Overview

overview

10

Static

static

8

82e50a8f03...c1.exe

windows7-x64

10

82e50a8f03...c1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    155s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 21:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    82e50a8f03b010a3a1e65111d9150eeb72ff9147a05170c01c1bdccf98b1c8c1.exe

  • Size

    255KB

  • MD5

    a4091b61aa64eb56890e71daf501a989

  • SHA1

    91089db448c09c4b8c0b9f00e9ad2058144535fe

  • SHA256

    82e50a8f03b010a3a1e65111d9150eeb72ff9147a05170c01c1bdccf98b1c8c1

  • SHA512

    e42de641da7fdf6a5c928132fa939e59974f37603d134565aefdee5518850a1e4ed26c755fe1b16a98808bf5da91e26029cf0eb41acbf1b89dba167e8204b6c4

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJv:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIM

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\82e50a8f03b010a3a1e65111d9150eeb72ff9147a05170c01c1bdccf98b1c8c1.exe
    "C:\Users\Admin\AppData\Local\Temp\82e50a8f03b010a3a1e65111d9150eeb72ff9147a05170c01c1bdccf98b1c8c1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Windows\SysWOW64\rcyqsjxgak.exe
      rcyqsjxgak.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\SysWOW64\nsazmaky.exe
        C:\Windows\system32\nsazmaky.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5044
    • C:\Windows\SysWOW64\mgmciayysgfhckv.exe
      mgmciayysgfhckv.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3028
    • C:\Windows\SysWOW64\nsazmaky.exe
      nsazmaky.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3896
    • C:\Windows\SysWOW64\yndyylytvcjgw.exe
      yndyylytvcjgw.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2872
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    255KB

    MD5

    d7b9b476293fd1e0fd59121e4baf8d64

    SHA1

    41a55d55b58b4857f2adae13ac528beedcffa473

    SHA256

    58a16ab2385d4831b22a05d28e5b83252df0d24ae1187c9ec3b9117d5b1e9f21

    SHA512

    7c883457f618a93cfabeb87e80ffbd3056f67c19c41166973ddebe2b65da5fb69f30f24097886de76c3226fc7474ca44f6d2c04edf5511b11788d1e56e39af4f

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    255KB

    MD5

    ede4ebe892f900da55e7e217bdaf83a9

    SHA1

    a48c77be60058eabdf113d5faf7c9ff67fb32121

    SHA256

    2bafff514089253c966f9d284d45f98a1b124160d12983baaa7211c8cbb98bf7

    SHA512

    21a6f69656ae4be01a1aa5beb79e90e9143cc6c61bb5ccba0f784cac5107269ffff23d17ae0ec3459268895c7454b004d65b2ea85a23e1a1220fd5dd4106b89d

    Download Submit
  • C:\Users\Admin\Documents\ConvertToUnprotect.doc.exe
    Filesize

    255KB

    MD5

    6cb50bdcde1d8c7cff82da2c4c055970

    SHA1

    5bd1767ce906e57e362fb835de1cb85eb6aef366

    SHA256

    22f1b266e16482ba79d87e9058172b0c9327784187abaaa1937e752d01e9b967

    SHA512

    7b5a2ef3ea67ecdf5d4ccb5d01a4c7a578a8f530641f773e3365d9abff22e63e204f430b9c4061dffa0ccf3480e3c0a46b5a2ed9e7bdcdf161b16776292d62c5

    Download Submit
  • C:\Windows\SysWOW64\mgmciayysgfhckv.exe
    Filesize

    255KB

    MD5

    fe49ae01cac62e2e5b95c6be35c76048

    SHA1

    902ee23be7b670e6621e601feb5e9217694358d4

    SHA256

    66a8e292241a4e5d9478ca07527f8637ed78ad75154b7a3f5511f6b62309db0d

    SHA512

    4c6481e55645b691c19b722254e5755ade75d56ca978128a9e2bf9107be6d291d80edf89e369ca08f9df9a5774f50364404d79bd13e428e19e9537f55d47d735

    Download Submit
  • C:\Windows\SysWOW64\mgmciayysgfhckv.exe
    Filesize

    255KB

    MD5

    fe49ae01cac62e2e5b95c6be35c76048

    SHA1

    902ee23be7b670e6621e601feb5e9217694358d4

    SHA256

    66a8e292241a4e5d9478ca07527f8637ed78ad75154b7a3f5511f6b62309db0d

    SHA512

    4c6481e55645b691c19b722254e5755ade75d56ca978128a9e2bf9107be6d291d80edf89e369ca08f9df9a5774f50364404d79bd13e428e19e9537f55d47d735

    Download Submit
  • C:\Windows\SysWOW64\nsazmaky.exe
    Filesize

    255KB

    MD5

    bf692b7c2a248c0b82c893eff9eff11c

    SHA1

    e24bd6d0ce82375cb17c8b43393f3ba4175f8cec

    SHA256

    6b5c09c0f94fcd8b8bbe205829a980cfdc61331a6dc386b6050e32a55a6f422b

    SHA512

    df455cedc5c1756106eae1c0208d476015be1b9f0a6df22c36d190b9e8ee43495e7c964ad83e69ae04a567c53a52a26f09e9ea67ed4905c10d7e4091cb16991b

    Download Submit
  • C:\Windows\SysWOW64\nsazmaky.exe
    Filesize

    255KB

    MD5

    bf692b7c2a248c0b82c893eff9eff11c

    SHA1

    e24bd6d0ce82375cb17c8b43393f3ba4175f8cec

    SHA256

    6b5c09c0f94fcd8b8bbe205829a980cfdc61331a6dc386b6050e32a55a6f422b

    SHA512

    df455cedc5c1756106eae1c0208d476015be1b9f0a6df22c36d190b9e8ee43495e7c964ad83e69ae04a567c53a52a26f09e9ea67ed4905c10d7e4091cb16991b

    Download Submit
  • C:\Windows\SysWOW64\nsazmaky.exe
    Filesize

    255KB

    MD5

    bf692b7c2a248c0b82c893eff9eff11c

    SHA1

    e24bd6d0ce82375cb17c8b43393f3ba4175f8cec

    SHA256

    6b5c09c0f94fcd8b8bbe205829a980cfdc61331a6dc386b6050e32a55a6f422b

    SHA512

    df455cedc5c1756106eae1c0208d476015be1b9f0a6df22c36d190b9e8ee43495e7c964ad83e69ae04a567c53a52a26f09e9ea67ed4905c10d7e4091cb16991b

    Download Submit
  • C:\Windows\SysWOW64\rcyqsjxgak.exe
    Filesize

    255KB

    MD5

    7e57fda5866ec5bfd0398412d8cea2cf

    SHA1

    542bdb55216cc064bb7f8bdaf2249958d6aece45

    SHA256

    aaa74081a06ab49f04f447bed76b99fb95cdd548aed7d703a758e505b17ff9ac

    SHA512

    560d13eeca22cecf6897be2ca59b7012b375594664ea49d324eff1d447ded8d81afdd153bda4aade66f51691dfb985a7f27628e56faad23e9a26d4390ebcdb73

    Download Submit
  • C:\Windows\SysWOW64\rcyqsjxgak.exe
    Filesize

    255KB

    MD5

    7e57fda5866ec5bfd0398412d8cea2cf

    SHA1

    542bdb55216cc064bb7f8bdaf2249958d6aece45

    SHA256

    aaa74081a06ab49f04f447bed76b99fb95cdd548aed7d703a758e505b17ff9ac

    SHA512

    560d13eeca22cecf6897be2ca59b7012b375594664ea49d324eff1d447ded8d81afdd153bda4aade66f51691dfb985a7f27628e56faad23e9a26d4390ebcdb73

    Download Submit
  • C:\Windows\SysWOW64\yndyylytvcjgw.exe
    Filesize

    255KB

    MD5

    71d4b9cfb19a6b2cccce1a56e03c7682

    SHA1

    57a8ffb6b0da57a125a6ac3f0580bd09963938df

    SHA256

    2dc00dde8ba814489a7d6a7274faaee1eee899161a1798488c7d7442ae13d0d8

    SHA512

    7d75a2196f33470110503e45739cce2d56b0e651b530a6b4538f763138bdd2e9d9bbd7993fd52468296dfa00983849e292866f8847c65e8d0858f63ce090d03f

    Download Submit
  • C:\Windows\SysWOW64\yndyylytvcjgw.exe
    Filesize

    255KB

    MD5

    71d4b9cfb19a6b2cccce1a56e03c7682

    SHA1

    57a8ffb6b0da57a125a6ac3f0580bd09963938df

    SHA256

    2dc00dde8ba814489a7d6a7274faaee1eee899161a1798488c7d7442ae13d0d8

    SHA512

    7d75a2196f33470110503e45739cce2d56b0e651b530a6b4538f763138bdd2e9d9bbd7993fd52468296dfa00983849e292866f8847c65e8d0858f63ce090d03f

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    255KB

    MD5

    4ec576a350fa11e6873bdcaa5d77959a

    SHA1

    39602ca0dc8455916db40734769ce0fe32366cf7

    SHA256

    220385ce5228223a69e3b8ef5e3f44cfda2dc4e6d2ce34da82f2b4f36f72906c

    SHA512

    3aa3bcdbeee63a2283313197eb4e37ac6ce1af94dffaf946e058779937ec0b1a61db2d3d19f2f9f259a26b743fed394c17af573a90d3c89d7691918db2c2073b

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    255KB

    MD5

    0f4afca3638dc1a1f04fd21ae3180421

    SHA1

    ff7e761386b83a90c3c50b657d3b174f3fa89dd3

    SHA256

    2d00dc91a9ca286722a8324ee21beabb22a4b93692e57e20cc4dd4c30fbb5b87

    SHA512

    b2e660d94f05e443c6472139163a54aaf8640b7cd9891639f9323a9de4ce2b9dc3e7558789134cb21f004019d035a54b0228b5ccf6aaf1d02c358493fe7b7bc2

    Download Submit
  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
    Filesize

    255KB

    MD5

    0f4afca3638dc1a1f04fd21ae3180421

    SHA1

    ff7e761386b83a90c3c50b657d3b174f3fa89dd3

    SHA256

    2d00dc91a9ca286722a8324ee21beabb22a4b93692e57e20cc4dd4c30fbb5b87

    SHA512

    b2e660d94f05e443c6472139163a54aaf8640b7cd9891639f9323a9de4ce2b9dc3e7558789134cb21f004019d035a54b0228b5ccf6aaf1d02c358493fe7b7bc2

    Download Submit
  • memory/1760-153-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1760-132-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/2128-164-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/2128-145-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/2128-133-0x0000000000000000-mapping.dmp
    Download
  • memory/2872-167-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/2872-148-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/2872-142-0x0000000000000000-mapping.dmp
    Download
  • memory/3028-165-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/3028-146-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/3028-136-0x0000000000000000-mapping.dmp
    Download
  • memory/3828-162-0x00007FFC2FA10000-0x00007FFC2FA20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-158-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-161-0x00007FFC2FA10000-0x00007FFC2FA20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-157-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-154-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-155-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-151-0x0000000000000000-mapping.dmp
    Download
  • memory/3828-175-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-177-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-176-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-174-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3828-156-0x00007FFC32230000-0x00007FFC32240000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3896-166-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/3896-139-0x0000000000000000-mapping.dmp
    Download
  • memory/3896-147-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/5044-152-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/5044-168-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/5044-149-0x0000000000000000-mapping.dmp
    Download