Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:03
General
-
Target
82652d8fa981f813639208ad313c783ee5d7c808afeb18fb98c79f584656a0a8.exe
-
Size
255KB
-
MD5
29091989086425a6d3a63e48c680b4a9
-
SHA1
4af28fb42da89139ec542da17d7163b67f5e6311
-
SHA256
82652d8fa981f813639208ad313c783ee5d7c808afeb18fb98c79f584656a0a8
-
SHA512
f5faf616867096b621b00d49c7701cf7c81a4cfdfa41a74c9f30ee1bbedce082186dd135190caf9e2c37b765296c793dcb9a2fa3ede5a88947f2a02f2c9914a8
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ+:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIf
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82652d8fa981f813639208ad313c783ee5d7c808afeb18fb98c79f584656a0a8.exe"C:\Users\Admin\AppData\Local\Temp\82652d8fa981f813639208ad313c783ee5d7c808afeb18fb98c79f584656a0a8.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\hunjknmxga.exehunjknmxga.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vflkobwu.exeC:\Windows\system32\vflkobwu.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\lwesnpvmknkpyjc.exelwesnpvmknkpyjc.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\vflkobwu.exevflkobwu.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\jwyepnpcekcag.exejwyepnpcekcag.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5054776b640b55ab64c09c4c6376ef283
SHA1b1c1dccec7edbc4900cd671d0ff8cf2662e18b90
SHA25686a9a1b843db6823e5e4eb6c4c365194990fe67e7ce55979e26dd30e9e592b86
SHA512f683e1e63d5187ca2691ebcd85b06b3baccca50992111f1fd7d8cca22ee53250cc491b47718e28be56e937d743044fd4043ed6a18f5c1de6372e245d8932e4d7
-
Filesize
255KB
MD5093ecdb6a62280cc9ff4b1255b5d85c0
SHA19d177cd4f13ff97563ebae982bd616a12a09fcdd
SHA25698e730f07e92dd48eb06a7f0d3f6d8da5c0dab10f6cf63f48322d10b78484f0d
SHA512b32e6507cb28c586b6f4c07370581e39409a13e5d980f281a24285cf507956255f581193346cad740f6e8f639a36a57cf578e4246cf513843b47b6c29c6a84ba
-
Filesize
255KB
MD5607ce161b582b25a6b4a4d01da010efe
SHA12c5e3d57c29b4149895e77610e0505279b87b49b
SHA2562ee753fc41e88a437062a0c436508942b9428e35245dc6b958104fd5564196ba
SHA5124ea854b65ef9813080dbe48b663390b0175781a70729a718d6922ef6891027860df358e0067e720c9d549b1e56a622d3384879d0da624b1746e0d2c3d58ed8e4
-
Filesize
255KB
MD5607ce161b582b25a6b4a4d01da010efe
SHA12c5e3d57c29b4149895e77610e0505279b87b49b
SHA2562ee753fc41e88a437062a0c436508942b9428e35245dc6b958104fd5564196ba
SHA5124ea854b65ef9813080dbe48b663390b0175781a70729a718d6922ef6891027860df358e0067e720c9d549b1e56a622d3384879d0da624b1746e0d2c3d58ed8e4
-
Filesize
255KB
MD5d406bcbb0e1137a8b4a58a68c5a08cd4
SHA1b9ed0b0edf7ea2b0de52e853e5e121703d9a0db5
SHA256455bb4845e3d2416c54ec2883f80a6e95e85b7655b51bee73ef7c5f9d1a9892e
SHA512b74dc9d7b0ab223f2357776ac883685913d03bff197355c85395c0e8797c2acd95777234dda05dc1801851bc0e4ce5235dbc735622e46bfd3f87d5b1ca40d71c
-
Filesize
255KB
MD5d406bcbb0e1137a8b4a58a68c5a08cd4
SHA1b9ed0b0edf7ea2b0de52e853e5e121703d9a0db5
SHA256455bb4845e3d2416c54ec2883f80a6e95e85b7655b51bee73ef7c5f9d1a9892e
SHA512b74dc9d7b0ab223f2357776ac883685913d03bff197355c85395c0e8797c2acd95777234dda05dc1801851bc0e4ce5235dbc735622e46bfd3f87d5b1ca40d71c
-
Filesize
255KB
MD5e4da6aa4aedf03348560abd6129addf0
SHA1d9c05b92229e8e6b33c35126ed14b948b5ad2360
SHA256e3a735d4cc7ee85a7bbf195577f37970d8b525a8b28fca733e836ec4698356cf
SHA5122122a74a17e8ca40134e62306c1be713af9ac608ce363ed58f9999cc0a5657342836f57b779a51032f5b0ac05e5bbcb54604ab93a2bfa3f6f91da7334980b797
-
Filesize
255KB
MD5e4da6aa4aedf03348560abd6129addf0
SHA1d9c05b92229e8e6b33c35126ed14b948b5ad2360
SHA256e3a735d4cc7ee85a7bbf195577f37970d8b525a8b28fca733e836ec4698356cf
SHA5122122a74a17e8ca40134e62306c1be713af9ac608ce363ed58f9999cc0a5657342836f57b779a51032f5b0ac05e5bbcb54604ab93a2bfa3f6f91da7334980b797
-
Filesize
255KB
MD54b7377c78b59dde5b0384d6a995c22f4
SHA17c052d4a0ca439655c37d95f43a2f84cbc937719
SHA2569d237f49b8158672afc83fb97175e0421420d0e13710c664cec10db3f9ae7e5a
SHA512c4ec1fd79ba1f474a3c775fa5fb8e440c1421d7fa1d55595b09c729814ffe3ee4a186e3d0cb79aa0d247bc685bcd800119b41a37dc91c14ad23ffbb7867f09f1
-
Filesize
255KB
MD54b7377c78b59dde5b0384d6a995c22f4
SHA17c052d4a0ca439655c37d95f43a2f84cbc937719
SHA2569d237f49b8158672afc83fb97175e0421420d0e13710c664cec10db3f9ae7e5a
SHA512c4ec1fd79ba1f474a3c775fa5fb8e440c1421d7fa1d55595b09c729814ffe3ee4a186e3d0cb79aa0d247bc685bcd800119b41a37dc91c14ad23ffbb7867f09f1
-
Filesize
255KB
MD54b7377c78b59dde5b0384d6a995c22f4
SHA17c052d4a0ca439655c37d95f43a2f84cbc937719
SHA2569d237f49b8158672afc83fb97175e0421420d0e13710c664cec10db3f9ae7e5a
SHA512c4ec1fd79ba1f474a3c775fa5fb8e440c1421d7fa1d55595b09c729814ffe3ee4a186e3d0cb79aa0d247bc685bcd800119b41a37dc91c14ad23ffbb7867f09f1
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB