Analysis
-
max time kernel
153s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:03
General
-
Target
74d571874b16696455072cc62e37ddf032e9856c4faa92c583f0b37218b26f2f.exe
-
Size
255KB
-
MD5
ae43e6be2ce789ba4d5185b6d242adda
-
SHA1
50a717c9f14eea606c03def87b76828a7b343edb
-
SHA256
74d571874b16696455072cc62e37ddf032e9856c4faa92c583f0b37218b26f2f
-
SHA512
6fc10aca0d04b8194affcbb20a778144678d8e5c1a91c300c32723e0b200533dcc1076ed08b14553dc364f6c32273153f80fecab3b814593b9c41c1b57171988
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJc:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI/
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74d571874b16696455072cc62e37ddf032e9856c4faa92c583f0b37218b26f2f.exe"C:\Users\Admin\AppData\Local\Temp\74d571874b16696455072cc62e37ddf032e9856c4faa92c583f0b37218b26f2f.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dfbdflarro.exedfbdflarro.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vuulpuiw.exeC:\Windows\system32\vuulpuiw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\qnqniupmnbynccy.exeqnqniupmnbynccy.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c lyhzrywffbbqn.exe3⤵
-
C:\Windows\SysWOW64\vuulpuiw.exevuulpuiw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\lyhzrywffbbqn.exelyhzrywffbbqn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD54040e1d18cb10be1f944e36d31c3402f
SHA1f85edd641cf19e4db35ab2aa0183af2e7f86be2b
SHA256d40ac52e295b5831f5ef1e444f499b47d37565c66856718634e3349d6f142f26
SHA512e3d5cf24d68420f3362dc30dee03e25cae2b84223d43016c97a0f27271f8d71cc93256db40681e5146f1c5a6b4566d1c5e32d1a99fc6fb3c31f58492cdda13e4
-
Filesize
255KB
MD5319dc2ce4907cabbc04282263af0ebad
SHA136606efd63fdf3f5851e713d6585f92c53427d5c
SHA25617f0ebcede6159ed2644d3cc14708b23ea851882eea1a4178b3f79b70a5ecedc
SHA5127e7dc4a5a75b34e7e7235ddb2cf5ce1f0d1cf5a72b4378d49f19937d9b8d551207626e59e557f97460097eda99f712c4a64ec2a59934f4107dc4dbbc1080f024
-
Filesize
255KB
MD541e201a7262974d165d2daed2c280727
SHA1d76fc0c55f09f1ec480082fcf0c6aaf9c64e5610
SHA256b0cee2b2163827505f22af1d211e8a450941bec6236e6d09c0bac829aa4d3964
SHA5122c64aea8da828c741bce6315dfab3db2d843984caec67c8ba02a20d70521126c87268ab7a4e6003a0a0b634126ec0b00a99b00fb4cee3abd31d1f09f0d760f21
-
Filesize
255KB
MD541e201a7262974d165d2daed2c280727
SHA1d76fc0c55f09f1ec480082fcf0c6aaf9c64e5610
SHA256b0cee2b2163827505f22af1d211e8a450941bec6236e6d09c0bac829aa4d3964
SHA5122c64aea8da828c741bce6315dfab3db2d843984caec67c8ba02a20d70521126c87268ab7a4e6003a0a0b634126ec0b00a99b00fb4cee3abd31d1f09f0d760f21
-
Filesize
255KB
MD51e0fc1c9044f556a8b9f836898298e41
SHA12bfcf3fc3bde9e9ef257ca633da640de4f72cacd
SHA25639704dd63f8f51f2ddb99b85d710e2814f51d96d2a043cc3a19d07e9ff5cbbf9
SHA512494012d027c94f4472166597d60612c57251b1353affcb1bdadd2d41189f334ea8dd7073ca3a2041025ed6f9a2998e28669f857d99280eb482fc96fcf06556d7
-
Filesize
255KB
MD51e0fc1c9044f556a8b9f836898298e41
SHA12bfcf3fc3bde9e9ef257ca633da640de4f72cacd
SHA25639704dd63f8f51f2ddb99b85d710e2814f51d96d2a043cc3a19d07e9ff5cbbf9
SHA512494012d027c94f4472166597d60612c57251b1353affcb1bdadd2d41189f334ea8dd7073ca3a2041025ed6f9a2998e28669f857d99280eb482fc96fcf06556d7
-
Filesize
255KB
MD5d518afeb1488ce85cfdf9440cd7d513c
SHA187db6ee93c3e1af0e6bdbb04d2b2489e3b477ec8
SHA25674b7af957e2a2668b3cd6ed1409cc37814b728f67d2c0b55bea68ed34001ec5f
SHA51241f8f723616f916415b4920f0243683a70b2d8dd11b0a1bc065e2552fbad70d5054499597f9e06d5fca42d6ecb38c919e9fa490b5ded52496ea526e7b8e662d8
-
Filesize
255KB
MD5d518afeb1488ce85cfdf9440cd7d513c
SHA187db6ee93c3e1af0e6bdbb04d2b2489e3b477ec8
SHA25674b7af957e2a2668b3cd6ed1409cc37814b728f67d2c0b55bea68ed34001ec5f
SHA51241f8f723616f916415b4920f0243683a70b2d8dd11b0a1bc065e2552fbad70d5054499597f9e06d5fca42d6ecb38c919e9fa490b5ded52496ea526e7b8e662d8
-
Filesize
255KB
MD59c735fcd392b3351464befaf4d8829f9
SHA123ac8656364ba7f252efed38540568dfd1bd8a9e
SHA256b567af00f85ed2379bf08ea638b7f9db69d182fe232dc186b5515ff729d8eebc
SHA51221ad5d26bd785de4cc9c306083c94fbf5faa5ba43e70f516976debdf29c1e1f48363a04299b2e55a295e60b4f3bac159a9dd6cf8f7d71ad3e8525add64112aba
-
Filesize
255KB
MD59c735fcd392b3351464befaf4d8829f9
SHA123ac8656364ba7f252efed38540568dfd1bd8a9e
SHA256b567af00f85ed2379bf08ea638b7f9db69d182fe232dc186b5515ff729d8eebc
SHA51221ad5d26bd785de4cc9c306083c94fbf5faa5ba43e70f516976debdf29c1e1f48363a04299b2e55a295e60b4f3bac159a9dd6cf8f7d71ad3e8525add64112aba
-
Filesize
255KB
MD59c735fcd392b3351464befaf4d8829f9
SHA123ac8656364ba7f252efed38540568dfd1bd8a9e
SHA256b567af00f85ed2379bf08ea638b7f9db69d182fe232dc186b5515ff729d8eebc
SHA51221ad5d26bd785de4cc9c306083c94fbf5faa5ba43e70f516976debdf29c1e1f48363a04299b2e55a295e60b4f3bac159a9dd6cf8f7d71ad3e8525add64112aba
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB