Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-11-2022 20:59
General
-
Target
ff0c7a781d85d81363f385617476e5199791bc9702c323142ec53b7e839b8f98.exe
-
Size
255KB
-
MD5
d1b1341d083a3008b97a28077e52e1c5
-
SHA1
3de7acf39298dec436b6d749ddb27d73a92a9c56
-
SHA256
ff0c7a781d85d81363f385617476e5199791bc9702c323142ec53b7e839b8f98
-
SHA512
4465ef6f31d70321da2a0d88fbee0a18134ff0f964819c0d57be3f2560d2fb44ab0d664854b78eda959a3e663f16c8fc9e74b868f10be7ef918a81000aa610d3
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJa:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIZ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 6 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 47 IoCs
-
Suspicious use of SendNotifyMessage 33 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff0c7a781d85d81363f385617476e5199791bc9702c323142ec53b7e839b8f98.exe"C:\Users\Admin\AppData\Local\Temp\ff0c7a781d85d81363f385617476e5199791bc9702c323142ec53b7e839b8f98.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\oaxultgepq.exeoaxultgepq.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tbhpyxsu.exeC:\Windows\system32\tbhpyxsu.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\eypqvhwqrfxhvtt.exeeypqvhwqrfxhvtt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c gybwkzhimclna.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gybwkzhimclna.exegybwkzhimclna.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Windows\SysWOW64\tbhpyxsu.exetbhpyxsu.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\gybwkzhimclna.exegybwkzhimclna.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5a735833c59ca40fdbef5098fca5082e5
SHA10bf9f74fd6cb83b112bbe9c81563f73fc6b96762
SHA256b33ff239690288088b38efb368bb6d39862f243c10d8b6028227368a8f6186f4
SHA51257b30dac421ba855b0008f73d1eb972f5cc877629b6b919cfef24169d516392087d4e821048c4115c495e4f45944daa356746bda47e700176d20ab2575d4ef19
-
Filesize
255KB
MD5a735833c59ca40fdbef5098fca5082e5
SHA10bf9f74fd6cb83b112bbe9c81563f73fc6b96762
SHA256b33ff239690288088b38efb368bb6d39862f243c10d8b6028227368a8f6186f4
SHA51257b30dac421ba855b0008f73d1eb972f5cc877629b6b919cfef24169d516392087d4e821048c4115c495e4f45944daa356746bda47e700176d20ab2575d4ef19
-
Filesize
255KB
MD551bf0ae1c223daf7d4b8c2d875fe5027
SHA161f0586324e830754710655b7c34c203ffdb212b
SHA25685ea4cd281eba2867643635142466fe2d40b82be875477fcf7335e0f8e9c1351
SHA512374340919347b2ad3a222cfddb74969a36a9ce9ac3e67eaed56b397e8009b88a1aac232def4621fdfda388a0967ee8165fc425c1352f2b01e041247a5df1e187
-
Filesize
255KB
MD551bf0ae1c223daf7d4b8c2d875fe5027
SHA161f0586324e830754710655b7c34c203ffdb212b
SHA25685ea4cd281eba2867643635142466fe2d40b82be875477fcf7335e0f8e9c1351
SHA512374340919347b2ad3a222cfddb74969a36a9ce9ac3e67eaed56b397e8009b88a1aac232def4621fdfda388a0967ee8165fc425c1352f2b01e041247a5df1e187
-
Filesize
255KB
MD551bf0ae1c223daf7d4b8c2d875fe5027
SHA161f0586324e830754710655b7c34c203ffdb212b
SHA25685ea4cd281eba2867643635142466fe2d40b82be875477fcf7335e0f8e9c1351
SHA512374340919347b2ad3a222cfddb74969a36a9ce9ac3e67eaed56b397e8009b88a1aac232def4621fdfda388a0967ee8165fc425c1352f2b01e041247a5df1e187
-
Filesize
255KB
MD582b8df9d07e6bcb7131b463e4788481b
SHA1c2a1832f0b7069f63823db0bde3e170db50d2fdd
SHA2566bf316be7a5ae08552a28419bf0be82503d89d5743c8ba1443f694b2957886d3
