Analysis
-
max time kernel
189s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:03
General
-
Target
77b0ea439c327e12480ff5471a8915900cc95a1b99ab7272675a00ea3e1510f8.exe
-
Size
255KB
-
MD5
eaefe78dd0ca9b0d51a10039bbb94a3f
-
SHA1
cb4a65fbebfcd5a1507d2247e213c1ff54b1b179
-
SHA256
77b0ea439c327e12480ff5471a8915900cc95a1b99ab7272675a00ea3e1510f8
-
SHA512
07c39f5eb8c05eda926c9403d9895836d633c8896405f7990773ee5c9854ab1598a062e4c096743c5331c765f8312a5a3c47795428bdf319850fb875aba2867a
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJd:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI8
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77b0ea439c327e12480ff5471a8915900cc95a1b99ab7272675a00ea3e1510f8.exe"C:\Users\Admin\AppData\Local\Temp\77b0ea439c327e12480ff5471a8915900cc95a1b99ab7272675a00ea3e1510f8.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gofrkpvatl.exegofrkpvatl.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gicjocqw.exeC:\Windows\system32\gicjocqw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\rfiljhtlpbkdkud.exerfiljhtlpbkdkud.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\gicjocqw.exegicjocqw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\nytpbculqkbbl.exenytpbculqkbbl.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD577b6dad312d63aa9e2c6813252983daf
SHA1c78d39d07228c99fe4369cdc81343138b3321e5f
SHA2567089c80a9325a82fa9edc8240401e49755729d635d25a8873eb66bbfb2cb57bb
SHA512cb75e175b4eee51af2ab2b74d546ae5a24e7be8aa947c35245bc32895d68d138ae85c74ec2dcfa72254838f9ef62b83cf5da6f1fdad8f851524924242dfb02cb
-
Filesize
255KB
MD5878d2f691d9aebb502e92bcb520bb456
SHA10315f9edaf501303ce939c5abe68b5cbb9ce74f3
SHA256b054176a852756def97c3ed6e6c7bc4d0a13d6cb1e9b6c58505637fb8016f555
SHA512fedc9b27b9135d12a13ef84d4b12e41553bdb22333bac3f0f6a9676f776ab3d20c5c5f15bcc829f4c116c368189ff1567e5624f2a1b16c4ee8f00d4f178f4c30
-
Filesize
255KB
MD5d8424b163eca9261fb4e02c6f2a4b0aa
SHA176867fcaf7460aa14d1e4b11c52bd42ba051a22b
SHA2563271279070b1a38579d87456ab47ebf7e5a0633d7b776555ce912a8bee7e3f9a
SHA512d446939af9f43c42d876ddcaa3165695031f916af79fa53bfe8628dd8c6045385a8d6758d267d2ee0fce2473f28879daf39df8691e19c246a9401e025711a62f
-
Filesize
255KB
MD5d8424b163eca9261fb4e02c6f2a4b0aa
SHA176867fcaf7460aa14d1e4b11c52bd42ba051a22b
SHA2563271279070b1a38579d87456ab47ebf7e5a0633d7b776555ce912a8bee7e3f9a
SHA512d446939af9f43c42d876ddcaa3165695031f916af79fa53bfe8628dd8c6045385a8d6758d267d2ee0fce2473f28879daf39df8691e19c246a9401e025711a62f
-
Filesize
255KB
MD5d8424b163eca9261fb4e02c6f2a4b0aa
SHA176867fcaf7460aa14d1e4b11c52bd42ba051a22b
SHA2563271279070b1a38579d87456ab47ebf7e5a0633d7b776555ce912a8bee7e3f9a
SHA512d446939af9f43c42d876ddcaa3165695031f916af79fa53bfe8628dd8c6045385a8d6758d267d2ee0fce2473f28879daf39df8691e19c246a9401e025711a62f
-
Filesize
255KB
MD5298bd89bbe095964bff5aa7a30657f30
SHA114bb935dc4e7e1388b270087d04be05e3a85cef2
SHA2567a8aefcefd0050e2858b0a35b9879699942693c14e2de0041a038f3e46bce946
SHA512a0908020495c20f62243cc61a0990afa62b6292ed59b5d5dac60302130de4924ff62a5fab34afcffc1722924724a42a3281784f74f00d1305837272b7a6251fd
-
Filesize
255KB
MD5298bd89bbe095964bff5aa7a30657f30
SHA114bb935dc4e7e1388b270087d04be05e3a85cef2
SHA2567a8aefcefd0050e2858b0a35b9879699942693c14e2de0041a038f3e46bce946
SHA512a0908020495c20f62243cc61a0990afa62b6292ed59b5d5dac60302130de4924ff62a5fab34afcffc1722924724a42a3281784f74f00d1305837272b7a6251fd
-
Filesize
255KB
MD58f36ac331b17bd093a4f69275536c388
SHA173e1a934225894612384b193e14517d278cd320b
SHA25676a5a9f5fd3554765ba344c9194a44b9a0e59a9fd111d5545159c21c82a926a8
SHA5122092f45e554a5abde5fe303ac39d092ab6a89950e321aeeb98edc04e86911de1bae1799e0d3d00aebadd42941979f57364128541964e82d4a9d4aa4ad5e9fe81
-
Filesize
255KB
MD58f36ac331b17bd093a4f69275536c388
SHA173e1a934225894612384b193e14517d278cd320b
SHA25676a5a9f5fd3554765ba344c9194a44b9a0e59a9fd111d5545159c21c82a926a8
SHA5122092f45e554a5abde5fe303ac39d092ab6a89950e321aeeb98edc04e86911de1bae1799e0d3d00aebadd42941979f57364128541964e82d4a9d4aa4ad5e9fe81
-
Filesize
255KB
MD5d808d304db7b551b3b8f429fe3fa94ce
SHA1d860177e9cf682386c76cf2ecde3ab8648b073b0
SHA256d4db9d95feed245676b671ee642fdc1cc858493571492576abbdb1982fda7137
SHA512a24b010f50d86d4e206a3a4a6cf1a84a74486a96af21bd6886d07868baa6f06487d4bf0902b91ad0137de7f2c6f72b9aa47430cbe1ef9052137a7de4e0a919b9
-
Filesize
255KB
MD5d808d304db7b551b3b8f429fe3fa94ce
SHA1d860177e9cf682386c76cf2ecde3ab8648b073b0
SHA256d4db9d95feed245676b671ee642fdc1cc858493571492576abbdb1982fda7137
SHA512a24b010f50d86d4e206a3a4a6cf1a84a74486a96af21bd6886d07868baa6f06487d4bf0902b91ad0137de7f2c6f72b9aa47430cbe1ef9052137a7de4e0a919b9
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB