Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:04
General
-
Target
6fd331710ba2ba95c8da836a4804f2de20b76452e40803d2022fda04176acd10.exe
-
Size
255KB
-
MD5
5914feb2b958d5cf6ff20bc83c5ed5fa
-
SHA1
ca150f84117f57342ca485b018e18a0ff721ef98
-
SHA256
6fd331710ba2ba95c8da836a4804f2de20b76452e40803d2022fda04176acd10
-
SHA512
3998dac53f551169afbb6c8b6dc3b87c08effc4c1d5c7fc3fccbe003f254b6203ac076b095d6c2bf6e06e86b3b29ada556964db2e378010d32462d8ac8db2f1a
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJb:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIK
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 16 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fd331710ba2ba95c8da836a4804f2de20b76452e40803d2022fda04176acd10.exe"C:\Users\Admin\AppData\Local\Temp\6fd331710ba2ba95c8da836a4804f2de20b76452e40803d2022fda04176acd10.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmfdfpbata.execmfdfpbata.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\upirmvcp.exeC:\Windows\system32\upirmvcp.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ijmwrxaxlvnlbqs.exeijmwrxaxlvnlbqs.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\upirmvcp.exeupirmvcp.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\pbnaxwdwwmaba.exepbnaxwdwwmaba.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD534bf3b84b9230de530bba67611ba7cf8
SHA18613cc544b5fbf9c4ae66cbd46b33e6e376ba6ae
SHA25662d8837e82fdbdb84ce00b1b0f40483b75734ef79a37e994fa30b34b5973767d
SHA512b419e98a6a59ca4038773f8a1fde79ece4a7289f88d17eeba1e26f630ef4229a9487f509fbb5d2b97ce06864cfbfe5a7cf454790dd2a9ccaf73c3c20714ff2cf
-
Filesize
255KB
MD534bf3b84b9230de530bba67611ba7cf8
SHA18613cc544b5fbf9c4ae66cbd46b33e6e376ba6ae
SHA25662d8837e82fdbdb84ce00b1b0f40483b75734ef79a37e994fa30b34b5973767d
SHA512b419e98a6a59ca4038773f8a1fde79ece4a7289f88d17eeba1e26f630ef4229a9487f509fbb5d2b97ce06864cfbfe5a7cf454790dd2a9ccaf73c3c20714ff2cf
-
Filesize
255KB
MD5c68a36a739506d37d225e6d041901463
SHA15ff6957e063195574b93051242d83c6271634215
SHA256e5583c4653385d587aedd8166b9b603543fce3376a79ca9e49bd9775dff3400f
SHA512eea26997b5a3321acb60a1d4525cb93f5318a3d1e356c0900f64fb7646373643c6b53dcd158f56c066e3caeac2ad5f9b4c62bed5d0a3fbfd15163bc7803ff16c
-
Filesize
255KB
MD5210bfb742296f8d29da639b1ba25725a
SHA1c4d82a84806a1d2bc4048f88e4ad072a9a2899d7
SHA256f5ddbea6d44b514308b5286e65fae93b32ad6e72b106ca8687702ef91f3ac32c
SHA5120d6d12464ba22443a4683fefc41f8d76c4c382407b6f60480a1b8e13b7497a71f29d1b6df4b93a9df216c7306c9ab33a621f40653b170d3b3117507b01e55d62
-
Filesize
255KB
MD5210bfb742296f8d29da639b1ba25725a
SHA1c4d82a84806a1d2bc4048f88e4ad072a9a2899d7
SHA256f5ddbea6d44b514308b5286e65fae93b32ad6e72b106ca8687702ef91f3ac32c
SHA5120d6d12464ba22443a4683fefc41f8d76c4c382407b6f60480a1b8e13b7497a71f29d1b6df4b93a9df216c7306c9ab33a621f40653b170d3b3117507b01e55d62
-
Filesize
255KB
MD5f207d6d0bab49b1497eb24bf4938c856
SHA1a2956c7e4543acac4932e8c373ba568ec43f668e
SHA256e8b871b6928c88cb1c44c430c6dd9d1ba015cea17b85bd04d2790c259a24de4e
SHA51241c0f8cd140140e53d95b93c988bddef86aed533b4e41ec7644ac8bdb596f6eafd6cf9717d02d101d426f8824cd2126a75413418f3435fe931a7f7472d682771
-
Filesize
255KB
MD5f207d6d0bab49b1497eb24bf4938c856
SHA1a2956c7e4543acac4932e8c373ba568ec43f668e
SHA256e8b871b6928c88cb1c44c430c6dd9d1ba015cea17b85bd04d2790c259a24de4e
SHA51241c0f8cd140140e53d95b93c988bddef86aed533b4e41ec7644ac8bdb596f6eafd6cf9717d02d101d426f8824cd2126a75413418f3435fe931a7f7472d682771
-
Filesize
255KB
MD5617f75e04f6835913fd37f2e3c412495
SHA1fbec9ea08fbaa5ee0d00e3336f0f06f32f28ecf2
SHA25687d08d34ecfbfd657b477f334108f59b4762953d1f5a1e1676e36cfda85e2ea3
SHA5121a3eb5ef81f2ad46ee0831a8eb84a371601199f2f61600ca7cfcb7141bcd10757bb9655851def3bd8755d0220246e7bb6f64ef0aa5832eefc8e1ea75ecdc5fb0
-
Filesize
255KB
MD5617f75e04f6835913fd37f2e3c412495
SHA1fbec9ea08fbaa5ee0d00e3336f0f06f32f28ecf2
SHA25687d08d34ecfbfd657b477f334108f59b4762953d1f5a1e1676e36cfda85e2ea3
SHA5121a3eb5ef81f2ad46ee0831a8eb84a371601199f2f61600ca7cfcb7141bcd10757bb9655851def3bd8755d0220246e7bb6f64ef0aa5832eefc8e1ea75ecdc5fb0
-
Filesize
255KB
MD5c3d3e254b6dbcc0a19eacdbdd268b38d
SHA1626fd08ce36854d3575f618147267c5b3159da35
SHA2563bd30d64aa2995fbff98e5b59111511b765afaae6bbea0adb487b6dcbf1c8adb
SHA512bdda1dcf9bfd08c852b3e856e22fb380b9db43053ecf437777823b6a7aec5a4ae9b7c0b89c2c9e763fbe35994d6e04bca5390cada264a6466a57546a3152cfda
-
Filesize
255KB
MD5c3d3e254b6dbcc0a19eacdbdd268b38d
SHA1626fd08ce36854d3575f618147267c5b3159da35
SHA2563bd30d64aa2995fbff98e5b59111511b765afaae6bbea0adb487b6dcbf1c8adb
SHA512bdda1dcf9bfd08c852b3e856e22fb380b9db43053ecf437777823b6a7aec5a4ae9b7c0b89c2c9e763fbe35994d6e04bca5390cada264a6466a57546a3152cfda
-
Filesize
255KB
MD5c3d3e254b6dbcc0a19eacdbdd268b38d
SHA1626fd08ce36854d3575f618147267c5b3159da35
SHA2563bd30d64aa2995fbff98e5b59111511b765afaae6bbea0adb487b6dcbf1c8adb
SHA512bdda1dcf9bfd08c852b3e856e22fb380b9db43053ecf437777823b6a7aec5a4ae9b7c0b89c2c9e763fbe35994d6e04bca5390cada264a6466a57546a3152cfda
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5917481ed7b64d980df3af00fdec3bf5f
SHA105f81594c991864a862b85de9512ec9db7c1533c
SHA25694382e5539a9a3d8c84fc0be100dcbe53c246313755def47d9d66c7329c157f8
SHA512a3961d4e00324a61ffd8cdd67a3254b7b3fb8ea3a0c1aba53574570bc6cfd91f98e438df71edc10e4d983255e134cff2d534edfb23f0894989c37c7240ef4ab1
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-