Analysis
-
max time kernel
159s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 19:06
General
-
Target
2f3946a7b96590dd9cfc7e561b5df384cf1d43b8c10ebf91a4a023d4ce62bb7c.exe
-
Size
255KB
-
MD5
524df86307d2c6fe5a20d4246526b836
-
SHA1
4f06ede6d39c4dffbd0ec076119c4a3ff679c4bd
-
SHA256
2f3946a7b96590dd9cfc7e561b5df384cf1d43b8c10ebf91a4a023d4ce62bb7c
-
SHA512
2bde40f43e0c29c686b7acfd99359ec9af5001bb62683bae029111d46d83cc1853a19761e67442cd84dadb448ead51e718f810cf02bcf4b70953dbd7d5bc610c
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJE:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI9
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f3946a7b96590dd9cfc7e561b5df384cf1d43b8c10ebf91a4a023d4ce62bb7c.exe"C:\Users\Admin\AppData\Local\Temp\2f3946a7b96590dd9cfc7e561b5df384cf1d43b8c10ebf91a4a023d4ce62bb7c.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iixfjikhrc.exeiixfjikhrc.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\bolazlvl.exeC:\Windows\system32\bolazlvl.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\vaokmdwyjumbaby.exevaokmdwyjumbaby.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\bolazlvl.exebolazlvl.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\rcexxpmwufyow.exercexxpmwufyow.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD587838f63d37741ecea98b01d4ffcfa0f
SHA14bcccd1d6d02bde1d07762a872819374cf23e181
SHA2567948faf85c4ccf1882bb55f4c5ee1a76359f4a331f64a729ed1431eee7932eac
SHA512d2b4d79dc80e7225b51d8b04441294428ed71208a9d416d7608e3342750defd76fe0e7e49593a6f7c0effd6170a4b4e1145f6f5f7ec039d203b2e293a57ebc8a
-
Filesize
255KB
MD587838f63d37741ecea98b01d4ffcfa0f
SHA14bcccd1d6d02bde1d07762a872819374cf23e181
SHA2567948faf85c4ccf1882bb55f4c5ee1a76359f4a331f64a729ed1431eee7932eac
SHA512d2b4d79dc80e7225b51d8b04441294428ed71208a9d416d7608e3342750defd76fe0e7e49593a6f7c0effd6170a4b4e1145f6f5f7ec039d203b2e293a57ebc8a
-
Filesize
255KB
MD53a0dabd495f2cae01932a5450196fe78
SHA113f1ecf56ec5025ea1e900e451acfe6ba60937e2
SHA256058861a9e8befc84b47a9650d89dd1cf9bfa1511c3d08362b00d0cb7d74e10e6
SHA512426fd4acee94b14b4e5e721414545b3d21d7b41bcfb0609b504032abd28ebc86f58b8150d0b391fe81a90e8e620a0eeefbc29d4300b0866ec93c0b2867c196c6
-
Filesize
255KB
MD53a0dabd495f2cae01932a5450196fe78
SHA113f1ecf56ec5025ea1e900e451acfe6ba60937e2
SHA256058861a9e8befc84b47a9650d89dd1cf9bfa1511c3d08362b00d0cb7d74e10e6
SHA512426fd4acee94b14b4e5e721414545b3d21d7b41bcfb0609b504032abd28ebc86f58b8150d0b391fe81a90e8e620a0eeefbc29d4300b0866ec93c0b2867c196c6
-
Filesize
255KB
MD50c89608583a18ff74a27709f665b38b6
SHA11d95490ece787e71b265897838896c23318c622c
SHA2562ba1138b307422ae1bb1f98d33945b0f9db08195b2ae989f2a781c95e286bbd7
SHA512b14a39ae3231ff18d418f60a37fd505a590da467e695d118c655f55d4e6e1302b67aefd2a482ec1dec0aad64ee7c01d37ae6beee6f07f7b05714ffa1b4fc2e5e
-
Filesize
255KB
MD50c89608583a18ff74a27709f665b38b6
SHA11d95490ece787e71b265897838896c23318c622c
SHA2562ba1138b307422ae1bb1f98d33945b0f9db08195b2ae989f2a781c95e286bbd7
SHA512b14a39ae3231ff18d418f60a37fd505a590da467e695d118c655f55d4e6e1302b67aefd2a482ec1dec0aad64ee7c01d37ae6beee6f07f7b05714ffa1b4fc2e5e
-
Filesize
255KB
MD50c89608583a18ff74a27709f665b38b6
SHA11d95490ece787e71b265897838896c23318c622c
SHA2562ba1138b307422ae1bb1f98d33945b0f9db08195b2ae989f2a781c95e286bbd7
