Analysis
-
max time kernel
157s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:04
General
-
Target
7085afb19783f55fbced2866e84a2821844a009919449bbbd2010c9a98b2a837.exe
-
Size
255KB
-
MD5
5c68735ba52464db85df70858967d36b
-
SHA1
19d9a8d363dc9851aade058645567a600d1b2246
-
SHA256
7085afb19783f55fbced2866e84a2821844a009919449bbbd2010c9a98b2a837
-
SHA512
40989030de16f6a2799ad83114c2c122f97b035ccb8a184ace4de0c9db01a3d9b7ab877bb6397e0d03ddc785ab26f77dffd23ddf6ec83c9b135eea22febad514
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJu:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIH
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 27 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7085afb19783f55fbced2866e84a2821844a009919449bbbd2010c9a98b2a837.exe"C:\Users\Admin\AppData\Local\Temp\7085afb19783f55fbced2866e84a2821844a009919449bbbd2010c9a98b2a837.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dmnvifrpfp.exedmnvifrpfp.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unbaajdz.exeC:\Windows\system32\unbaajdz.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\qrpmxnenkstvnbd.exeqrpmxnenkstvnbd.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\unbaajdz.exeunbaajdz.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\yjoxeapnutxrp.exeyjoxeapnutxrp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5e7acad442d9798436ea8fee43f3037f9
SHA19d38bc802c1e863b7b74a61690d590380fb618ec
SHA2565d37559da096e5a9dc274572759b7e44d0c130400c4e7931a0e4da897f71d51f
SHA512b60c709fcdc71954d454b03290fce706e91df019001f113d6c020ffeb9b8e9b7a9297cbdf09dc54f1523f97bfaee0bd06dc935f16d46c39fe9bc12c9289f899d
-
Filesize
255KB
MD5ce1cc45782847d7c410f0120a7f50cf3
SHA1095158abb5f86f70bd2b9c358f1adbe871a6b263
SHA256b4663c6439953d5c7e6fc4105d6b59db2c999a08e3eca372b75c8137a8e607c8
SHA512afe37d8c6365f7c05de8de32785a5d944ebf18c018a04359c73573a0f4f5dfe82a647a113c5cc056a5c2c5540dd4661bb41cd6ccab782f5971fd3fec77f2f135
-
Filesize
255KB
MD51240794601d752594638ea573924ed42
SHA1ffb2b8bbc344e0f26aff18059898958d23054519
SHA25689cb588c74248df3d38ffe24459f0b048d01ba8a9c367e312cc247985c8537bf
SHA512d87505eeb4f9e56ba41f4c0caffb013b1d1762717c2d6b89e6e464f9cde18e80d21f826e9bfafce300eb3efdd7bc1143a1c30115ad145c024a04495f2fcfbab3
-
Filesize
255KB
MD55dfc66a7df24c18a34577a2ffffc2ba7
SHA196f5bb425ce6f171be0aafd49752b87736406069
SHA2564eb0335f8c7240478656caf98c497f0e2edb9e96a7a9bc69d300435364612ca6
SHA512d043c4ffcb473156e539fe941eaafa44110e39e0130a58d5a6551ea73be862d48818cd870615bfe48c92ea997fae632f462fe728ad4d8d4d595135630be0a0a9
-
Filesize
255KB
MD54a2d60d1e89f6b4206bcf200fe9f1928
SHA1fb4905e9d242c213a989e4261b9257f869b24756
SHA2568e687272b43310d92ec329a44d31d9350b9f9354e07c7f2d6432296c25d05b11
SHA512d99d39b007301fef940fbfea1c6e89c6dd7ca1e8850b47787267e0cf8a288bb38935920e1e41fb960232980d9796f940e84c24c79ff70caf10dbac050a8a7bb3
-
Filesize
255KB
MD566785240b6cb2a1f1173a4bae0d81393
SHA142e39a979d22d6b6286a75f9cc812ece852a190b
SHA256674b7223601f8f5e221de97c20a838e7fe4ef87dd40bae1bb37b29f555d53910
SHA51267aa35664e8276b15ee3286208309f71ffa96b26173cc7910fbfe8ebfc12104b768ca0d02637ad5fdf0e611f1db34ecb66024fc79db4b874cec010c2bd97b5ce
-
Filesize
255KB
MD566785240b6cb2a1f1173a4bae0d81393
SHA142e39a979d22d6b6286a75f9cc812ece852a190b
SHA256674b7223601f8f5e221de97c20a838e7fe4ef87dd40bae1bb37b29f555d53910
SHA51267aa35664e8276b15ee3286208309f71ffa96b26173cc7910fbfe8ebfc12104b768ca0d02637ad5fdf0e611f1db34ecb66024fc79db4b874cec010c2bd97b5ce
-
Filesize
255KB
MD5be03b389903cee0be491e5ecd4e2b067
SHA17c9d2f67e445e98b6a1302084e400731c8190039
SHA25601f5d8d25bad611eb239a2580221949a800de500e44ee2fdcaa957a88c8304c1
SHA5129379ae17cad36c881826d1bf834550948389c1d55a50e6cd79181c56de7410f256dc1ae3ca4e6f8744c0524edbb5dc63eb8bdc5215247a57a552fdfa70167f03
-
Filesize
255KB
MD5be03b389903cee0be491e5ecd4e2b067
SHA17c9d2f67e445e98b6a1302084e400731c8190039
SHA25601f5d8d25bad611eb239a2580221949a800de500e44ee2fdcaa957a88c8304c1
SHA5129379ae17cad36c881826d1bf834550948389c1d55a50e6cd79181c56de7410f256dc1ae3ca4e6f8744c0524edbb5dc63eb8bdc5215247a57a552fdfa70167f03
-
Filesize
255KB
MD59869750614b84c6f7b68e41b57ac1f6f
SHA1d4768d2f8f74749d2ee02d17e6e0fc881bd0f6d3
SHA256d5904d00385093e461e5063ed3b5524c6c5ccbfad1abbe907b40d5df7784cecd
SHA5125009ad89df36c15bbb2f9aba8a8aa25ab6802a00932018c5843c1cc91af7ca69e056f238097867e1452b3cc3b1bcc2100d224e6e21d7097e1cf7250b2dbf1286
-
Filesize
255KB
MD59869750614b84c6f7b68e41b57ac1f6f
SHA1d4768d2f8f74749d2ee02d17e6e0fc881bd0f6d3
SHA256d5904d00385093e461e5063ed3b5524c6c5ccbfad1abbe907b40d5df7784cecd
SHA5125009ad89df36c15bbb2f9aba8a8aa25ab6802a00932018c5843c1cc91af7ca69e056f238097867e1452b3cc3b1bcc2100d224e6e21d7097e1cf7250b2dbf1286
-
Filesize
255KB
MD59869750614b84c6f7b68e41b57ac1f6f
SHA1d4768d2f8f74749d2ee02d17e6e0fc881bd0f6d3
SHA256d5904d00385093e461e5063ed3b5524c6c5ccbfad1abbe907b40d5df7784cecd
SHA5125009ad89df36c15bbb2f9aba8a8aa25ab6802a00932018c5843c1cc91af7ca69e056f238097867e1452b3cc3b1bcc2100d224e6e21d7097e1cf7250b2dbf1286
-
Filesize
255KB
MD510457de2897a5d4f15e07f79798c4cef
SHA1fa643e5fa1c5275fe79137bf4e5cccef23d93279
SHA256edb56f00708dbfce5858f16849f503d1de6aa37ad843cb1cae9fb08f386a558d
SHA512b7394613b99e0bdad19372690b9722714aeee57a297627f940baf92b370d438d5f2590c53768049f1f50c152993cd862c6a731129b8a41b97d6a5a0133f3e08b
-
Filesize
255KB
MD510457de2897a5d4f15e07f79798c4cef
SHA1fa643e5fa1c5275fe79137bf4e5cccef23d93279
SHA256edb56f00708dbfce5858f16849f503d1de6aa37ad843cb1cae9fb08f386a558d
SHA512b7394613b99e0bdad19372690b9722714aeee57a297627f940baf92b370d438d5f2590c53768049f1f50c152993cd862c6a731129b8a41b97d6a5a0133f3e08b
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD52b8154f5393ed445fdbeb6a6c2598709
SHA172101ae1f7f945e947ec406d4944e79b04a10321
SHA25698f92ccede30f219c8d85c92be6ea238f6908f5d6e5ae1bd9f4d9a7e7e9040e1
SHA51283ae51fecf722c5bf9d01f68203d40c47fa50ea916ff7f38e63f8678456963b32804784b18d63f7f973e03db9e9ad68a6f88b55e32ff21e92e229a08a64a0289
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB