Analysis
-
max time kernel
186s -
max time network
229s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:03
General
-
Target
8397bc1ad6e62e8dc6c71e087dd82ccaa811889baf9f3a317721f396846c75f5.exe
-
Size
255KB
-
MD5
f7c1cb4e34afd6d23fce916221b1be97
-
SHA1
eaa65157ace3e49e458ca6647b7e2ebe3a58510b
-
SHA256
8397bc1ad6e62e8dc6c71e087dd82ccaa811889baf9f3a317721f396846c75f5
-
SHA512
39516139df477d30ccb520a27a267fee5157b35197c8fa6fc50df96821e641b9038e996760523c9a4b97b4b6c3f5312eca255da3305e00b92ec3fcee764aae9d
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJz:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIC
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8397bc1ad6e62e8dc6c71e087dd82ccaa811889baf9f3a317721f396846c75f5.exe"C:\Users\Admin\AppData\Local\Temp\8397bc1ad6e62e8dc6c71e087dd82ccaa811889baf9f3a317721f396846c75f5.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\emstpkjpyh.exeemstpkjpyh.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\veeuhjpw.exeC:\Windows\system32\veeuhjpw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ucqrscqmsmotlov.exeucqrscqmsmotlov.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c xtuczxygpgnvl.exe3⤵
-
C:\Windows\SysWOW64\veeuhjpw.exeveeuhjpw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\xtuczxygpgnvl.exextuczxygpgnvl.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD58063182e0445e141f1aa3a0a1765c0b4
SHA182d1818786ffe7b8c6a53d9be78057bd55c90ad7
SHA256f797b1d121353b26e0b1b503dd431e2e27c9951ebd4a82adef8a5521fa414884
SHA51256bec1d94219e735c29c20fc8ce8407ff02e5b3d746e5fac8e48cff490d18cfe5cd115d104eaea4ce0ab281645071ae2b79ecdcb02ba4e9ff41ef6747a7a5976
-
Filesize
255KB
MD5a0b8a2e1fab5d8962e647fc2a291a9bf
SHA160464e46147610665760a85414a1843c2eb58ad5
SHA256c557e745aa8882f011a1f8eec686c5d27cf08a94f81f06ae65333dd2c3a6db0f
SHA512e5584bdb4966e3c8ae91996a4554ccc281e0e85a02eb85b691d19922ca95042d29d5b26080784c4c0e567ac36e27a00ef84ed6aa9e9acfea5325f46474a57400
-
Filesize
255KB
MD5a0b8a2e1fab5d8962e647fc2a291a9bf
SHA160464e46147610665760a85414a1843c2eb58ad5
SHA256c557e745aa8882f011a1f8eec686c5d27cf08a94f81f06ae65333dd2c3a6db0f
SHA512e5584bdb4966e3c8ae91996a4554ccc281e0e85a02eb85b691d19922ca95042d29d5b26080784c4c0e567ac36e27a00ef84ed6aa9e9acfea5325f46474a57400
-
Filesize
255KB
MD5bdc4a20074ec4646e80b926f586886b7
SHA10200cf35c11ab5dace27897ef04af48035e2e9ba
SHA256719d39ca2780151c9766dc4037435d1704cdfc9a0da1ea744105236e14d4620e
SHA5126c3bd659a3534af80d4567635a36b19f5fa19247ac782a3f60467a4a8f589ca06dd769313380857f31dbe20ef6fe2b31c45ac99bfea0cdfa15ff3ec415f2a7a0
-
Filesize
255KB
MD5bdc4a20074ec4646e80b926f586886b7
SHA10200cf35c11ab5dace27897ef04af48035e2e9ba
SHA256719d39ca2780151c9766dc4037435d1704cdfc9a0da1ea744105236e14d4620e
SHA5126c3bd659a3534af80d4567635a36b19f5fa19247ac782a3f60467a4a8f589ca06dd769313380857f31dbe20ef6fe2b31c45ac99bfea0cdfa15ff3ec415f2a7a0
-
Filesize
255KB
MD525fd693bcbed6e24e3ed31c5a5f222a8
SHA12f9f6781dfbc51e89a084b3c2b87d4670e3a9c0e
SHA256baa74c1c3e1a86aa2bd1f90e4196196a56796ca547f1db1d0c74c52a70f83b06
SHA512a700631f6cf06d343da47fc110b17690f0cc2c67f4ad3ab09bcfefd317bef7966300fb9ee94eb9081ac011389a88016baf30a4ec9bdd270f9937769703b87442
-
Filesize
255KB
MD525fd693bcbed6e24e3ed31c5a5f222a8
SHA12f9f6781dfbc51e89a084b3c2b87d4670e3a9c0e
SHA256baa74c1c3e1a86aa2bd1f90e4196196a56796ca547f1db1d0c74c52a70f83b06
SHA512a700631f6cf06d343da47fc110b17690f0cc2c67f4ad3ab09bcfefd317bef7966300fb9ee94eb9081ac011389a88016baf30a4ec9bdd270f9937769703b87442
-
Filesize
255KB
MD525fd693bcbed6e24e3ed31c5a5f222a8
SHA12f9f6781dfbc51e89a084b3c2b87d4670e3a9c0e
SHA256baa74c1c3e1a86aa2bd1f90e4196196a56796ca547f1db1d0c74c52a70f83b06
SHA512a700631f6cf06d343da47fc110b17690f0cc2c67f4ad3ab09bcfefd317bef7966300fb9ee94eb9081ac011389a88016baf30a4ec9bdd270f9937769703b87442
-
Filesize
255KB
MD545283f11fe43f794d566acf73df17812
SHA1e78c154ff38af4c9b80782c67786ca13ae821792
SHA2567e192a35bab67e5527ff051760c7e60e74eccc7ebfe8a9149505a9431234754d
SHA5120e4b912bdfc0738aad46e9d4f2b016574b3bf209e39370a5815514cea6a1f58cf3360fbe0dbb29a258f46c8aca1c3cacd13e80cfda263ae6111210b7c614b2da
-
Filesize
255KB
MD545283f11fe43f794d566acf73df17812
SHA1e78c154ff38af4c9b80782c67786ca13ae821792
SHA2567e192a35bab67e5527ff051760c7e60e74eccc7ebfe8a9149505a9431234754d
SHA5120e4b912bdfc0738aad46e9d4f2b016574b3bf209e39370a5815514cea6a1f58cf3360fbe0dbb29a258f46c8aca1c3cacd13e80cfda263ae6111210b7c614b2da
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD52ca4f0c9cc5afcf57058f5e8bdaf312c
SHA193f3f683d56066e79fa2beb911613be7b054b0b7
SHA256aedf3072e68dc51ca83535c731cc9c893c97084529b7755b9bf61fd4be160bf6
SHA5121512a715c23848155150c5a0f84ef2db21302677f0c5bb9b13a65f64f9db082471a5ce671f98c7b3dbc05f403c71e2a63c028226fc890eaabd171fa8a152109d
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB