Analysis
-
max time kernel
172s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:01
General
-
Target
b8e84aef0d7ba76491d0f309d743af797c2966a4e52b3f324e4b2590caac937d.exe
-
Size
255KB
-
MD5
2b494e60880898b400240d07acc066d3
-
SHA1
c279aa527fcbf7ff67ba788545212d1d72e5aa51
-
SHA256
b8e84aef0d7ba76491d0f309d743af797c2966a4e52b3f324e4b2590caac937d
-
SHA512
644fad58d1565886c2a74ab2f9e7a0ecc80d78975d3b4ee5fd3a6b326b2275b0f864bada26c81431a9b9091d70c697a3461ba090b6bccdee7e5ee68569e64fec
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJF:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIG
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8e84aef0d7ba76491d0f309d743af797c2966a4e52b3f324e4b2590caac937d.exe"C:\Users\Admin\AppData\Local\Temp\b8e84aef0d7ba76491d0f309d743af797c2966a4e52b3f324e4b2590caac937d.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ilzbjslokm.exeilzbjslokm.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\qozcfwlw.exeC:\Windows\system32\qozcfwlw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\daltxegkcmogcpo.exedaltxegkcmogcpo.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c gonelgpaxenbu.exe3⤵
-
-
-
C:\Windows\SysWOW64\qozcfwlw.exeqozcfwlw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\gonelgpaxenbu.exegonelgpaxenbu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5e3c3fbb4951c0ffa982693b0110f0941
SHA17d8aebe78107029dfee9d0d608a0f4c40aeedbd2
SHA2569b9ebfc5e41e19d2755dfcd9180b69866a4a0244f2d5568717d1661a4fd39835
SHA51207b3bf64220c2de138a80215bd1f3b28cf3e7e2d4d11c1a9c38b29f4afde2329bbf4a15872faa727fcc7077a50066259737c64ffca387d71a0dd469889d947a7
-
Filesize
255KB
MD55439fde88b9164dc096b30e2d3555961
SHA170b5cab9aff98d950341cc68ae45e80767eb0130
SHA2563269af8eab3234fd66400fd255358eff0929f248930dea79485e1bf94401756c
SHA5126b98545c9a05c13dcebea01d4fecb58033bba87115f4b7d8c4d185e2170bfafc96b2711488571cecd39865f55d92261c9b802cb00900403c5f6bca999483285d
-
Filesize
255KB
MD5ce3b63069eda73a6621ff5ae59714a3d
SHA13f13d32aa0d3db8b51077c20f1b6878a411fc0d1
SHA2561467f7c99ef1531e12e3fe0a0b1e02ef47fa33a892a3930d387b81d5de725260
SHA5120a60346f06590a1f16d3b529d259df2ce185adc91650d81a6e7f18ceb7a4f2972a1e44e5c5c352770ab1c8699e2601c893bf89093dd5c4481f8501c5563d1a2d
-
Filesize
255KB
MD5ce3b63069eda73a6621ff5ae59714a3d
SHA13f13d32aa0d3db8b51077c20f1b6878a411fc0d1
SHA2561467f7c99ef1531e12e3fe0a0b1e02ef47fa33a892a3930d387b81d5de725260
SHA5120a60346f06590a1f16d3b529d259df2ce185adc91650d81a6e7f18ceb7a4f2972a1e44e5c5c352770ab1c8699e2601c893bf89093dd5c4481f8501c5563d1a2d
-
Filesize
255KB
MD5c7df95754b615d7336c37de5d897dde4
SHA1788909082719d06a8acb482311475f35c13e5b7e
SHA256ac471e6a0bd20bf36cdd3d4a63daeca4a5ea586cb31943d6f1148383f189004e
SHA512128d6f350ae92571e0e6ecfaf46b4edab395a0ac589401c48df94366297b976bc68fe037d3d5701e79ba3297ca9df39e208f916cc1d49263b15d7d987131af29
-
Filesize
255KB
MD5c7df95754b615d7336c37de5d897dde4
SHA1788909082719d06a8acb482311475f35c13e5b7e
SHA256ac471e6a0bd20bf36cdd3d4a63daeca4a5ea586cb31943d6f1148383f189004e
SHA512128d6f350ae92571e0e6ecfaf46b4edab395a0ac589401c48df94366297b976bc68fe037d3d5701e79ba3297ca9df39e208f916cc1d49263b15d7d987131af29
-
Filesize
255KB
MD5a995c20fbca1facdc2d475a984ca2758
SHA1a28ab4e5fe829423314a0c40f6629f3bfade30a8
SHA256f766081999aa63707100938732a4cc9185d780ec31c5536ad9e871019ac32d22
SHA5125fea10fc0a7dc9d338853365549ce46572fcb4ca1e28388e06968e5e0e5f441a1e541919598892f9d8a930b0aa1df9b40f40c16ff534eb30aec104d2a692d818
-
Filesize
255KB
MD5a995c20fbca1facdc2d475a984ca2758
SHA1a28ab4e5fe829423314a0c40f6629f3bfade30a8
SHA256f766081999aa63707100938732a4cc9185d780ec31c5536ad9e871019ac32d22
SHA5125fea10fc0a7dc9d338853365549ce46572fcb4ca1e28388e06968e5e0e5f441a1e541919598892f9d8a930b0aa1df9b40f40c16ff534eb30aec104d2a692d818
-
Filesize
255KB
MD53accfc380c48f83c133c7e026a5a4bd8
SHA1969c03153ec94141e1ba6334db547f761ea1895b
SHA2562f2b9b2a0ab4cc280e31a47748b5aeeb0f6fd7d452bb2a9e3093ea56ce834bc9
SHA51202a6ccb0ce7b9207cbe9202ff0187d71554f1a2a3a9e0ea570585287e5da62744701171b294ad3167a1dd98cf122692f58e56bd32d192adfe138fcf10e123fb8
-
Filesize
255KB
MD53accfc380c48f83c133c7e026a5a4bd8
SHA1969c03153ec94141e1ba6334db547f761ea1895b
SHA2562f2b9b2a0ab4cc280e31a47748b5aeeb0f6fd7d452bb2a9e3093ea56ce834bc9
SHA51202a6ccb0ce7b9207cbe9202ff0187d71554f1a2a3a9e0ea570585287e5da62744701171b294ad3167a1dd98cf122692f58e56bd32d192adfe138fcf10e123fb8
-
Filesize
255KB
MD53accfc380c48f83c133c7e026a5a4bd8
SHA1969c03153ec94141e1ba6334db547f761ea1895b
SHA2562f2b9b2a0ab4cc280e31a47748b5aeeb0f6fd7d452bb2a9e3093ea56ce834bc9
SHA51202a6ccb0ce7b9207cbe9202ff0187d71554f1a2a3a9e0ea570585287e5da62744701171b294ad3167a1dd98cf122692f58e56bd32d192adfe138fcf10e123fb8
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-