Overview

overview

10

Static

static

8

7a268510a8...f1.exe

windows7-x64

10

7a268510a8...f1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    186s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 21:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a268510a83851b6c3442d1e7111baf53729ad3562bca45d67f364f1ddb7fff1.exe

  • Size

    255KB

  • MD5

    f245eab61c253a24c28a1e410cd0b077

  • SHA1

    f9cdee35ad2005d88ea04503875226ac204584dd

  • SHA256

    7a268510a83851b6c3442d1e7111baf53729ad3562bca45d67f364f1ddb7fff1

  • SHA512

    064365b1b254889eaa7a950f0431d995a32f80bb24166849f94398d5fc76b9f7f186304b98c490169239a51df9cd85752582a72a89c82d6b651547628189b65e

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJi:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3

Score
10/10
evasionpersistencetrojanupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a268510a83851b6c3442d1e7111baf53729ad3562bca45d67f364f1ddb7fff1.exe
    "C:\Users\Admin\AppData\Local\Temp\7a268510a83851b6c3442d1e7111baf53729ad3562bca45d67f364f1ddb7fff1.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Windows\SysWOW64\dmnvifrpfp.exe
      dmnvifrpfp.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Windows\SysWOW64\unbaajdz.exe
        C:\Windows\system32\unbaajdz.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4368
    • C:\Windows\SysWOW64\qrpmxnenkstvnbd.exe
      qrpmxnenkstvnbd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4248
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c yjoxeapnutxrp.exe
        3⤵
          PID:3628
      • C:\Windows\SysWOW64\unbaajdz.exe
        unbaajdz.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2100
      • C:\Windows\SysWOW64\yjoxeapnutxrp.exe
        yjoxeapnutxrp.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4392
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
        2⤵
        • Drops file in Windows directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1288

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Hidden Files and Directories

    2
    T1158

    Registry Run Keys / Startup Folder

    1
    T1060

    Winlogon Helper DLL

    1
    T1004

    Privilege Escalation

    Defense Evasion

    Hidden Files and Directories

    2
    T1158

    Modify Registry

    6
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Discovery

    Query Registry

    4
    T1012

    System Information Discovery

    5
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
      Filesize

      255KB

      MD5

      0e376b81c985c0171c328d14b0fb29e3

      SHA1

      767b20165a46d4354001d99aa32e7c33e8a85109

      SHA256

      7398fa356561091dfc1c6e7a0179079739fa2fc23bfc6763a0a1aa46fc802477

      SHA512

      8bb8f198421e63b8154d567c26b694ed4ed2670ed5bdc636159a6144c6be573219d1ba586f95c2d5b875a0dc639dbeaa604b19344280382d9149532ab9e772ad

      Download Submit
    • C:\Windows\SysWOW64\dmnvifrpfp.exe
      Filesize

      255KB

      MD5

      a24b50ca417ab1e46c3958a2ca1f5d74

      SHA1

      c2042f2ec0f4e94c8bd2eb66edac5827ea04c036

      SHA256

      52db553b680c1dd13650fd994daa4aeab0807b85d4192db54441f67c06add5f4

      SHA512

      8155cfa89c42eb390b2d8f5ad5871b9b08f5f8412b9def69b1adba6b232677a3d2f03781632a44988d7623af6c5db7b1b676626acbe50168d945e1ecfb77d541

      Download Submit
    • C:\Windows\SysWOW64\dmnvifrpfp.exe
      Filesize

      255KB

      MD5

      a24b50ca417ab1e46c3958a2ca1f5d74

      SHA1

      c2042f2ec0f4e94c8bd2eb66edac5827ea04c036

      SHA256

      52db553b680c1dd13650fd994daa4aeab0807b85d4192db54441f67c06add5f4

      SHA512

      8155cfa89c42eb390b2d8f5ad5871b9b08f5f8412b9def69b1adba6b232677a3d2f03781632a44988d7623af6c5db7b1b676626acbe50168d945e1ecfb77d541

      Download Submit
    • C:\Windows\SysWOW64\qrpmxnenkstvnbd.exe
      Filesize

      255KB

      MD5

      4aaf44e360f68ad0530fce7767965772

      SHA1

      996c48617ba4a7436c3eca5ee6c563cfe2bef2db

      SHA256

      76f09c695729151b4d2610d49d030cf6f85f5b80575ecd445a0e63c6554bd707

      SHA512

      ead81ec43d8e86c3d28d6e9905ba00c7f15e79e1839bd0b2c18f6c8bc60d7ed688be366a8985f4aa6daec2317ae7090bfe26625844450292e1882fa1a1f5f8af

