Analysis

  • max time kernel
    155s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 21:35

General

  • Target

    9e0564beb8057e1f666c2cb5918e8961875f9a2fe13c945c19cca6d30c8761b6.exe

  • Size

    255KB

  • MD5

    02ae9753ce806ffeb5ce51acafbecba1

  • SHA1

    9348aeb1b26556db5de9f94fd2931615c8cef86b

  • SHA256

    9e0564beb8057e1f666c2cb5918e8961875f9a2fe13c945c19cca6d30c8761b6

  • SHA512

    0cbed35394f4b81bb56dbda507ad548cba5097665df4acb7440f4332d5d2faf619b9ea4d415b5fdf3dc1449045f064e69b67462ff5208ca8dd153a700ae25e97

  • SSDEEP

    6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI6l:Plf5j6zCNa0xeE3my

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e0564beb8057e1f666c2cb5918e8961875f9a2fe13c945c19cca6d30c8761b6.exe
    "C:\Users\Admin\AppData\Local\Temp\9e0564beb8057e1f666c2cb5918e8961875f9a2fe13c945c19cca6d30c8761b6.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\SysWOW64\dknfmokczg.exe
      dknfmokczg.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Windows\SysWOW64\txpmnkxl.exe
        C:\Windows\system32\txpmnkxl.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:860
    • C:\Windows\SysWOW64\kjaxvlulopkmpom.exe
      kjaxvlulopkmpom.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4928
    • C:\Windows\SysWOW64\txpmnkxl.exe
      txpmnkxl.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4896
    • C:\Windows\SysWOW64\kbxefqplduoms.exe
      kbxefqplduoms.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:376
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:548

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    255KB

    MD5

    c4bd88e13b4ea4f2de6bcbfb09e28460

    SHA1

    19c2b8493fda68c49e4230f572539dafb9aa6eaa

    SHA256

    650d5b413612b4b31ba834d3fd6885a6a709a65d41aa6f50694f7c351577d469

    SHA512

    1a0cb7dba6fc75073a3e7838c8b3bfb96c2f0f611bf56586a49eb854ba03ca2e013b9b87bfa17aa5863bda1e0e3574208c4db4ef50102a575359a48845f4f421

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    255KB

    MD5

    c68b7af7be1d40089fec76d63f47d436

    SHA1

    3dfc89f8b67af2d54bdd459cc5698d12d3378809

    SHA256

    f66e5d130c39f6a05341b68ff5b871723de2ad2f1c185fc53a99c94205cbd769

    SHA512

    ecef58f01cc544db1322fdbaa4ab0009a01454d33c3895b5c10c5bbd0687f75f72f36e16ea13f51bcdae03ce23585cc1431ddb9e88c177d4c9444428829f16de

  • C:\Windows\SysWOW64\dknfmokczg.exe

    Filesize

    255KB

    MD5

    caa2ba0e4567f484df86b788cdbd3a24

    SHA1

    72c0e70becbed0b94705065ed0938acd61e85f4a

    SHA256

    09493b4d2f86b2499a06dc1b627f9498c2b8699d244fdda880fee92cbe7feba9

    SHA512

    e26d9dab987fd47c5b539bfdbc6c444a161156244fdfba2a7230e3a515e9c299f37fc6e8ddbd55c21d0a7c48bc7c9bdfe302ea0592269ce69e59ab2b3fe83436

  • C:\Windows\SysWOW64\dknfmokczg.exe

    Filesize

    255KB

    MD5

    caa2ba0e4567f484df86b788cdbd3a24

    SHA1

    72c0e70becbed0b94705065ed0938acd61e85f4a

    SHA256

    09493b4d2f86b2499a06dc1b627f9498c2b8699d244fdda880fee92cbe7feba9

    SHA512

    e26d9dab987fd47c5b539bfdbc6c444a161156244fdfba2a7230e3a515e9c299f37fc6e8ddbd55c21d0a7c48bc7c9bdfe302ea0592269ce69e59ab2b3fe83436

  • C:\Windows\SysWOW64\kbxefqplduoms.exe

    Filesize

    255KB

    MD5

    7341855733f690b4bbf8ee4301f325ce

    SHA1

    6251c6d04fd35e3b3554a58849b05fb1c31b7353

    SHA256

    76db14363d5f879e2e269a6704246cd39a34ba0a7dcfa92809c220295eb6ebd0

    SHA512

    dbf869ab48ad36e7dc2b51181b3fbe06c1edc5147f8098a3fdfbe563f2b2b4ac55c9d91aa1ce4d3130a8e3215f1aba4824a29df7860814c9d93af72b5f44ba82

  • C:\Windows\SysWOW64\kbxefqplduoms.exe

    Filesize

    255KB

    MD5

    7341855733f690b4bbf8ee4301f325ce

    SHA1

    6251c6d04fd35e3b3554a58849b05fb1c31b7353

    SHA256

    76db14363d5f879e2e269a6704246cd39a34ba0a7dcfa92809c220295eb6ebd0

    SHA512

    dbf869ab48ad36e7dc2b51181b3fbe06c1edc5147f8098a3fdfbe563f2b2b4ac55c9d91aa1ce4d3130a8e3215f1aba4824a29df7860814c9d93af72b5f44ba82

  • C:\Windows\SysWOW64\kjaxvlulopkmpom.exe

    Filesize

    255KB

    MD5

    5002c9e146901de423b9a6f778610344

    SHA1

    346889ee7bfffa5f5320e589f87ad9fd113783cd

    SHA256

    680b5a5a9faecf6aca39c9a755d56af6040d1dd7de7152a8ddf72b5720a802b0

    SHA512

    734c9cc4660b42d87f4cd7b439c9531435a0e0902253deb6c3b428637cd12f6a0d0fc708b5c33d12f796994dc111da633ee5af6666e713ac0aae9c5e20a3623d

