Analysis
-
max time kernel
158s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 21:02
General
-
Target
91004537d91f5e6726223b123103f27bb81eeded38687a4886b6c3391d1a9820.exe
-
Size
255KB
-
MD5
972b93400b3f8b0f1d1307b2c8d8b5e1
-
SHA1
cda8aa62a48578c21758a09f776b15b79d73aa09
-
SHA256
91004537d91f5e6726223b123103f27bb81eeded38687a4886b6c3391d1a9820
-
SHA512
2939b1939ae4bc84eb67a69362b21e58b8c3e9cbd09cc2854de278dcb0788f2507e7ac95be7c9a24c2b270ca9c87c3e6e09b9257b315ee9d67827bb4d29a2aa6
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJl:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIY
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91004537d91f5e6726223b123103f27bb81eeded38687a4886b6c3391d1a9820.exe"C:\Users\Admin\AppData\Local\Temp\91004537d91f5e6726223b123103f27bb81eeded38687a4886b6c3391d1a9820.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dzunqrfxzo.exedzunqrfxzo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\qvzmxqcm.exeC:\Windows\system32\qvzmxqcm.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\edktuxxjacubxwr.exeedktuxxjacubxwr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\qvzmxqcm.exeqvzmxqcm.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\jorduvbddomvo.exejorduvbddomvo.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5d8e2264363c1d495cf65af60d9e719fe
SHA1f75f5f7862a1c3afad061df67da2d95bf7fc57ee
SHA256408ae58358bff7ddfff37640441ef8aa5ca988221c25cd58ef5d55053eebfd88
SHA512581b5f3fc0fc855a36a28b717ac2e89cfcc0903c6a0d3567eba404e75557cdfbdf175b71ee36f819fdd0d5e482d3be852a05599ddda04b6deb820c0dae19c836
-
Filesize
255KB
MD53b4c1c329fec56f51cbea9fa61522f27
SHA100c0847261f86c28e67c5753f9a3809b9365f880
SHA256fb5161dd82ef4c00a5d1c198a7aa897717c4ea7f67f26e0f1c655fc4c4805ed2
SHA512ef3afe288983d8f50b56e5bca858290ccf954091b0aa2febcf343c94d8e14c2337543334b69833774c96b2452f2b8849ef88ee460d4e2bb5cd372932a6812d43
-
Filesize
255KB
MD5a55fcbc60b93d480c54b6bd722f9f9c7
SHA17800b830c6e34f94a6e4b710454a9d625e3c67be
SHA25641dac7e05a08742f284115d27bc74a1b2264e398d4f6397fa13f46ff092428d0
SHA51232c036b970ad3f1df61f58f40e7962e3aa990b8a6f67e9450e135c57eec53a33b0e748531c0badd918157bd4dee37c5ed291e2a5f310b773bf7aa5575b8c96ae
-
Filesize
255KB
MD5a55fcbc60b93d480c54b6bd722f9f9c7
SHA17800b830c6e34f94a6e4b710454a9d625e3c67be
SHA25641dac7e05a08742f284115d27bc74a1b2264e398d4f6397fa13f46ff092428d0
SHA51232c036b970ad3f1df61f58f40e7962e3aa990b8a6f67e9450e135c57eec53a33b0e748531c0badd918157bd4dee37c5ed291e2a5f310b773bf7aa5575b8c96ae
-
Filesize
255KB
MD5e810de2dc96e9bf6dddb1930eaa03f78
SHA12fcdcea3a028e1ea740775f6c4d38bf347b4d149
SHA25658848a023cffe6d748f0a9330a46c54498fa02dee8ef41ee72191d94443d03cc
SHA512d25e6fcb56f823a7563296cf0a3685680294e152b46ad08793eb44d3a1850cae32ce9d79f97989c8f0af9ac33635e963587cb46e2d47a0267d63d66c2209b647
-
Filesize
255KB
MD5e810de2dc96e9bf6dddb1930eaa03f78
SHA12fcdcea3a028e1ea740775f6c4d38bf347b4d149
SHA25658848a023cffe6d748f0a9330a46c54498fa02dee8ef41ee72191d94443d03cc
SHA512d25e6fcb56f823a7563296cf0a3685680294e152b46ad08793eb44d3a1850cae32ce9d79f97989c8f0af9ac33635e963587cb46e2d47a0267d63d66c2209b647
-
Filesize
255KB
MD5b545847be4d35a019042f81ba4810470
SHA1dfc65ae1398e29994edb417293e389a63a2dd995
SHA256b9fb53ebb187c1a4b7b72e71460993355a60b197a3ff549bc48efc9b5752ece1
SHA5127310b2e1658607003c7df83d3fc70f5401d5d3c1087e09cf1c8178769f8e84b68b2bdea0fbb63763dbc5a82cda95af02172dc66281eb08638f4f06b04465106e
-
Filesize
255KB
MD5b545847be4d35a019042f81ba4810470
SHA1dfc65ae1398e29994edb417293e389a63a2dd995
SHA256b9fb53ebb187c1a4b7b72e71460993355a60b197a3ff549bc48efc9b5752ece1
SHA5127310b2e1658607003c7df83d3fc70f5401d5d3c1087e09cf1c8178769f8e84b68b2bdea0fbb63763dbc5a82cda95af02172dc66281eb08638f4f06b04465106e
-
Filesize
255KB
MD57d1959a46f62586437671621ad799006
SHA1d3b09439d75855c9e3adc30641af3baa09605f60
SHA256b27497ce1c37f2c069bd084302f3651325f80be25e630b4f017d05e56e883ded
SHA5123677ae654e211d0a298f69d14725879a1a068ae6cbac14baaf0d453dbdfb30d8416151b58597f57fd21ecc74e803683501853a34dbe6d5cd6d171d42fa40e39f
-
Filesize
255KB
MD57d1959a46f62586437671621ad799006
SHA1d3b09439d75855c9e3adc30641af3baa09605f60
SHA256b27497ce1c37f2c069bd084302f3651325f80be25e630b4f017d05e56e883ded
SHA5123677ae654e211d0a298f69d14725879a1a068ae6cbac14baaf0d453dbdfb30d8416151b58597f57fd21ecc74e803683501853a34dbe6d5cd6d171d42fa40e39f
-
Filesize
255KB
MD5ebe3bb67b80897117b26751fea3befee
SHA1473eef0dff6d9cfc0131384a17ff1861ddbed7c0
SHA256407d314a6ae078242fbf191eb30a86440f08dafabe3e1a3d32d75df81a721f9e
SHA512318735e929fac0136baaf67cd558b3ccc6668e9237d141856e851e5348ea467b9d2881f57ff7847e6b4dd02296bffa67ce5e33854434b2ced5e544640cf41fbc
-
Filesize
255KB
MD5ebe3bb67b80897117b26751fea3befee
SHA1473eef0dff6d9cfc0131384a17ff1861ddbed7c0
SHA256407d314a6ae078242fbf191eb30a86440f08dafabe3e1a3d32d75df81a721f9e
SHA512318735e929fac0136baaf67cd558b3ccc6668e9237d141856e851e5348ea467b9d2881f57ff7847e6b4dd02296bffa67ce5e33854434b2ced5e544640cf41fbc
-
Filesize
255KB
MD5ebe3bb67b80897117b26751fea3befee
SHA1473eef0dff6d9cfc0131384a17ff1861ddbed7c0
SHA256407d314a6ae078242fbf191eb30a86440f08dafabe3e1a3d32d75df81a721f9e
SHA512318735e929fac0136baaf67cd558b3ccc6668e9237d141856e851e5348ea467b9d2881f57ff7847e6b4dd02296bffa67ce5e33854434b2ced5e544640cf41fbc
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5899c640aa2f530871ac5b27318e022b3
SHA10100228c4401d825dfe7b46be1132e98d38d9d66
SHA256112b1bc6f6ca1513da5b44cc995c8a8b9912ef79f7909e0651295d5d858f1ded
SHA51243d58bd2bc2a6bf5156a50b9bef2babad0d9099e0c798efb56da5d567d0052613d77973e3e7e7e47bb299c1bb7a40230505218a1ed78969280da4f4e571970e5
-
Filesize
255KB
MD5899c640aa2f530871ac5b27318e022b3
SHA10100228c4401d825dfe7b46be1132e98d38d9d66
SHA256112b1bc6f6ca1513da5b44cc995c8a8b9912ef79f7909e0651295d5d858f1ded
SHA51243d58bd2bc2a6bf5156a50b9bef2babad0d9099e0c798efb56da5d567d0052613d77973e3e7e7e47bb299c1bb7a40230505218a1ed78969280da4f4e571970e5
-
Filesize
255KB
MD5b328567dceda6a37079e007b6290a376
SHA1ac4e76a3ebfe240d01f762857a6143bfc3ad2f39
SHA25679d4c6dad099bbb3896ccb5a8283fbeb56490ae051c9a9a248a5459a5fbf67d5
SHA512f17a18863cdaa1abd114058ed634dbd4d10edb5a32bddcef3af2c24667041b32be605ef320814234a82fba78919c44e266bfb86043d4c42f50d836d17f7fd6e4
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB