Analysis
-
max time kernel
154s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:03
General
-
Target
88b11acbc810715c121447c02765223fd4d981a851cd5cc2b466ea7e75100aef.exe
-
Size
255KB
-
MD5
e16dffcae0434e7e9e5012aa3c96caee
-
SHA1
cfb03b4f0ef8e829a32a3f3a4824308fada5da59
-
SHA256
88b11acbc810715c121447c02765223fd4d981a851cd5cc2b466ea7e75100aef
-
SHA512
d17e1861f11158588180821c2d1de6496ee1ceb6b4c43a739771b29e4fd848fc56da4b7ea343aef48a6708de4ce8f20574b6840bc8870acb53f07b500507de96
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJb:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIu
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88b11acbc810715c121447c02765223fd4d981a851cd5cc2b466ea7e75100aef.exe"C:\Users\Admin\AppData\Local\Temp\88b11acbc810715c121447c02765223fd4d981a851cd5cc2b466ea7e75100aef.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\hscjqokhob.exehscjqokhob.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\enxqxyau.exeC:\Windows\system32\enxqxyau.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\onamcxrrwyzwvef.exeonamcxrrwyzwvef.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\enxqxyau.exeenxqxyau.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\rnmkhojuadonn.exernmkhojuadonn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD53b65da29c4d5b4e06bb744c33508b6d4
SHA14d1b184f1c249c1a7967f20d61b8b7a7205de2f5
SHA25642c3835df3703dcf2a00c8bc2c7683e9d2db13e6cfd0a205090932f7038bc910
SHA512684be95bdd4e05bb1c89b0f5302b8e91771801e1773597f2342dea9a94ab6b710e47bf8d2573896f5793fe812b25c2d39645db02c1d55a3f4441cd58416e30fa
-
Filesize
255KB
MD54d8faf700303a939d6130b120c8d5240
SHA1403afcbc4840a276ca2832e96c57b4e4e12a378b
SHA256e81270c284fa6c336dee27a3909235a37c32d04a26738bca08f18afdf44f8287
SHA51288a00cd5e278fcd8a358e0a547151242539145580e9e208eb643cc6f2b55ca29182d56d25a61632c95cb1416128e7eff4fa14f1d9f40646517fbfd29ed5ca3de
-
Filesize
255KB
MD525e4485199c17447a3f960c9b5a4ad54
SHA1f56fd0aecad060d8d59650307764a2a755d02099
SHA2566983bcc9164085292d6b00ad643c17383454016546032c39fc4ee4dd235abd70
SHA5129d685a96bf43248e5cff03caeab09d475929404b6e2ece47218bd426cbea809693643b5ba2a68e8fdd7e9afa2902da3d351b5cb3a5016d4662119b698309f2d0
-
Filesize
255KB
MD525e4485199c17447a3f960c9b5a4ad54
SHA1f56fd0aecad060d8d59650307764a2a755d02099
SHA2566983bcc9164085292d6b00ad643c17383454016546032c39fc4ee4dd235abd70
SHA5129d685a96bf43248e5cff03caeab09d475929404b6e2ece47218bd426cbea809693643b5ba2a68e8fdd7e9afa2902da3d351b5cb3a5016d4662119b698309f2d0
-
Filesize
255KB
MD525e4485199c17447a3f960c9b5a4ad54
SHA1f56fd0aecad060d8d59650307764a2a755d02099
SHA2566983bcc9164085292d6b00ad643c17383454016546032c39fc4ee4dd235abd70
SHA5129d685a96bf43248e5cff03caeab09d475929404b6e2ece47218bd426cbea809693643b5ba2a68e8fdd7e9afa2902da3d351b5cb3a5016d4662119b698309f2d0
-
Filesize
255KB
MD5f37dff47b783b94512348baa8ab2b8c4
SHA19abf20ffac34e0259397ac7874ebdc8f961fac1a
SHA2568fa7bdb65734ed014d0b291d0827db77a5d34e4dd0ab0e219e3ac72cdbcad4ae
SHA51292a8fad4d42abf1da786a7bb1a288c0570b13a9fd5ba7143eb1982103eeca0bbd82f47e7556aab2b6f9626099282b7bcfd8c19de6071ff7fe418782904019906
-
Filesize
255KB
MD5f37dff47b783b94512348baa8ab2b8c4
SHA19abf20ffac34e0259397ac7874ebdc8f961fac1a
SHA2568fa7bdb65734ed014d0b291d0827db77a5d34e4dd0ab0e219e3ac72cdbcad4ae
SHA51292a8fad4d42abf1da786a7bb1a288c0570b13a9fd5ba7143eb1982103eeca0bbd82f47e7556aab2b6f9626099282b7bcfd8c19de6071ff7fe418782904019906
-
Filesize
255KB
MD58631fecbeca756cb452407e3a433fda9
SHA11b01ae288bae127366e0215af903bd30df934194
SHA256041023e7d14bb37a1757173fe0bc7d7291e5ed901a3852e6369542c0fc33cfa7
SHA51298b7c4905d8f2364b86d6b5c1ec8576436a18c38c828e5d8a0517f572f96fc1c42d9e36f14bd7aa97db5f201db0e43819a5c91f787254d547bcdb113a7abad7a
-
Filesize
255KB
MD58631fecbeca756cb452407e3a433fda9
SHA11b01ae288bae127366e0215af903bd30df934194
SHA256041023e7d14bb37a1757173fe0bc7d7291e5ed901a3852e6369542c0fc33cfa7
SHA51298b7c4905d8f2364b86d6b5c1ec8576436a18c38c828e5d8a0517f572f96fc1c42d9e36f14bd7aa97db5f201db0e43819a5c91f787254d547bcdb113a7abad7a
-
Filesize
255KB
MD52f389799799946885525bb4cd590383f
SHA1f59ada019455ebe53306be19d72f8a8f02c8a22c
SHA25625c6a8b3b0dcd50f6379aa21903c94e50913e536d5c0719677de0c1b9c1f3ee7
SHA512ccc9e876b072e9eed117bda95cf78490aa14aa13bde81d43c8c919fda333da6a98b3207a0cd61613f859ed73e0ebfb78205775ef6dfe55dde3551a1620fc1e92
-
Filesize
255KB
MD52f389799799946885525bb4cd590383f
SHA1f59ada019455ebe53306be19d72f8a8f02c8a22c
SHA25625c6a8b3b0dcd50f6379aa21903c94e50913e536d5c0719677de0c1b9c1f3ee7
SHA512ccc9e876b072e9eed117bda95cf78490aa14aa13bde81d43c8c919fda333da6a98b3207a0cd61613f859ed73e0ebfb78205775ef6dfe55dde3551a1620fc1e92
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-