  • C:\Windows\SysWOW64\kjaxvlulopkmpom.exe

    Filesize

    255KB

    MD5

    5002c9e146901de423b9a6f778610344

    SHA1

    346889ee7bfffa5f5320e589f87ad9fd113783cd

    SHA256

    680b5a5a9faecf6aca39c9a755d56af6040d1dd7de7152a8ddf72b5720a802b0

    SHA512

    734c9cc4660b42d87f4cd7b439c9531435a0e0902253deb6c3b428637cd12f6a0d0fc708b5c33d12f796994dc111da633ee5af6666e713ac0aae9c5e20a3623d

  • C:\Windows\SysWOW64\txpmnkxl.exe

    Filesize

    255KB

    MD5

    8a093bd1aea05cc83b7b4b3fc9cc172d

    SHA1

    e8ee5e3b19afdf1110c225ee1f906cc2b34925c3

    SHA256

    9dcebb89aa05e0c516043a1eb3beb796267819588e2aae9b22e8a50c7176a3ac

    SHA512

    86f370c869a1897f0d357416c1d264d23caacb7ebab963a0cf946f018c7767b176b41608d530304c46fc8b6676d86b417628ccce2a5700013f9cbbf271729459

  • C:\Windows\SysWOW64\txpmnkxl.exe

    Filesize

    255KB

    MD5

    8a093bd1aea05cc83b7b4b3fc9cc172d

    SHA1

    e8ee5e3b19afdf1110c225ee1f906cc2b34925c3

    SHA256

    9dcebb89aa05e0c516043a1eb3beb796267819588e2aae9b22e8a50c7176a3ac

    SHA512

    86f370c869a1897f0d357416c1d264d23caacb7ebab963a0cf946f018c7767b176b41608d530304c46fc8b6676d86b417628ccce2a5700013f9cbbf271729459

  • C:\Windows\SysWOW64\txpmnkxl.exe

    Filesize

    255KB

    MD5

    8a093bd1aea05cc83b7b4b3fc9cc172d

    SHA1

    e8ee5e3b19afdf1110c225ee1f906cc2b34925c3

    SHA256

    9dcebb89aa05e0c516043a1eb3beb796267819588e2aae9b22e8a50c7176a3ac

    SHA512

    86f370c869a1897f0d357416c1d264d23caacb7ebab963a0cf946f018c7767b176b41608d530304c46fc8b6676d86b417628ccce2a5700013f9cbbf271729459

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    255KB

    MD5

    6f2ddf24dbe404ba94a7baaf9c7be923

    SHA1

    1a8da2eee6121a59ce4bea73a8266958ae163caa

    SHA256

    e3ff57f8fa61adca0298a40dcd3e6216a78515e6a09d69c5f6950f4f72ad69c1

    SHA512

    cd1854c3d2ac24cd3d1f342247589392a0bc213b6a1999b6bca857d86f9e4b0cf2729ab786b07799a8ba4391be456651d916d7e38704459d62c546b7fd680fb5

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    255KB

    MD5

    6f2ddf24dbe404ba94a7baaf9c7be923

    SHA1

    1a8da2eee6121a59ce4bea73a8266958ae163caa

    SHA256

    e3ff57f8fa61adca0298a40dcd3e6216a78515e6a09d69c5f6950f4f72ad69c1

    SHA512

    cd1854c3d2ac24cd3d1f342247589392a0bc213b6a1999b6bca857d86f9e4b0cf2729ab786b07799a8ba4391be456651d916d7e38704459d62c546b7fd680fb5

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    255KB

    MD5

    6f2ddf24dbe404ba94a7baaf9c7be923

    SHA1

    1a8da2eee6121a59ce4bea73a8266958ae163caa

    SHA256

    e3ff57f8fa61adca0298a40dcd3e6216a78515e6a09d69c5f6950f4f72ad69c1

    SHA512

    cd1854c3d2ac24cd3d1f342247589392a0bc213b6a1999b6bca857d86f9e4b0cf2729ab786b07799a8ba4391be456651d916d7e38704459d62c546b7fd680fb5

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    255KB

    MD5

    58fd4975f3f9919763800ce3a518d492

    SHA1

    876a089c68f9583e957eb089809d81226c5492f0

    SHA256

    fc5bc5593432abb2905199920e360af738bcc2e08907fee108daf7b56121fab8

    SHA512

    fc196a80959d936431991a76a200dd6ecc89e973e41f6920e3edad738e942b48b9a794fdbf7c3421d931b95c0d31b6dc58803d8478c54cae621ab56861842dab

  • memory/376-150-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/376-167-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/548-159-0x00007FFBF8150000-0x00007FFBF8160000-memory.dmp

    Filesize

    64KB

  • memory/548-175-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-177-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-154-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-155-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-156-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-157-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-158-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-176-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-174-0x00007FFBFA950000-0x00007FFBFA960000-memory.dmp

    Filesize

    64KB

  • memory/548-162-0x00007FFBF8150000-0x00007FFBF8160000-memory.dmp

    Filesize

    64KB

  • memory/860-151-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/860-168-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2376-132-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/2376-153-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4896-166-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4896-144-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4928-165-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/4928-143-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/5012-164-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB

  • memory/5012-142-0x0000000000400000-0x00000000004A0000-memory.dmp

    Filesize

    640KB