Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 18:47
General
-
Target
f7e954a22d334f570d2655c6cecc4da5d3145be43c7f164ad5dd0fb2bf0ca10b.exe
-
Size
255KB
-
MD5
47b28358635e42864407a315aed96966
-
SHA1
22d919bb411005554c8beb8d7b7eb8ccb0dea863
-
SHA256
f7e954a22d334f570d2655c6cecc4da5d3145be43c7f164ad5dd0fb2bf0ca10b
-
SHA512
3e9baed8969d2cf25b5ee209bab0574163c55ef63321219d8c7172344ec0337355fdd699eb50d81c39a332f1acf1b43c48277889eda1e153cc37006dfc35aef7
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ1:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI8
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7e954a22d334f570d2655c6cecc4da5d3145be43c7f164ad5dd0fb2bf0ca10b.exe"C:\Users\Admin\AppData\Local\Temp\f7e954a22d334f570d2655c6cecc4da5d3145be43c7f164ad5dd0fb2bf0ca10b.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zvwmlkakgp.exezvwmlkakgp.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\aticuodf.exeC:\Windows\system32\aticuodf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\vizgixfhruilcwo.exevizgixfhruilcwo.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\aticuodf.exeaticuodf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\bdaipkxradlwl.exebdaipkxradlwl.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5c2aa72d5860af8cf6d3d853a9e6f8df3
SHA11264447a068bd71108d8fb2db0d383def7738cb3
SHA256e8b92a89a024ce2d322ec3617fb874f8371b2fbd3f3e2dc6e126fcb204367ea6
SHA512163b33f295dde8a2423f2384ff52cbae0b803b95ffb6490408573b0e2fee8764358899d15e46f102743cf2e144e08b97dea63b575000dd1858923589bf2ebc8b
-
Filesize
255KB
MD52bcdfdb19702f62a699c20fd33e20842
SHA123ce9a73c7828483149bea82f252190e0e265009
SHA256fc1284cd78e9f5751478e19192d17f5947a6b7d39bd63b3b8de5e58c9814f179
SHA5126e153cdb27a2cb192e2e3f44757f6c8531e9062685e079980af975eb45bc214ebc81d04a07c274a8b77b15ba4691e67ee3bbdd6abd13c1f366d35f00cb27bf72
-
Filesize
255KB
MD52bcdfdb19702f62a699c20fd33e20842
SHA123ce9a73c7828483149bea82f252190e0e265009
SHA256fc1284cd78e9f5751478e19192d17f5947a6b7d39bd63b3b8de5e58c9814f179
SHA5126e153cdb27a2cb192e2e3f44757f6c8531e9062685e079980af975eb45bc214ebc81d04a07c274a8b77b15ba4691e67ee3bbdd6abd13c1f366d35f00cb27bf72
-
Filesize
255KB
MD52bcdfdb19702f62a699c20fd33e20842
SHA123ce9a73c7828483149bea82f252190e0e265009
SHA256fc1284cd78e9f5751478e19192d17f5947a6b7d39bd63b3b8de5e58c9814f179
SHA5126e153cdb27a2cb192e2e3f44757f6c8531e9062685e079980af975eb45bc214ebc81d04a07c274a8b77b15ba4691e67ee3bbdd6abd13c1f366d35f00cb27bf72
-
Filesize
255KB
MD5ac4f8f573e69019f062ec7b842a9cb0f
SHA1696d8753b845a5ae250104b03afe235de232ee3f
SHA25690a8d81fdf32817938e3536d438960e4b4c63263577ec38b5d567a8df2921f3d
SHA5123fbc3a5d90026f268b628ab9df7b9885c8936502da0a793e5f12905c7ac8f50632cc3357a21928bfe1c7f20b8f53c7ad49ea097357713c0d55d1fedeaead63be
-
Filesize
255KB
MD5ac4f8f573e69019f062ec7b842a9cb0f
SHA1696d8753b845a5ae250104b03afe235de232ee3f
SHA25690a8d81fdf32817938e3536d438960e4b4c63263577ec38b5d567a8df2921f3d
SHA5123fbc3a5d90026f268b628ab9df7b9885c8936502da0a793e5f12905c7ac8f50632cc3357a21928bfe1c7f20b8f53c7ad49ea097357713c0d55d1fedeaead63be
-
Filesize
255KB
MD5f07b92f8a541850ba2eb8420ed1f0e7d
SHA1aabf8a3d73946a7f231d919afe0046418fe970d9
SHA25661c1d7a9f257fe2711d4e0fb409abc904ab3aed7d176f71bc29c316473745c69
SHA51287e2b15eb2d28815835ccc93f57a9b50e7144db6d62f02bb0d543f376deaea9f19ed8acdeaed8d83c5a92e7344938c4c675ae168b5d865ff03241fd48f2c14e9
-
Filesize
255KB
MD5f07b92f8a541850ba2eb8420ed1f0e7d
SHA1aabf8a3d73946a7f231d919afe0046418fe970d9
SHA25661c1d7a9f257fe2711d4e0fb409abc904ab3aed7d176f71bc29c316473745c69
SHA51287e2b15eb2d28815835ccc93f57a9b50e7144db6d62f02bb0d543f376deaea9f19ed8acdeaed8d83c5a92e7344938c4c675ae168b5d865ff03241fd48f2c14e9
-
Filesize
255KB
MD5fd2b2eeeb0c7ddad636e4ba4e6f73519
SHA1f8afd7529dd57ea4deff24608e9dd3a7ad00bbc1
SHA256e6a4d92e68a519f911ad74892f6f0009ee3d3c9c12a515af4420b652fe6846c5
SHA512cd1de3898ddbfd9402b139b93ea167d3b67916dca0d3f6734bac7d6794109a4437f581602126bbed139134b104470fa95af8f4847f0c039f399a0868ea33a3ba
-
Filesize
255KB
MD5fd2b2eeeb0c7ddad636e4ba4e6f73519
SHA1f8afd7529dd57ea4deff24608e9dd3a7ad00bbc1
SHA256e6a4d92e68a519f911ad74892f6f0009ee3d3c9c12a515af4420b652fe6846c5
SHA512cd1de3898ddbfd9402b139b93ea167d3b67916dca0d3f6734bac7d6794109a4437f581602126bbed139134b104470fa95af8f4847f0c039f399a0868ea33a3ba
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
-
Filesize
640KB