Analysis
-
max time kernel
155s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 21:03
General
-
Target
82e50a8f03b010a3a1e65111d9150eeb72ff9147a05170c01c1bdccf98b1c8c1.exe
-
Size
255KB
-
MD5
a4091b61aa64eb56890e71daf501a989
-
SHA1
91089db448c09c4b8c0b9f00e9ad2058144535fe
-
SHA256
82e50a8f03b010a3a1e65111d9150eeb72ff9147a05170c01c1bdccf98b1c8c1
-
SHA512
e42de641da7fdf6a5c928132fa939e59974f37603d134565aefdee5518850a1e4ed26c755fe1b16a98808bf5da91e26029cf0eb41acbf1b89dba167e8204b6c4
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJv:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIM
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82e50a8f03b010a3a1e65111d9150eeb72ff9147a05170c01c1bdccf98b1c8c1.exe"C:\Users\Admin\AppData\Local\Temp\82e50a8f03b010a3a1e65111d9150eeb72ff9147a05170c01c1bdccf98b1c8c1.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rcyqsjxgak.exercyqsjxgak.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nsazmaky.exeC:\Windows\system32\nsazmaky.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\mgmciayysgfhckv.exemgmciayysgfhckv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\nsazmaky.exensazmaky.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\yndyylytvcjgw.exeyndyylytvcjgw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5d7b9b476293fd1e0fd59121e4baf8d64
SHA141a55d55b58b4857f2adae13ac528beedcffa473
SHA25658a16ab2385d4831b22a05d28e5b83252df0d24ae1187c9ec3b9117d5b1e9f21
SHA5127c883457f618a93cfabeb87e80ffbd3056f67c19c41166973ddebe2b65da5fb69f30f24097886de76c3226fc7474ca44f6d2c04edf5511b11788d1e56e39af4f
-
Filesize
255KB
MD5ede4ebe892f900da55e7e217bdaf83a9
SHA1a48c77be60058eabdf113d5faf7c9ff67fb32121
SHA2562bafff514089253c966f9d284d45f98a1b124160d12983baaa7211c8cbb98bf7
SHA51221a6f69656ae4be01a1aa5beb79e90e9143cc6c61bb5ccba0f784cac5107269ffff23d17ae0ec3459268895c7454b004d65b2ea85a23e1a1220fd5dd4106b89d
-
Filesize
255KB
MD56cb50bdcde1d8c7cff82da2c4c055970
SHA15bd1767ce906e57e362fb835de1cb85eb6aef366
SHA25622f1b266e16482ba79d87e9058172b0c9327784187abaaa1937e752d01e9b967
SHA5127b5a2ef3ea67ecdf5d4ccb5d01a4c7a578a8f530641f773e3365d9abff22e63e204f430b9c4061dffa0ccf3480e3c0a46b5a2ed9e7bdcdf161b16776292d62c5
-
Filesize
255KB
MD5fe49ae01cac62e2e5b95c6be35c76048
SHA1902ee23be7b670e6621e601feb5e9217694358d4
SHA25666a8e292241a4e5d9478ca07527f8637ed78ad75154b7a3f5511f6b62309db0d
SHA5124c6481e55645b691c19b722254e5755ade75d56ca978128a9e2bf9107be6d291d80edf89e369ca08f9df9a5774f50364404d79bd13e428e19e9537f55d47d735
-
Filesize
255KB
MD5fe49ae01cac62e2e5b95c6be35c76048
SHA1902ee23be7b670e6621e601feb5e9217694358d4
SHA25666a8e292241a4e5d9478ca07527f8637ed78ad75154b7a3f5511f6b62309db0d
SHA5124c6481e55645b691c19b722254e5755ade75d56ca978128a9e2bf9107be6d291d80edf89e369ca08f9df9a5774f50364404d79bd13e428e19e9537f55d47d735
-
Filesize
255KB
MD5bf692b7c2a248c0b82c893eff9eff11c
SHA1e24bd6d0ce82375cb17c8b43393f3ba4175f8cec
SHA2566b5c09c0f94fcd8b8bbe205829a980cfdc61331a6dc386b6050e32a55a6f422b
SHA512df455cedc5c1756106eae1c0208d476015be1b9f0a6df22c36d190b9e8ee43495e7c964ad83e69ae04a567c53a52a26f09e9ea67ed4905c10d7e4091cb16991b
-
Filesize
255KB
MD5bf692b7c2a248c0b82c893eff9eff11c
SHA1e24bd6d0ce82375cb17c8b43393f3ba4175f8cec
SHA2566b5c09c0f94fcd8b8bbe205829a980cfdc61331a6dc386b6050e32a55a6f422b
SHA512df455cedc5c1756106eae1c0208d476015be1b9f0a6df22c36d190b9e8ee43495e7c964ad83e69ae04a567c53a52a26f09e9ea67ed4905c10d7e4091cb16991b
-
Filesize
255KB
MD5bf692b7c2a248c0b82c893eff9eff11c
SHA1e24bd6d0ce82375cb17c8b43393f3ba4175f8cec
SHA2566b5c09c0f94fcd8b8bbe205829a980cfdc61331a6dc386b6050e32a55a6f422b
SHA512df455cedc5c1756106eae1c0208d476015be1b9f0a6df22c36d190b9e8ee43495e7c964ad83e69ae04a567c53a52a26f09e9ea67ed4905c10d7e4091cb16991b
-
Filesize
255KB
MD57e57fda5866ec5bfd0398412d8cea2cf
SHA1542bdb55216cc064bb7f8bdaf2249958d6aece45
SHA256aaa74081a06ab49f04f447bed76b99fb95cdd548aed7d703a758e505b17ff9ac
SHA512560d13eeca22cecf6897be2ca59b7012b375594664ea49d324eff1d447ded8d81afdd153bda4aade66f51691dfb985a7f27628e56faad23e9a26d4390ebcdb73
-
Filesize
255KB
MD57e57fda5866ec5bfd0398412d8cea2cf
SHA1542bdb55216cc064bb7f8bdaf2249958d6aece45
SHA256aaa74081a06ab49f04f447bed76b99fb95cdd548aed7d703a758e505b17ff9ac
SHA512560d13eeca22cecf6897be2ca59b7012b375594664ea49d324eff1d447ded8d81afdd153bda4aade66f51691dfb985a7f27628e56faad23e9a26d4390ebcdb73
-
Filesize
255KB
MD571d4b9cfb19a6b2cccce1a56e03c7682
SHA157a8ffb6b0da57a125a6ac3f0580bd09963938df
SHA2562dc00dde8ba814489a7d6a7274faaee1eee899161a1798488c7d7442ae13d0d8
SHA5127d75a2196f33470110503e45739cce2d56b0e651b530a6b4538f763138bdd2e9d9bbd7993fd52468296dfa00983849e292866f8847c65e8d0858f63ce090d03f
-
Filesize
255KB
MD571d4b9cfb19a6b2cccce1a56e03c7682
SHA157a8ffb6b0da57a125a6ac3f0580bd09963938df
SHA2562dc00dde8ba814489a7d6a7274faaee1eee899161a1798488c7d7442ae13d0d8
SHA5127d75a2196f33470110503e45739cce2d56b0e651b530a6b4538f763138bdd2e9d9bbd7993fd52468296dfa00983849e292866f8847c65e8d0858f63ce090d03f
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD54ec576a350fa11e6873bdcaa5d77959a
SHA139602ca0dc8455916db40734769ce0fe32366cf7
SHA256220385ce5228223a69e3b8ef5e3f44cfda2dc4e6d2ce34da82f2b4f36f72906c
SHA5123aa3bcdbeee63a2283313197eb4e37ac6ce1af94dffaf946e058779937ec0b1a61db2d3d19f2f9f259a26b743fed394c17af573a90d3c89d7691918db2c2073b
-
Filesize
255KB
MD50f4afca3638dc1a1f04fd21ae3180421
SHA1ff7e761386b83a90c3c50b657d3b174f3fa89dd3
SHA2562d00dc91a9ca286722a8324ee21beabb22a4b93692e57e20cc4dd4c30fbb5b87
SHA512b2e660d94f05e443c6472139163a54aaf8640b7cd9891639f9323a9de4ce2b9dc3e7558789134cb21f004019d035a54b0228b5ccf6aaf1d02c358493fe7b7bc2
-
Filesize
255KB
MD50f4afca3638dc1a1f04fd21ae3180421
SHA1ff7e761386b83a90c3c50b657d3b174f3fa89dd3
SHA2562d00dc91a9ca286722a8324ee21beabb22a4b93692e57e20cc4dd4c30fbb5b87
SHA512b2e660d94f05e443c6472139163a54aaf8640b7cd9891639f9323a9de4ce2b9dc3e7558789134cb21f004019d035a54b0228b5ccf6aaf1d02c358493fe7b7bc2
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-