Analysis
-
max time kernel
174s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:01
General
-
Target
b62374321cbc31b0989ff0cebcaef98aab301e90326e856e0d744fd26dcd8e1b.exe
-
Size
255KB
-
MD5
855fa2fe0d782cbd256466662a9dc7a1
-
SHA1
7ca032553c54862e9db8bbb0d632c32254e61802
-
SHA256
b62374321cbc31b0989ff0cebcaef98aab301e90326e856e0d744fd26dcd8e1b
-
SHA512
731d79d9099d0a675198fa9e11da1e538dd17581a89caf833ea92711bb66ffb0b337bdfced5d449471f7f8f20ac0bbba72d050f3f778d05d767e524b7cfa5a58
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJn:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIG
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b62374321cbc31b0989ff0cebcaef98aab301e90326e856e0d744fd26dcd8e1b.exe"C:\Users\Admin\AppData\Local\Temp\b62374321cbc31b0989ff0cebcaef98aab301e90326e856e0d744fd26dcd8e1b.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ldpjdgnfan.exeldpjdgnfan.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\qivryxoh.exeC:\Windows\system32\qivryxoh.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\lszvaacapdcwqwu.exelszvaacapdcwqwu.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\qivryxoh.exeqivryxoh.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\rgenuwajwngcr.exergenuwajwngcr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5251aaedd48654db2021ad41afdfa04e6
SHA17ad78761fc4e9b5fd363e299a52a9b6510dc5783
SHA256344f6b4894c7d35fed9d3be361a89a4a7b6028de0e57bbdb5e682e5982764c97
SHA512af04931cfc98853d2966a7890b224f9b6f7fd44ed90351ee52d8e1b3c02b05b543d24f8ea6c79ce6ee69772687d6d34cad83e35d807d3c0f38c27067e5c69206
-
Filesize
255KB
MD5c610db77244a0b0fe17c884beb2dd830
SHA1c05627b36db0e0e0ef285530d53d8f0e1ca949fb
SHA25621b15af4f60ebc0c2d78513909d9d3551488238acb7b465114dbe57e2568db68
SHA5121550e04e1247484350bb881db55a77f0a33a4f1921ede94cc0fc4ba7539336141f7cef6a587ce3476b9bf60323c8530b6b76d5fc2c94a6e3a233827c9641e606
-
Filesize
255KB
MD556d1034ca6a994d2a8010702ed4c727b
SHA1277d7b7b10143c736675313894b1457de535b532
SHA25644a50b7940da1d9c64e8072355408d0e0b1eff21961f9c7a8e3a34755ec91e2b
SHA512d2911fc9309d73028762bb6632b7154b1a44077fa4b19fc9899e072e389757188beb537c386a8f43fb31b2d40d851c1631450b63d524b5562075bbc64586a332
-
Filesize
255KB
MD556d1034ca6a994d2a8010702ed4c727b
SHA1277d7b7b10143c736675313894b1457de535b532
SHA25644a50b7940da1d9c64e8072355408d0e0b1eff21961f9c7a8e3a34755ec91e2b
SHA512d2911fc9309d73028762bb6632b7154b1a44077fa4b19fc9899e072e389757188beb537c386a8f43fb31b2d40d851c1631450b63d524b5562075bbc64586a332
-
Filesize
255KB
MD537f7ec0d8eadcbc31bef4899c95b07f6
SHA172963181f4215738a99d12c76d4e3a213476cef0
SHA25612941cb8d2c06015589c837f5abc215020ec1d076c4026b89f045c0adeb2074d
SHA5127f9db3519c128392b0f87011efe4971ea28aa61fc5c3d460d96973cb823564a46be508950bc820812ffdbe256b866e52f37ebab0430e7f96a77e3d417db90c6f
-
Filesize
255KB
MD537f7ec0d8eadcbc31bef4899c95b07f6
SHA172963181f4215738a99d12c76d4e3a213476cef0
SHA25612941cb8d2c06015589c837f5abc215020ec1d076c4026b89f045c0adeb2074d
SHA5127f9db3519c128392b0f87011efe4971ea28aa61fc5c3d460d96973cb823564a46be508950bc820812ffdbe256b866e52f37ebab0430e7f96a77e3d417db90c6f
-
Filesize
255KB
MD52b33032c606ef557950243c9ceafab3a
SHA19cbd6d7bbcacfd41246dd8d7a0d3e2ed105b8889
SHA256a819be4a0913684b5565800c5a69e69cf1aa75f63f1cc5edf22496d187d41dde
SHA5123e355d794bec8d10a612372d5c97f2a13577c06ba389140c6c2551f2f1382b22998cd3071a7d8e80abc680d4da4829bdcb8bf824262a296e8cd3c72e378f6f7a
-
Filesize
255KB
MD52b33032c606ef557950243c9ceafab3a
SHA19cbd6d7bbcacfd41246dd8d7a0d3e2ed105b8889
SHA256a819be4a0913684b5565800c5a69e69cf1aa75f63f1cc5edf22496d187d41dde
SHA5123e355d794bec8d10a612372d5c97f2a13577c06ba389140c6c2551f2f1382b22998cd3071a7d8e80abc680d4da4829bdcb8bf824262a296e8cd3c72e378f6f7a
-
Filesize
255KB
MD52b33032c606ef557950243c9ceafab3a
SHA19cbd6d7bbcacfd41246dd8d7a0d3e2ed105b8889
SHA256a819be4a0913684b5565800c5a69e69cf1aa75f63f1cc5edf22496d187d41dde
SHA5123e355d794bec8d10a612372d5c97f2a13577c06ba389140c6c2551f2f1382b22998cd3071a7d8e80abc680d4da4829bdcb8bf824262a296e8cd3c72e378f6f7a
-
Filesize
255KB
MD5763ba9adad12b145687652004a350f48
SHA1c83ee3ffbda50d1df74ee01589e46cc9b8c65538
SHA256b1a4748b272bab9151b83145fd20c0f7a960596c4fc31a116aea20b8c839fc8d
SHA512ec888b7282163c8cc45595ff0185097feeef67b552f1b38ba103a721ef933ab249640da484af168d8534a1da58983de6f657c18aa509b4d9eed9d4154d84a7e8
-
Filesize
255KB
MD5763ba9adad12b145687652004a350f48
SHA1c83ee3ffbda50d1df74ee01589e46cc9b8c65538
SHA256b1a4748b272bab9151b83145fd20c0f7a960596c4fc31a116aea20b8c839fc8d
SHA512ec888b7282163c8cc45595ff0185097feeef67b552f1b38ba103a721ef933ab249640da484af168d8534a1da58983de6f657c18aa509b4d9eed9d4154d84a7e8
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5c610db77244a0b0fe17c884beb2dd830
SHA1c05627b36db0e0e0ef285530d53d8f0e1ca949fb
SHA25621b15af4f60ebc0c2d78513909d9d3551488238acb7b465114dbe57e2568db68
SHA5121550e04e1247484350bb881db55a77f0a33a4f1921ede94cc0fc4ba7539336141f7cef6a587ce3476b9bf60323c8530b6b76d5fc2c94a6e3a233827c9641e606
-
Filesize
255KB
MD52bd80e53043dd7ab6211535e01c32a87
SHA1fc54f5268e824de0b4081911e655e5c3927f782a
SHA2563cecf8511138c5c8ef404b5ccc9285ab8c59d40465cc92c5bc5d44c37104b635
SHA51215d15102c87bb1c26ed571ac555fd92eaf37061e7cc0b9b49e24dd4fc8d3881c483d88ff2c60aec9e9487b4fbbda698a4baf9cc2710320b37786a88f3aee7927
-
Filesize
255KB
MD52bd80e53043dd7ab6211535e01c32a87
SHA1fc54f5268e824de0b4081911e655e5c3927f782a
SHA2563cecf8511138c5c8ef404b5ccc9285ab8c59d40465cc92c5bc5d44c37104b635
SHA51215d15102c87bb1c26ed571ac555fd92eaf37061e7cc0b9b49e24dd4fc8d3881c483d88ff2c60aec9e9487b4fbbda698a4baf9cc2710320b37786a88f3aee7927
-
Filesize
255KB
MD58b3d5131083fffb4f3227c3e00e56e44
SHA1a6cb1d014cdb8205a3bdb92a5210c26da7399df1
SHA25694e1245c23fcbdac4666c02a307d6c1e017856d2d26afcc7f954109589992e7f
SHA51230df930608a8a1421e18aeb5f94e96f9c67ce275c1d518b08ea4771894d003bacc4a12959a10a26bf108cf9f1aeaf8e4d11eb2e1964656c29ddc95187bdc8474
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-