SHA51257e34909ade0e0ceadca5a85e8c5bc09b03be2d81dbebdae83040f63d293ea97e8ed97508f348c467ca06db453e9a4cc34a685ffd6b5d1bf16ff49261ff556ca
-
Filesize
255KB
MD582b8df9d07e6bcb7131b463e4788481b
SHA1c2a1832f0b7069f63823db0bde3e170db50d2fdd
SHA2566bf316be7a5ae08552a28419bf0be82503d89d5743c8ba1443f694b2957886d3
SHA51257e34909ade0e0ceadca5a85e8c5bc09b03be2d81dbebdae83040f63d293ea97e8ed97508f348c467ca06db453e9a4cc34a685ffd6b5d1bf16ff49261ff556ca
-
Filesize
255KB
MD549ec91da38bceecd6fdcc54f8e76b5c1
SHA1452e349d0e4c36e00c262cb5b2eee893c23908e5
SHA256b82059ab470da295e84957b9c9140f34ade39649110e6aaea982f14c76957033
SHA51214702e8ef6e03a48856be80892d28c94b4f8a7d7b24df8ccc8f2de11f23735c19ed6f5acf92d9a91b6942c8c1406f18d231f47e15d0c01b6b9f88f4d73b837c8
-
Filesize
255KB
MD549ec91da38bceecd6fdcc54f8e76b5c1
SHA1452e349d0e4c36e00c262cb5b2eee893c23908e5
SHA256b82059ab470da295e84957b9c9140f34ade39649110e6aaea982f14c76957033
SHA51214702e8ef6e03a48856be80892d28c94b4f8a7d7b24df8ccc8f2de11f23735c19ed6f5acf92d9a91b6942c8c1406f18d231f47e15d0c01b6b9f88f4d73b837c8
-
Filesize
255KB
MD549ec91da38bceecd6fdcc54f8e76b5c1
SHA1452e349d0e4c36e00c262cb5b2eee893c23908e5
SHA256b82059ab470da295e84957b9c9140f34ade39649110e6aaea982f14c76957033
SHA51214702e8ef6e03a48856be80892d28c94b4f8a7d7b24df8ccc8f2de11f23735c19ed6f5acf92d9a91b6942c8c1406f18d231f47e15d0c01b6b9f88f4d73b837c8
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5a735833c59ca40fdbef5098fca5082e5
SHA10bf9f74fd6cb83b112bbe9c81563f73fc6b96762
SHA256b33ff239690288088b38efb368bb6d39862f243c10d8b6028227368a8f6186f4
SHA51257b30dac421ba855b0008f73d1eb972f5cc877629b6b919cfef24169d516392087d4e821048c4115c495e4f45944daa356746bda47e700176d20ab2575d4ef19
-
Filesize
255KB
MD551bf0ae1c223daf7d4b8c2d875fe5027
SHA161f0586324e830754710655b7c34c203ffdb212b
SHA25685ea4cd281eba2867643635142466fe2d40b82be875477fcf7335e0f8e9c1351
SHA512374340919347b2ad3a222cfddb74969a36a9ce9ac3e67eaed56b397e8009b88a1aac232def4621fdfda388a0967ee8165fc425c1352f2b01e041247a5df1e187
-
Filesize
255KB
MD551bf0ae1c223daf7d4b8c2d875fe5027
SHA161f0586324e830754710655b7c34c203ffdb212b
SHA25685ea4cd281eba2867643635142466fe2d40b82be875477fcf7335e0f8e9c1351
SHA512374340919347b2ad3a222cfddb74969a36a9ce9ac3e67eaed56b397e8009b88a1aac232def4621fdfda388a0967ee8165fc425c1352f2b01e041247a5df1e187
-
Filesize
255KB
MD582b8df9d07e6bcb7131b463e4788481b
SHA1c2a1832f0b7069f63823db0bde3e170db50d2fdd
SHA2566bf316be7a5ae08552a28419bf0be82503d89d5743c8ba1443f694b2957886d3
SHA51257e34909ade0e0ceadca5a85e8c5bc09b03be2d81dbebdae83040f63d293ea97e8ed97508f348c467ca06db453e9a4cc34a685ffd6b5d1bf16ff49261ff556ca
-
Filesize
255KB
MD549ec91da38bceecd6fdcc54f8e76b5c1
SHA1452e349d0e4c36e00c262cb5b2eee893c23908e5
SHA256b82059ab470da295e84957b9c9140f34ade39649110e6aaea982f14c76957033
SHA51214702e8ef6e03a48856be80892d28c94b4f8a7d7b24df8ccc8f2de11f23735c19ed6f5acf92d9a91b6942c8c1406f18d231f47e15d0c01b6b9f88f4d73b837c8
-
Filesize
255KB
MD549ec91da38bceecd6fdcc54f8e76b5c1
SHA1452e349d0e4c36e00c262cb5b2eee893c23908e5
SHA256b82059ab470da295e84957b9c9140f34ade39649110e6aaea982f14c76957033
SHA51214702e8ef6e03a48856be80892d28c94b4f8a7d7b24df8ccc8f2de11f23735c19ed6f5acf92d9a91b6942c8c1406f18d231f47e15d0c01b6b9f88f4d73b837c8
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
44KB
-
Filesize
44KB
-
-
Filesize
64KB
-
Filesize
12KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
8KB