      Download Submit
    • C:\Windows\SysWOW64\qrpmxnenkstvnbd.exe
      Filesize

      255KB

      MD5

      4aaf44e360f68ad0530fce7767965772

      SHA1

      996c48617ba4a7436c3eca5ee6c563cfe2bef2db

      SHA256

      76f09c695729151b4d2610d49d030cf6f85f5b80575ecd445a0e63c6554bd707

      SHA512

      ead81ec43d8e86c3d28d6e9905ba00c7f15e79e1839bd0b2c18f6c8bc60d7ed688be366a8985f4aa6daec2317ae7090bfe26625844450292e1882fa1a1f5f8af

      Download Submit
    • C:\Windows\SysWOW64\unbaajdz.exe
      Filesize

      255KB

      MD5

      1bf4a51330117c92f889b9f19a7ad761

      SHA1

      e71adcb3b66b5da3a45ac4980b7171d19a2ef7d7

      SHA256

      a5e5cbe3eea9bed8d048c84ef43dad358de9b20d7ba8b22e676fe31c92cbb6cd

      SHA512

      f71d791446ed4e7ff08d5ac425332062a202bc1100e900e6b40b8e60cdcabc81287fc18fad34dfe720833efe9fcdaf71abe661a926250b9903ff3be2b91ffbcc

      Download Submit
    • C:\Windows\SysWOW64\unbaajdz.exe
      Filesize

      255KB

      MD5

      1bf4a51330117c92f889b9f19a7ad761

      SHA1

      e71adcb3b66b5da3a45ac4980b7171d19a2ef7d7

      SHA256

      a5e5cbe3eea9bed8d048c84ef43dad358de9b20d7ba8b22e676fe31c92cbb6cd

      SHA512

      f71d791446ed4e7ff08d5ac425332062a202bc1100e900e6b40b8e60cdcabc81287fc18fad34dfe720833efe9fcdaf71abe661a926250b9903ff3be2b91ffbcc

      Download Submit
    • C:\Windows\SysWOW64\unbaajdz.exe
      Filesize

      255KB

      MD5

      1bf4a51330117c92f889b9f19a7ad761

      SHA1

      e71adcb3b66b5da3a45ac4980b7171d19a2ef7d7

      SHA256

      a5e5cbe3eea9bed8d048c84ef43dad358de9b20d7ba8b22e676fe31c92cbb6cd

      SHA512

      f71d791446ed4e7ff08d5ac425332062a202bc1100e900e6b40b8e60cdcabc81287fc18fad34dfe720833efe9fcdaf71abe661a926250b9903ff3be2b91ffbcc

      Download Submit
    • C:\Windows\SysWOW64\yjoxeapnutxrp.exe
      Filesize

      255KB

      MD5

      f51fb2df54f263c51062ff085ad52e78

      SHA1

      e15566db66bff92ba6d3197d708f014568d7d7de

      SHA256

      c246debbfd768d2a32a16c92ab41080f44e893bf7eaf597c97a5912afd6949e4

      SHA512

      ebcd9fb756801250a5dfacb00c559b98a94fd5faffb3753303dfc0baf3eb5e2b9a517cbb475468afd5a419ff6af5af632fd9d17d806fc91b7005e62b6dad63cd

      Download Submit
    • C:\Windows\SysWOW64\yjoxeapnutxrp.exe
      Filesize

      255KB

      MD5

      f51fb2df54f263c51062ff085ad52e78

      SHA1

      e15566db66bff92ba6d3197d708f014568d7d7de

      SHA256

      c246debbfd768d2a32a16c92ab41080f44e893bf7eaf597c97a5912afd6949e4

      SHA512

      ebcd9fb756801250a5dfacb00c559b98a94fd5faffb3753303dfc0baf3eb5e2b9a517cbb475468afd5a419ff6af5af632fd9d17d806fc91b7005e62b6dad63cd

      Download Submit
    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit
    • memory/1288-159-0x00007FFEA7AB0000-0x00007FFEA7AC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1288-162-0x00007FFEA54A0000-0x00007FFEA54B0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1288-160-0x00007FFEA54A0000-0x00007FFEA54B0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1288-158-0x00007FFEA7AB0000-0x00007FFEA7AC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1288-155-0x00007FFEA7AB0000-0x00007FFEA7AC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1288-156-0x00007FFEA7AB0000-0x00007FFEA7AC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1288-157-0x00007FFEA7AB0000-0x00007FFEA7AC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1288-152-0x0000000000000000-mapping.dmp
      Download
    • memory/1396-154-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/1396-132-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/2100-146-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/2100-139-0x0000000000000000-mapping.dmp
      Download
    • memory/2100-166-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/3628-148-0x0000000000000000-mapping.dmp
      Download
    • memory/4204-133-0x0000000000000000-mapping.dmp
      Download
    • memory/4204-144-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4204-164-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4248-145-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4248-136-0x0000000000000000-mapping.dmp
      Download
    • memory/4248-165-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4368-150-0x0000000000000000-mapping.dmp
      Download
    • memory/4368-153-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4368-168-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4392-142-0x0000000000000000-mapping.dmp
      Download
    • memory/4392-149-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4392-167-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download