SHA512b14a39ae3231ff18d418f60a37fd505a590da467e695d118c655f55d4e6e1302b67aefd2a482ec1dec0aad64ee7c01d37ae6beee6f07f7b05714ffa1b4fc2e5e
-
Filesize
255KB
MD573d4e86213a3eea26e88e28d063b27cf
SHA1944fdb9ce66602b35ad52bd0937b22501a57ad2b
SHA25665fb226ae55845411f37fa182896cc290ec50b414d909ba5313a1d26be06a5a0
SHA5127d2d35127e640a715ea157b7f996820533b142a1b82b96c825a75a9e4e6ad694ad8f26eb9790f389086273c8f657ffcd9cde2b9c8f2f139473626a568c121929
-
Filesize
255KB
MD573d4e86213a3eea26e88e28d063b27cf
SHA1944fdb9ce66602b35ad52bd0937b22501a57ad2b
SHA25665fb226ae55845411f37fa182896cc290ec50b414d909ba5313a1d26be06a5a0
SHA5127d2d35127e640a715ea157b7f996820533b142a1b82b96c825a75a9e4e6ad694ad8f26eb9790f389086273c8f657ffcd9cde2b9c8f2f139473626a568c121929
-
Filesize
255KB
MD577133e24878f65ef2f61b62b9f7f3a0b
SHA102c9d16a8288410ad2fba27b4f9293e4beb9f632
SHA256d07bb26c609b054ab95fbc7cd89abb3ddfcd1f5029d9090fee747f48552f06aa
SHA51250001910ad7b47fa6364202199150fbd82118b1e848947917e90116203f4fda36a981b860037ffabd3662c659278f315a77e2d3832878aef45a270de43dbb327
-
Filesize
255KB
MD577133e24878f65ef2f61b62b9f7f3a0b
SHA102c9d16a8288410ad2fba27b4f9293e4beb9f632
SHA256d07bb26c609b054ab95fbc7cd89abb3ddfcd1f5029d9090fee747f48552f06aa
SHA51250001910ad7b47fa6364202199150fbd82118b1e848947917e90116203f4fda36a981b860037ffabd3662c659278f315a77e2d3832878aef45a270de43dbb327
-
Filesize
255KB
MD54cc04014713a86f1f2860b1e88ffd080
SHA1af1b4fde82b51c10612057c8c059fb09593554cd
SHA256519fbb539aab2a39cc587134306e92aa617871094c3d8f57a6c4568aea03e83f
SHA5123ed8a5e2c930d5ecd3d2a4bafb897f7a88ff31d7640448c03f98c20282b6c3a4b8af296641342221151a9cb9925c16f8a23e79426bd630c4b96b0c455d38988a
-
Filesize
255KB
MD54cc04014713a86f1f2860b1e88ffd080
SHA1af1b4fde82b51c10612057c8c059fb09593554cd
SHA256519fbb539aab2a39cc587134306e92aa617871094c3d8f57a6c4568aea03e83f
SHA5123ed8a5e2c930d5ecd3d2a4bafb897f7a88ff31d7640448c03f98c20282b6c3a4b8af296641342221151a9cb9925c16f8a23e79426bd630c4b96b0c455d38988a
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5285dcbf00b18578a39c9c998b7e428d1
SHA16146a56a5b8054bcd5d253fda82c577f775731e1
SHA2560a211f20e704dc76a83b22270f9214260b309952fb9d5f45ad59127a0825f3e7
SHA5120612bbdac8efb8aade201388d11af5ec94b6c04cb0f2a6cb2389b675141b3c7966bd1b669048970f56d9c019d5e65dfa9284d1b02627f57da6aad1ddc9cb8b1c
-
Filesize
255KB
MD579bb7ec53db02480d9c3a1cc5b33a74b
SHA19e7a69754d2241dc1e11807b2a116c561c6a6942
SHA256c882f45aad88d1574b994282e06fa860f70c43308d33e812e7938185ccdad28e
SHA5128927b83f3900225a98dffb464966eaf8fe8de0b0a2f224909c48f4edea3e243ae2a628ab9e8719ec265d31ed1f9f740c73ff7c659b5b359239764f4a73ac4c7d
-
Filesize
255KB
MD54cec3c98806165055817bbd5abe37cfc
SHA1b6f83f3adccc0f11c3a29e116f7bc2b22eb91092
SHA2567b1613b1f6666536c9035c596ed7e4d72f996078717fd504b9d76085c5a637d8
SHA512606042d910fe6f236fd60241d00cc68d1ef3963b2afddd381606f59b7760f98e4d93bb3e4334dde345fd9d35da0f56214c55f313498ce130fd7a3b9c5e00c0b3
-
Filesize
255KB
MD54cec3c98806165055817bbd5abe37cfc
SHA1b6f83f3adccc0f11c3a29e116f7bc2b22eb91092
SHA2567b1613b1f6666536c9035c596ed7e4d72f996078717fd504b9d76085c5a637d8
SHA512606042d910fe6f236fd60241d00cc68d1ef3963b2afddd381606f59b7760f98e4d93bb3e4334dde345fd9d35da0f56214c55f313498ce130fd7a3b9c5e00c0b3
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
-
Filesize
640KB