Analysis
-
max time kernel
206s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:03
General
-
Target
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe
-
Size
255KB
-
MD5
d86fd9e9ef6f00c85baaebffaa19db7d
-
SHA1
f9d565de0eab70a2257ee48df13f061f810a3845
-
SHA256
7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b
-
SHA512
8b1e9bd0cd244cc2ccbef3ec16ab3f96c4e0314a570274e7ed2d8449cc466fe1e83eb0ab232796589e229507b2cba9c72e1c3b9f8bfe9ddfbdc85fd6e92b22c5
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJP:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI8
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe"C:\Users\Admin\AppData\Local\Temp\7abfe416a48dfd64918a31120647f8c1f9de35d5fc1969ca89c72eb89c681e9b.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zmajcblraa.exezmajcblraa.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ekvwumca.exeC:\Windows\system32\ekvwumca.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cjkaocedzzvbqke.execjkaocedzzvbqke.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ekvwumca.exeekvwumca.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\elxahbcjsohzi.exeelxahbcjsohzi.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD521e5c22e98a0a855b57afb57d0fcadb9
SHA1a2af5d768bc484870746f6453db9407782fe0291
SHA2560da11e4b71bc517f7dbecd15d1159ef0383532eab47dfc5628d5898a71e45c9a
SHA51294e139cd76b686fee29830a858863c74e2fbe7bf203a8094fa75efd9d8e2253b4eda31836334184725ea5b8121aa1167fd6fb9f157860e1ffc6a58a981bff2a7
-
Filesize
255KB
MD5ab93c2bb84a9660eee7f22a353d2e72e
SHA12b322bec6b36ae5006a5b8521bcf5bf457f0c020
SHA256fa760bfb17174d4e4c330ef0523c453662dcd7a351de8be341419fcb5b0c0e83
SHA512491a318666df6e3c5e9dec4bae889d34b483af70860074ae5a24d069ebe8c69fa1bd3b1568d403a32b2a892485a7414325df23d3d8af0a6fbba63d41ae4d7c6d
-
Filesize
255KB
MD5ab93c2bb84a9660eee7f22a353d2e72e
SHA12b322bec6b36ae5006a5b8521bcf5bf457f0c020
SHA256fa760bfb17174d4e4c330ef0523c453662dcd7a351de8be341419fcb5b0c0e83
SHA512491a318666df6e3c5e9dec4bae889d34b483af70860074ae5a24d069ebe8c69fa1bd3b1568d403a32b2a892485a7414325df23d3d8af0a6fbba63d41ae4d7c6d
-
Filesize
255KB
MD517cac3689799118eb5d5c3e71e5580b1
SHA1a7eac573e0dcbf2c1f52c89953564a936c78afc7
SHA256b71c334239ff0ac694f947585fe79b2835dfc5c7b73b4f3ac97aaded800155f9
SHA5124ffc060dc5191a885c7cabc2b0d52ccc24b6698461ea1ebbfbc004da97e8092bdf73e1ddecbad00db21d0c708304c877f88df05514aec0045f4e0100ff07ccb3
-
Filesize
255KB
MD517cac3689799118eb5d5c3e71e5580b1
SHA1a7eac573e0dcbf2c1f52c89953564a936c78afc7
SHA256b71c334239ff0ac694f947585fe79b2835dfc5c7b73b4f3ac97aaded800155f9
SHA5124ffc060dc5191a885c7cabc2b0d52ccc24b6698461ea1ebbfbc004da97e8092bdf73e1ddecbad00db21d0c708304c877f88df05514aec0045f4e0100ff07ccb3
-
Filesize
255KB
MD517cac3689799118eb5d5c3e71e5580b1
SHA1a7eac573e0dcbf2c1f52c89953564a936c78afc7
SHA256b71c334239ff0ac694f947585fe79b2835dfc5c7b73b4f3ac97aaded800155f9
SHA5124ffc060dc5191a885c7cabc2b0d52ccc24b6698461ea1ebbfbc004da97e8092bdf73e1ddecbad00db21d0c708304c877f88df05514aec0045f4e0100ff07ccb3
-
Filesize
255KB
MD520c4ae2bad2fc8b6f1dcd0126a17f804
SHA12b26fd3e00ec16c5a66c2fcd076a4423cc4be2b8
SHA256bffda001a9d1c6fcffce6bb06a1cc761cfb6a325a33f4e51398ebf4937b67f3c
SHA512e65a0d7448e87e412a984e96453875e36f64993c1a9cf7983e35a48247fd95671866c581bba0b8635219bbabfab29ac347713bbbc59cf59e9b54e36070844435
-
Filesize
255KB
MD520c4ae2bad2fc8b6f1dcd0126a17f804
SHA12b26fd3e00ec16c5a66c2fcd076a4423cc4be2b8
SHA256bffda001a9d1c6fcffce6bb06a1cc761cfb6a325a33f4e51398ebf4937b67f3c
SHA512e65a0d7448e87e412a984e96453875e36f64993c1a9cf7983e35a48247fd95671866c581bba0b8635219bbabfab29ac347713bbbc59cf59e9b54e36070844435
-
Filesize
255KB
MD5f1fad13db64f344940001957d4cd5c1e
SHA18f25e9b6dd29b4e04070ba8c3b8be610935584bf
SHA25650c32ac1e83912941bf8296472365e9746361fedc13c4fefef40566b8278acba
SHA51286e44a78dc4ae26f804054b5c765ba5625b36c4c5d65549a80391662405dea7de80fce9ac9d7d8ea556102199a7c0d4fbbdee8f87b7b88db15ce562b7c2a65d8
-
Filesize
255KB
MD5f1fad13db64f344940001957d4cd5c1e
SHA18f25e9b6dd29b4e04070ba8c3b8be610935584bf
SHA25650c32ac1e83912941bf8296472365e9746361fedc13c4fefef40566b8278acba
SHA51286e44a78dc4ae26f804054b5c765ba5625b36c4c5d65549a80391662405dea7de80fce9ac9d7d8ea556102199a7c0d4fbbdee8f87b7b88db15ce562b7c2a65d8
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-