac3091.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\SysWOW64\avcfubnkzt.exe
      avcfubnkzt.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Modifies WinLogon
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1532
      • C:\Windows\SysWOW64\kxxhwxbc.exe
        C:\Windows\system32\kxxhwxbc.exe
        3⤵
          PID:392
      • C:\Windows\SysWOW64\qrbwjhaqkeala.exe
        qrbwjhaqkeala.exe
        2⤵
          PID:764
        • C:\Windows\SysWOW64\kxxhwxbc.exe
          kxxhwxbc.exe
          2⤵
            PID:960
          • C:\Windows\SysWOW64\vgzvlmwscezwykg.exe
            vgzvlmwscezwykg.exe
            2⤵
            • Executes dropped EXE
            PID:1648
          • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
            "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
            2⤵
              PID:820

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\SysWOW64\avcfubnkzt.exe

                  Filesize

                  57KB

                  MD5

                  d8b6d922677a81601b287e9a523dddac

                  SHA1

                  6684bdae989343e131fc8ce986e9e4bbd6c1ff09

                  SHA256

                  d259fa307e64ece0c0fcf58a0b5849c0c029c2af7a338c3f49b233a4cfb1c9bd

                  SHA512

                  2ec9c1b3d9d0e00254950845d3d23c87e832bcc0248269166a3ab2a583b5b94b07def937f82e2b4b959051a57ec34666d21ffb1354268cc75573167239f5d944

                • C:\Windows\SysWOW64\avcfubnkzt.exe

                  Filesize

                  37KB

                  MD5

                  d552f78deb9cb7be5821d16959a02f09

                  SHA1

                  9adc69b6baf964d61a838da0009095b616d35d18

                  SHA256

                  2a697d87cde1e429016935ba1ae732e44d4a5f4428eb35078bb44879e86aeb1b

                  SHA512

                  254078f7eae3ccc9915c9c36edf35812396de030d9503e3af67470253603a60bc953297c39ff6aad0d93f6c5732ac7a27d666881e06e0ea9c51b987f644e7d03

                • C:\Windows\SysWOW64\kxxhwxbc.exe

                  Filesize

                  32KB

                  MD5

                  81043ad75db2ff1d7aad7f7ceeae7696

                  SHA1

                  6393abd7c8c7ec36eac77b77118dd7739499a8e0

                  SHA256

                  c2421d56cf57cf9989da4cdfd0f688538b1f78924ffd3719a507114f92ddcf25

                  SHA512

                  8af5122afa4ecff1bde1fa51ab62a529599074a83ba398cc56cf8c7e02184e2cc02457c5e58dc9e4deecfa11943dadc1798f22075a1e207ca16dd3385446ff8a

                • C:\Windows\SysWOW64\kxxhwxbc.exe

                  Filesize

                  22KB

                  MD5

                  2e330e880e19679c7b9f46e5eb564ba6

                  SHA1

                  701e42b2e10f4325cda7fc4b41b9a551259da61d

                  SHA256

                  cd1d83caba8a801ee794cd74658024b8fc8fbf94465898b92a70f75bb2e0c233

                  SHA512

                  f59dead6bf57f79f107aa138cd40bd132a17910ac0a47f9589d22868d932c5934fb7e1bb366b5fc4aab2b7539216086fbf376bb254e00d47dcbf99019e1eee78

                • C:\Windows\SysWOW64\kxxhwxbc.exe

                  Filesize

                  34KB

                  MD5

                  58ffa14fcfa627f7770f1831205a4525

                  SHA1

                  e58b60ac4e59562d7664b217d5d34916ace3c125

                  SHA256

                  682bf0bae1dff84dab2ee4c9f398e28a45b4b8f23b6bf628e34d3b4c8777b9d2

                  SHA512

                  df99c0c3ff69c79cb219592c2182c3be9a7e6ae52b6119b207397978e064994259ee82f386216b2222287ea125eb5fca4d396e89c25a01b19b9f846a18050eaf

                • C:\Windows\SysWOW64\qrbwjhaqkeala.exe

                  Filesize

                  41KB

                  MD5

                  444682a903cd575c0c659c0c8252cb42

                  SHA1

                  e76780303849d98ece47f681fb65d14bb4f39fcd

                  SHA256

                  44bc8c70eb54ed665b9ee419b9dd6e1d9fcf1623cdafdd1ed4a639f25dd1fa7a

                  SHA512

                  f335e913ad5b93f9bf99ee7af2d85b832ad5db4ff06ea3cd8fe645289dc6e494c8b04ae55d5195f57cdf39f19d48622b9767879d1451a8543b1a48ece48a0019

                • C:\Windows\SysWOW64\qrbwjhaqkeala.exe

                  Filesize

                  31KB

                  MD5

                  6ff2a7c37a47f6ef843f1bbd8b0aed4d

                  SHA1

                  71821862efcd6a64dcd2115b57ad19b0529ef715

                  SHA256

                  32ceb513502ef3d33295df3d642524575d10a241f883c01211473a060e353d5d

                  SHA512

                  8daf55b12529bb6f891a787ff0f16d9e76208c7bb30edda8fafe9c98ae2cddee1f9deeb8196c58f8f2379f87241661d7252f450a42899d286340872eb5729a39

                • C:\Windows\SysWOW64\vgzvlmwscezwykg.exe

                  Filesize

                  48KB

                  MD5

                  32760de89400557f3d02d8b30f775be4

                  SHA1

                  21f91c2bf55d5fcb2532eb9f201e3ec4ea4025b9

                  SHA256

                  c71a0df1f95df6cb3894112b735cc01eebef86d2e11193d35522c2a4b82aefba

                  SHA512

                  68269bca90648c059abac2f5725ea2d17a109e09a60cd6779bf72bbf858610699af69cbb0df2a469dac04e5d08a047aee1e35347555331aa4396d3274350eb65

                • C:\Windows\SysWOW64\vgzvlmwscezwykg.exe

                  Filesize

                  24KB

                  MD5

                  558eb9a3ff224ce83f2d920a778e6eed

                  SHA1

                  0242ad966dd44aaa593b1a3acf3427085e2fe3bd

                  SHA256

                  f1c83d7bfd2cc3648ee3b3d7a2a7467e65bd54817633b6c66bc2ce4a7968badf

                  SHA512

                  ebe3387ce850672cc36dc5f6b46b793b3f1a20e977f5378fd7745ce3ad891ee7ba93762b0e29fc9a0f1e0e9075e542ada52aecd8e557d8e533e5e987c11b422a

                • \Windows\SysWOW64\avcfubnkzt.exe

                  Filesize

                  27KB

                  MD5

                  76c24f8bc57e7f411984c4ecbfba8276

                  SHA1

                  9c2a1e0c3e0f574890a11fb0690d64af2877f2c3

                  SHA256

                  39f0be7b3f0649beae8608da5a40c6c3b07c58d735948928c245b95c6ca8cc9b

                  SHA512

                  96aeb206291df0763d85f3939bc66fa197633ba6d94ee2038aa0cfccfe21ee357896d616f60667e58c7968ded07615bb34fee82e0277454b8ba17ea85d6c74fc

                • \Windows\SysWOW64\kxxhwxbc.exe

                  Filesize

                  22KB

                  MD5

                  5d5bfcb43bcf3ead077f1156759e32eb

                  SHA1

                  7c4b39b54a08048b61222e3af8d44652d62050d5

                  SHA256

                  7a7e993ba54913a4d9f56be731d8ca359d7e282efe44dfba730112c4ccf6f6e4

                  SHA512

                  e647a1b08c87b61608d3944f5fbae365017bd584ed092836cf17af1ab4489f4acd9f157669cb05f46662c591f3bcfa5489e63972bcba37a163fa6c84a384379b

                • \Windows\SysWOW64\kxxhwxbc.exe

                  Filesize

                  19KB

                  MD5

                  d864c6d7b1647ccbcacc5f960e88e035

                  SHA1

                  fdda001ff638ad26035916716c3cbd66a5a0cb9d

                  SHA256

                  b6de72e71161a8e483761abb9d271da238b89096a186be95f391adbf12d25e8c

                  SHA512

                  de0c99898b456e322daf2befb733ccbaeb202f220adf00a4cccb1a2004ccba503fac2ed522dd1b4453ca0bf47f40b55caa9d36da9e46f00c26b828dc92faad06

                • \Windows\SysWOW64\qrbwjhaqkeala.exe

                  Filesize

                  47KB

                  MD5

                  b0c5a337e535ba98aefe8b3ec7d1b079

                  SHA1

                  05d112f877b0b41ab342b11d0e5a381864d0cc57

                  SHA256

                  bd60172d0ffcb5ac13bd244de41f70ec4f75b271febbfba915500f8249b4e748

                  SHA512

                  b036e71b75c63c5b3e34dc114ffe81c771d704fb48c1b9c8edec5c48b1e29b59dfd61f41519a8b7904c2ae5dd603d751512de7182a620cd1563a8baffb7ae35d

                • \Windows\SysWOW64\vgzvlmwscezwykg.exe

                  Filesize

                  56KB

                  MD5

                  867d7ae0498eb4505b460f524efaf1f1

                  SHA1

                  5f3f72df38685dffef305a0add8879671d515b8e

                  SHA256

                  638318c6488c1a8d2aa24a75ed7af8260c587c1d0ed8d78913b922960cc49cb4

                  SHA512

                  2f93bb3731170dff60e308474d571de8b28a74b6550bfcd2feb8295be47a49c38cadb122157aadb4229a005a86fbd265ad603606d43c935f969c44233947ce95

                • memory/392-85-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/392-94-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/764-93-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/764-84-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/820-95-0x000000005FFF0000-0x0000000060000000-memory.dmp

                  Filesize

                  64KB

                • memory/820-89-0x0000000070181000-0x0000000070183000-memory.dmp

                  Filesize

                  8KB

                • memory/820-88-0x0000000072701000-0x0000000072704000-memory.dmp

                  Filesize

                  12KB

                • memory/960-92-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/960-83-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/1532-81-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/1532-90-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/1648-82-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/1648-91-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/1668-87-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/1668-54-0x0000000075201000-0x0000000075203000-memory.dmp

                  Filesize

                  8KB

                • memory/1668-55-0x0000000000400000-0x00000000004A0000-memory.dmp

                  Filesize

                  640KB

                • memory/1668-80-0x0000000003330000-0x00000000033D0000-memory.dmp

                  Filesize

                  640KB