Overview

overview

10

Static

static

8

9a882fc1b4...5d.exe

windows7-x64

10

9a882fc1b4...5d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    210s
  • max time network
    232s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 21:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe

  • Size

    255KB

  • MD5

    1fa7b053eb181dfa0c1632fb7a8eab99

  • SHA1

    bad62dbd43017abc28d42ec120f30b19c3d7dab8

  • SHA256

    9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d

  • SHA512

    fd471195b9c47ef3649eb40a5102fce146e323ce1cf071d28138016749759032281dfbd7179845afe9b937369a961a6d346a665c96e5424fc03c11ef49cd6e57

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJh:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIU

Score
10/10
evasionpersistencetrojanupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe
    "C:\Users\Admin\AppData\Local\Temp\9a882fc1b4bef5d6e11239ed875c9bd8e51a0f593039485e7ba37cc701f5c45d.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Windows\SysWOW64\iwgzpbcmrn.exe
      iwgzpbcmrn.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Windows\SysWOW64\fzzqbedz.exe
        C:\Windows\system32\fzzqbedz.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4992
    • C:\Windows\SysWOW64\nydglpcdoskfaqb.exe
      nydglpcdoskfaqb.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3048
    • C:\Windows\SysWOW64\fzzqbedz.exe
      fzzqbedz.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3320
    • C:\Windows\SysWOW64\iucoahdlhzekh.exe
      iucoahdlhzekh.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4516
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4424

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    255KB

    MD5

    d8c1543aaa78af0b63c36289801b13d2

    SHA1

    5c7e0b8bdebcb784b0b3b5e955a9fd0bb4cbe6df

    SHA256

    b5f80962ae9f64e3c06d83e7366035d3db5135fb6d6310bfcffe404f8d94c94a

    SHA512

    1830502d85c229e4596b339b230d514a9cdba2e068ee947905d332741138f2b4157dc98b81d7c8c520667732112dea016b2f65b65bb9f7568c665b7a111455d7

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    255KB

    MD5

    d269e6347571d14c56a08d7f7b8b75b0

    SHA1

    670fa1ec347943a45a37b5a3926145e687b1301d

    SHA256

    d7c54cb95e03b9b876811daa867f751ee9a503313165811b26e0f95872a60c64

    SHA512

    365bd29f84e69b88f0ffa97e4db509b8a04733332d45f8674c6b52629f9ac14bab353de64761ef87f6922111d2102725051d7e46d422c3479cc4c21b36b6f048

    Download Submit
  • C:\Windows\SysWOW64\fzzqbedz.exe
    Filesize

    255KB

    MD5

    4c368ad0434283a3e320378969db017b

    SHA1

    c54202214999dbfd5d55a6fd01e0e44906b75570

    SHA256

    5c64ecfa3ef7be86e235ba5aa41d4b7a63dc90ec2a41e54b3664b19d15083475

    SHA512

    69f9dc8e9de5a4b8d25240a7b11dee79ba7a937ebcb7014f543db6270c1e47dc4ac73598fb9c7825e0319d93be0549fd7a25a227f02729055e5b97af341fe821

    Download Submit
  • C:\Windows\SysWOW64\fzzqbedz.exe
    Filesize

    255KB

    MD5

    4c368ad0434283a3e320378969db017b

    SHA1

    c54202214999dbfd5d55a6fd01e0e44906b75570

    SHA256

    5c64ecfa3ef7be86e235ba5aa41d4b7a63dc90ec2a41e54b3664b19d15083475

    SHA512

    69f9dc8e9de5a4b8d25240a7b11dee79ba7a937ebcb7014f543db6270c1e47dc4ac73598fb9c7825e0319d93be0549fd7a25a227f02729055e5b97af341fe821

    Download Submit
  • C:\Windows\SysWOW64\fzzqbedz.exe
    Filesize

    255KB

    MD5

    4c368ad0434283a3e320378969db017b

    SHA1

    c54202214999dbfd5d55a6fd01e0e44906b75570

    SHA256

    5c64ecfa3ef7be86e235ba5aa41d4b7a63dc90ec2a41e54b3664b19d15083475

    SHA512

    69f9dc8e9de5a4b8d25240a7b11dee79ba7a937ebcb7014f543db6270c1e47dc4ac73598fb9c7825e0319d93be0549fd7a25a227f02729055e5b97af341fe821

    Download Submit
  • C:\Windows\SysWOW64\iucoahdlhzekh.exe
    Filesize

    255KB

    MD5

    0cdf83bc6e593dbe43a69dcde6d47f3e

    SHA1

    501d56e7b2b5146d59e26158afd97ac1258e2473

    SHA256

    2343444c9b20e15af80506a8d0ae896a45da517c65830b1f0a0ad390ac84f07f

    SHA512

    5f1a89e725fd0e10d05daa15c1fe84d6352db32989f34c6224f08feeea7c04ef16ae59b6cbb18c0b69a20873b439dd67376647db5ab1d2285c118fbd9db73e97

    Download Submit
  • C:\Windows\SysWOW64\iucoahdlhzekh.exe
    Filesize

    255KB

    MD5

    0cdf83bc6e593dbe43a69dcde6d47f3e

    SHA1

    501d56e7b2b5146d59e26158afd97ac1258e2473

    SHA256

    2343444c9b20e15af80506a8d0ae896a45da517c65830b1f0a0ad390ac84f07f

    SHA512

    5f1a89e725fd0e10d05daa15c1fe84d6352db32989f34c6224f08feeea7c04ef16ae59b6cbb18c0b69a20873b439dd67376647db5ab1d2285c118fbd9db73e97

    Download Submit
  • C:\Windows\SysWOW64\iwgzpbcmrn.exe
    Filesize

    255KB

    MD5

    faf183b6e9c8e64b582dcbaf142a5388

    SHA1

    c2d83e1f213baee41366361236bf2701315418c2

    SHA256

    40e0c99ccf44ee16b54f3e5cb1920e2adb6240bfd9f6447cdef8ab099fdaa184

    SHA512

    b5bf4c6f81b144234d30c93148dc36171568443a140b156f872e555d33e4efd567d32089bf40669528d7d76420df389e0b85c9c5bba6ad7821febce3844268e2

    Download Submit
  • C:\Windows\SysWOW64\iwgzpbcmrn.exe
    Filesize

    255KB

    MD5

    faf183b6e9c8e64b582dcbaf142a5388

    SHA1

    c2d83e1f213baee41366361236bf2701315418c2

    SHA256

    40e0c99ccf44ee16b54f3e5cb1920e2adb6240bfd9f6447cdef8ab099fdaa184

    SHA512

    b5bf4c6f81b144234d30c93148dc36171568443a140b156f872e555d33e4efd567d32089bf40669528d7d76420df389e0b85c9c5bba6ad7821febce3844268e2

    Download Submit
  • C:\Windows\SysWOW64\nydglpcdoskfaqb.exe
    Filesize

    255KB

    MD5

    ae7ae6421694ad04f885fa042f9d8903

    SHA1

    e0eb2410dd6196b11485f03c87f6e998973a4879

    SHA256

    b06f61e8821593323ce0928afb7584a5b97c2f5015b72e037483518be2ed99d5

    SHA512

    f19f7152e0ff1e7922e8ebb8d068f6e70625f9d96ea4f7007f0c90fe36ee266cb696b66d0fb29c2e6649a95542a67f3f875eeb2330b587c404d5892bf0eee2cb

    Download Submit
  • C:\Windows\SysWOW64\nydglpcdoskfaqb.exe
    Filesize

    255KB

    MD5

    ae7ae6421694ad04f885fa042f9d8903

    SHA1

    e0eb2410dd6196b11485f03c87f6e998973a4879

    SHA256

    b06f61e8821593323ce0928afb7584a5b97c2f5015b72e037483518be2ed99d5

    SHA512

    f19f7152e0ff1e7922e8ebb8d068f6e70625f9d96ea4f7007f0c90fe36ee266cb696b66d0fb29c2e6649a95542a67f3f875eeb2330b587c404d5892bf0eee2cb

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • memory/1420-158-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1420-149-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1420-132-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/2744-145-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/2744-133-0x0000000000000000-mapping.dmp
    Download
  • memory/3048-146-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/3048-150-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/3048-136-0x0000000000000000-mapping.dmp
    Download
  • memory/3320-147-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/3320-151-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/3320-139-0x0000000000000000-mapping.dmp
    Download
  • memory/4424-171-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-167-0x00007FFB51AB0000-0x00007FFB51AC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-157-0x0000000000000000-mapping.dmp
    Download
  • memory/4424-170-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-159-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-160-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-161-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-162-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-163-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-164-0x00007FFB51AB0000-0x00007FFB51AC0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-172-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4424-173-0x00007FFB54410000-0x00007FFB54420000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4516-141-0x0000000000000000-mapping.dmp
    Download
  • memory/4516-152-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4516-148-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4992-156-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4992-155-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4992-153-0x0000000000000000-mapping.dmp
    Download