Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:04
General
-
Target
6c827141d04dd86281be55e369b256d2ecbc2071ee257a3f78753729b36bf3be.exe
-
Size
255KB
-
MD5
7d5dc99d15d0b9b3b86665c091fad166
-
SHA1
c50b78c1dd46fb4a283f1532268390454a7181cf
-
SHA256
6c827141d04dd86281be55e369b256d2ecbc2071ee257a3f78753729b36bf3be
-
SHA512
bd0370c6e297c3ed120e1299fb13591b757d563310b6a2a78b97ed4617eebb5c14702a194d76a9840299ca117d1bab6b14ebf44922b776afb567a36ee383d7e3
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ1:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI6
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c827141d04dd86281be55e369b256d2ecbc2071ee257a3f78753729b36bf3be.exe"C:\Users\Admin\AppData\Local\Temp\6c827141d04dd86281be55e369b256d2ecbc2071ee257a3f78753729b36bf3be.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rgeakkdahd.exergeakkdahd.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xgvqmpak.exeC:\Windows\system32\xgvqmpak.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\clwhlgtxvhnjjed.execlwhlgtxvhnjjed.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\xgvqmpak.exexgvqmpak.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\pahplvtsculme.exepahplvtsculme.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5689475d49f3b23323d337e62c51f55ef
SHA1f9b7422a1221abd04de1309d5681e5f0d3d74b26
SHA256304c18a4a5e0cef8cf84c0feab2e2cc4ab186820efbb7cf5eec0ca3ba9c3ebef
SHA51210cce599bb37dbe50589c80fcd02f72f6f073b7e34aa893877cb76a2e3f7eebf1e48d9dc85bab09a436ffb292197cf3cc51677c14708c7c73e55faf52ed81a94
-
Filesize
255KB
MD553fd7427e7d96701a1108e5957a0bc45
SHA136c74523f38ae36aa4390868b724306277282f6d
SHA2569340ff24a90fec81cc3a79dd826acb7a38e6114292eac1d49b1b473f599fcfc8
SHA512820fd9ae9132a258f2a90a830822c1d83d36abf684fd9ff1fd00905f0a8dbd20c7199129424e93050e270ad1b7d91acb390a36de2c1b568285bfcb92a20b4f13
-
Filesize
255KB
MD52dd38bbd0ca017884214a1352b85d283
SHA1352d592d3d10895cd4419b06901d355d39f271ff
SHA256c94b78153da8cdec3a3f80db9c113eb4cc52e80bc22ae10ec8f2d1012bbbdda0
SHA512f6dcdaf8a6fd41cbc7192f67d75368667a44bf554f877328318fe58bcd752cdc29e2d7eb18aef6d6c8b385bb9caefe6242da6b603cada197e2c05a6a77dc0534
-
Filesize
255KB
MD52dd38bbd0ca017884214a1352b85d283
SHA1352d592d3d10895cd4419b06901d355d39f271ff
SHA256c94b78153da8cdec3a3f80db9c113eb4cc52e80bc22ae10ec8f2d1012bbbdda0
SHA512f6dcdaf8a6fd41cbc7192f67d75368667a44bf554f877328318fe58bcd752cdc29e2d7eb18aef6d6c8b385bb9caefe6242da6b603cada197e2c05a6a77dc0534
-
Filesize
255KB
MD5fbad7ac1da687ac374ced8e577682a15
SHA1c7bc2b4d0fe8ae83913d124d79e920b65b7e4b3f
SHA25645aa7ff8d008b131403312d9c7af5a65ceaed1d2ef901862e20db4d0c430095e
SHA512cceae0abb83256424e627bf939705ffeb07ad73b8a32e32a05c8046e67a6a6343be02de56e9c641eb36d0fd61306cb9a1935ea05466d1f46abf619b6fef47781
-
Filesize
255KB
MD5fbad7ac1da687ac374ced8e577682a15
SHA1c7bc2b4d0fe8ae83913d124d79e920b65b7e4b3f
SHA25645aa7ff8d008b131403312d9c7af5a65ceaed1d2ef901862e20db4d0c430095e
SHA512cceae0abb83256424e627bf939705ffeb07ad73b8a32e32a05c8046e67a6a6343be02de56e9c641eb36d0fd61306cb9a1935ea05466d1f46abf619b6fef47781
-
Filesize
255KB
MD5619ce8b04b856627dbcbc58bd0275a61
SHA12981ec7bc8629608f92c9bb6932f435bd9f26b5c
SHA256ce588525b1956b6bfca2cb315049465c70b4a068453c6e7d2bc0dd0e885eb0c6
SHA51278b196dfd7304aed6b2c928bce79374a31d588331addfe5fc3d1a72ca52a7a77d885463605b3f5d4402bb805d4a7de005f873221a9aa39c0d837c107d053a89d
-
Filesize
255KB
MD5619ce8b04b856627dbcbc58bd0275a61
SHA12981ec7bc8629608f92c9bb6932f435bd9f26b5c
SHA256ce588525b1956b6bfca2cb315049465c70b4a068453c6e7d2bc0dd0e885eb0c6
SHA51278b196dfd7304aed6b2c928bce79374a31d588331addfe5fc3d1a72ca52a7a77d885463605b3f5d4402bb805d4a7de005f873221a9aa39c0d837c107d053a89d
-
Filesize
255KB
MD512dba5a9ea327811ec085c849be95d3a
SHA16f546bb2626d8c42b017d64f020814cc930dfe01
SHA2568ddf051d9b718d13b6436868111ca43e68ab087619490fa346f45a80d0877cfd
SHA51290da7fe6daa8a9aaba83c3a5ec2e9e184bbecdcf3d62589c9904777f629fda0ac26636c1fb2b160157df6eb20d4435402577c90f2d52c6aeac98a154761e8006
-
Filesize
255KB
MD512dba5a9ea327811ec085c849be95d3a
SHA16f546bb2626d8c42b017d64f020814cc930dfe01
SHA2568ddf051d9b718d13b6436868111ca43e68ab087619490fa346f45a80d0877cfd
SHA51290da7fe6daa8a9aaba83c3a5ec2e9e184bbecdcf3d62589c9904777f629fda0ac26636c1fb2b160157df6eb20d4435402577c90f2d52c6aeac98a154761e8006
-
Filesize
255KB
MD512dba5a9ea327811ec085c849be95d3a
SHA16f546bb2626d8c42b017d64f020814cc930dfe01
SHA2568ddf051d9b718d13b6436868111ca43e68ab087619490fa346f45a80d0877cfd
SHA51290da7fe6daa8a9aaba83c3a5ec2e9e184bbecdcf3d62589c9904777f629fda0ac26636c1fb2b160157df6eb20d4435402577c90f2d52c6aeac98a154761e8006
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-