Analysis
-
max time kernel
210s -
max time network
226s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:02
General
-
Target
9669d6016ea6b09226849a22ae58dce628c2a8d71d88bc618bc56c35200ff5d4.exe
-
Size
255KB
-
MD5
1fc2c5d5c64c2d88634cd24e4054b01b
-
SHA1
350d5ecf1f0f23b7716dac8023044e66efe03c95
-
SHA256
9669d6016ea6b09226849a22ae58dce628c2a8d71d88bc618bc56c35200ff5d4
-
SHA512
8199f32abcf290f507f70230e7882dd5aee9d22d66fffde9435e32fac9ba5ecdee34a5e4ee70eda1cec57e04b35635180fd86913a2c70f353c5606bc03819ea2
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJI:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9669d6016ea6b09226849a22ae58dce628c2a8d71d88bc618bc56c35200ff5d4.exe"C:\Users\Admin\AppData\Local\Temp\9669d6016ea6b09226849a22ae58dce628c2a8d71d88bc618bc56c35200ff5d4.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gnrkfzutmz.exegnrkfzutmz.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\lzfoushy.exeC:\Windows\system32\lzfoushy.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\hutgwcibjwfdhnt.exehutgwcibjwfdhnt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c phbunynoksuaa.exe3⤵
-
C:\Windows\SysWOW64\lzfoushy.exelzfoushy.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\phbunynoksuaa.exephbunynoksuaa.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD552cc73463fc95f7de7f3dcf792c95e25
SHA10da5a6dd19493d4b9fb16da2015aac0e22e362b9
SHA256520d88b21ee995c5e3c104594da3cbd99f9258f8149718a4d894ff360a8cc9e9
SHA5124ca18387453588534659d2d3887b39c49e77c506140d53e7cfeece11766c3a8c48c34ce445c989802a91a6d0a405a4d8a2d10c6e2b36c59de3dc0027ff066e54
-
Filesize
255KB
MD58c866f5128117d5f8cd0c93fe90b4547
SHA179ea48ed944fae069ed234503f98b4d3b7a48b8d
SHA256257b78e2ba2e29557fbfa5500686b2b2063564197238715c74a0470c465fb4dd
SHA512a7bfa7de733c01ceb1b9824c0d4931dbbb835793e7c8445f349eb19250659bfee2f1eacd3d57581f4bb99f9fd0f72a638f0335ec4783e95d0c48ef13c3313152
-
Filesize
255KB
MD59bad2c546d4ce5f93dba6806351d69f2
SHA156a125601e134452f088602511943736aa81eacb
SHA256cca8bca282683ba00a4f20f6c5fc4758da78e04c6bcf4934ef022f45c7cd5886
SHA512dedfe27dafa44553531676049d60c0fb9f8dd7b72a4db531dc3972ac938c047332a7daf30a4ef94d67cdaab55f3b8431c1dd39c41217ebbc8e75d0d7ca3a13a5
-
Filesize
255KB
MD59bad2c546d4ce5f93dba6806351d69f2
SHA156a125601e134452f088602511943736aa81eacb
SHA256cca8bca282683ba00a4f20f6c5fc4758da78e04c6bcf4934ef022f45c7cd5886
SHA512dedfe27dafa44553531676049d60c0fb9f8dd7b72a4db531dc3972ac938c047332a7daf30a4ef94d67cdaab55f3b8431c1dd39c41217ebbc8e75d0d7ca3a13a5
-
Filesize
255KB
MD5b42386dafea54c24a6bfe0e9ad48630f
SHA196d2dd1a54520049a1b8fe22a11ab75657f8ff5c
SHA256caa2615068c4b4a1a6e7eea01586dfe79263e636bf67619095c2e9c3b8dfaf99
SHA5127d95b73549a73ea5cfca85eb83821e8a540e501a1458ff7d7923ee66ae77f1cac20d96f00f92398dda8866b4c9633b1ababeb71acf205fe8545595d9a0bb5cde
-
Filesize
255KB
MD5b42386dafea54c24a6bfe0e9ad48630f
SHA196d2dd1a54520049a1b8fe22a11ab75657f8ff5c
SHA256caa2615068c4b4a1a6e7eea01586dfe79263e636bf67619095c2e9c3b8dfaf99
SHA5127d95b73549a73ea5cfca85eb83821e8a540e501a1458ff7d7923ee66ae77f1cac20d96f00f92398dda8866b4c9633b1ababeb71acf205fe8545595d9a0bb5cde
-
Filesize
255KB
MD57c6dfe2af472e8306c68baa59b5406bc
SHA1ad318b3393a044e78442136a4877eb2354e084d8
SHA256d8a5b3b11995248c623acdb0f8b47f6e6bd319c74725ceed4d85534c5c33dbb2
SHA51260853881fa456982bede098c5b70fca4b3f2060fd2c8c751e64d773ff581f6974a20c174b55dedefd98b8a96029edd93f2af9208e10b1a4c37bf73209d5adcc8
-
Filesize
255KB
MD57c6dfe2af472e8306c68baa59b5406bc
SHA1ad318b3393a044e78442136a4877eb2354e084d8
SHA256d8a5b3b11995248c623acdb0f8b47f6e6bd319c74725ceed4d85534c5c33dbb2
SHA51260853881fa456982bede098c5b70fca4b3f2060fd2c8c751e64d773ff581f6974a20c174b55dedefd98b8a96029edd93f2af9208e10b1a4c37bf73209d5adcc8
-
Filesize
255KB
MD57c6dfe2af472e8306c68baa59b5406bc
SHA1ad318b3393a044e78442136a4877eb2354e084d8
SHA256d8a5b3b11995248c623acdb0f8b47f6e6bd319c74725ceed4d85534c5c33dbb2
SHA51260853881fa456982bede098c5b70fca4b3f2060fd2c8c751e64d773ff581f6974a20c174b55dedefd98b8a96029edd93f2af9208e10b1a4c37bf73209d5adcc8
-
Filesize
255KB
MD5eae685e7e11d318804a57651f7d32023
SHA1b9ec9adf6e624d1161ee10026affd0136cebf62d
SHA2564c6370c6e764ff48b631ef3929a3ecc801105cb688bd4211ae50ffb341d9c3a9
SHA5124250875617f0cd72c3f7ce916d2c52101d0f612dec3082354f2035d12d55548f03c99c2e6f452a668fd064e3da96d9703d7603cd413b128d888b3083c90fa7fb
-
Filesize
255KB
MD5eae685e7e11d318804a57651f7d32023
SHA1b9ec9adf6e624d1161ee10026affd0136cebf62d
SHA2564c6370c6e764ff48b631ef3929a3ecc801105cb688bd4211ae50ffb341d9c3a9
SHA5124250875617f0cd72c3f7ce916d2c52101d0f612dec3082354f2035d12d55548f03c99c2e6f452a668fd064e3da96d9703d7603cd413b128d888b3083c90fa7fb
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD58c866f5128117d5f8cd0c93fe90b4547
SHA179ea48ed944fae069ed234503f98b4d3b7a48b8d
SHA256257b78e2ba2e29557fbfa5500686b2b2063564197238715c74a0470c465fb4dd
SHA512a7bfa7de733c01ceb1b9824c0d4931dbbb835793e7c8445f349eb19250659bfee2f1eacd3d57581f4bb99f9fd0f72a638f0335ec4783e95d0c48ef13c3313152
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-