Analysis
-
max time kernel
171s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-11-2022 21:04
General
-
Target
6c9e2c8ccb2b9be3af6acff61672d6b23d960760271d196b2ab523d4b9fb45bf.exe
-
Size
255KB
-
MD5
ce0ed782372f927078e9b0e797c1de0a
-
SHA1
c5b8b40c1faa59a9ee5ed99cb4eb7c2857acfadb
-
SHA256
6c9e2c8ccb2b9be3af6acff61672d6b23d960760271d196b2ab523d4b9fb45bf
-
SHA512
9e3edb00d8332ef97519fcf397eedb679075a7f6b6229211969c08951f9cbc2273e250f0940b29feed323b80bf08c922e7866e5f54d4ec5488b8068cbfc44434
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ3:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIm
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 6 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 32 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 33 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 59 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c9e2c8ccb2b9be3af6acff61672d6b23d960760271d196b2ab523d4b9fb45bf.exe"C:\Users\Admin\AppData\Local\Temp\6c9e2c8ccb2b9be3af6acff61672d6b23d960760271d196b2ab523d4b9fb45bf.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\kifqxfnkwr.exekifqxfnkwr.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vhkrytby.exeC:\Windows\system32\vhkrytby.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\sxipbpnedmjbnhh.exesxipbpnedmjbnhh.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c zdeazndvfbfbh.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zdeazndvfbfbh.exezdeazndvfbfbh.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\vhkrytby.exevhkrytby.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\zdeazndvfbfbh.exezdeazndvfbfbh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5581⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5f59acd45b44bc2c417a52ad06164f2da
SHA1d5a61985a3bb3936d4d31f7e88781b38e31acc6f
SHA2564016547d980b5cd4f8290216bb8cca511c638963d57d60fe7abb1820a4fabe8f
SHA51233f0dc9f8ae6f5eed96550fc9220830030485f0df2cafd517e7592d99d5b403ce99008e3bd00625954e502cd4c92fa8e1d9937aa0d6ccf585d388e1e7aa924f0
-
Filesize
255KB
MD56c58c28575c78776e550d290fcf19baa
SHA14e0d6aeb0686cef697be0e26417eb66dad662389
SHA2563477894a781ef9560c2788dffb4e38aec5f85acd838712ae9a8869e195c1047d
SHA5124ac2a194aad8f3b5e8e416e7382f7f1c2b3efcd2ffbd701ba0a8e4c20b4a4da8345ef3a041292634c17ab6570dec2fe8b9684287a043c620ef20df310f6b657d
-
Filesize
255KB
MD597d6bd5028cff50c538414f08e098477
SHA1ef63f6524abbb2df60f6f979a010c961e1899fe8
SHA256778be2fec9dbb442d695ea0dcde0168014b8d14b4b66289562f9103ea42ff08b
SHA512f476f4a395ecec269dd9f2b4e09c90e4eb06aeef3b19f1153aa0387635f1449ad078a7ed9229f536323dc37d9d33c88e0c73313370dcdbf8d73226ceee0150b5
-
Filesize
255KB
MD597d6bd5028cff50c538414f08e098477
SHA1ef63f6524abbb2df60f6f979a010c961e1899fe8
SHA256778be2fec9dbb442d695ea0dcde0168014b8d14b4b66289562f9103ea42ff08b
SHA512f476f4a395ecec269dd9f2b4e09c90e4eb06aeef3b19f1153aa0387635f1449ad078a7ed9229f536323dc37d9d33c88e0c73313370dcdbf8d73226ceee0150b5
-
Filesize
255KB
MD571d2c85c3090baf33c62e0c5d873dc55
SHA18c4a6f1ace439e2c2f2944e47e44c206aeb86c07
SHA25654c1612fcb18e04fd815475a388d1b51138cbf3d5fe4ff92a55434a0d511af74
SHA512351875840664fa2c7000086023f39165cc448881d57c7ea2e0f6eda1526c6465f56ea6a365b885a185a3970586694d55e89dadbac6c901044d69f5aa0a20d84d
-
Filesize
255KB
MD571d2c85c3090baf33c62e0c5d873dc55
SHA18c4a6f1ace439e2c2f2944e47e44c206aeb86c07
SHA25654c1612fcb18e04fd815475a388d1b51138cbf3d5fe4ff92a55434a0d511af74
SHA512351875840664fa2c7000086023f39165cc448881d57c7ea2e0f6eda1526c6465f56ea6a365b885a185a3970586694d55e89dadbac6c901044d69f5aa0a20d84d
-
Filesize
255KB
MD53db14e9efebbcd1bba26fb5937b369ba
SHA169d87acbcc196d20387dd47dde3d758dd00e16f3
SHA2569063637b35e25da83f5b3a19a352fcaddb9179cdcf66ced458593aa5f50b5237
SHA512e940517f41a9467ab0515c9a0d6f679cd7d1a9833958329fedd84e9479eed540c653ac7328ae59ffb52fce0847529b646d0a4f9ad3dfc3186608f371c197654b
-
Filesize
255KB
MD53db14e9efebbcd1bba26fb5937b369ba
SHA169d87acbcc196d20387dd47dde3d758dd00e16f3
SHA2569063637b35e25da83f5b3a19a352fcaddb9179cdcf66ced458593aa5f50b5237
SHA512e940517f41a9467ab0515c9a0d6f679cd7d1a9833958329fedd84e9479eed540c653ac7328ae59ffb52fce0847529b646d0a4f9ad3dfc3186608f371c197654b
-
Filesize
255KB
MD53db14e9efebbcd1bba26fb5937b369ba
SHA169d87acbcc196d20387dd47dde3d758dd00e16f3
SHA2569063637b35e25da83f5b3a19a352fcaddb9179cdcf66ced458593aa5f50b5237
SHA512e940517f41a9467ab0515c9a0d6f679cd7d1a9833958329fedd84e9479eed540c653ac7328ae59ffb52fce0847529b646d0a4f9ad3dfc3186608f371c197654b
-
Filesize
255KB
MD56c14631a743dac06b9864084fc7a8841
SHA1c91cd0c3b3818bad280b9d99ab918015f19a2183
SHA256f3ef3a8b13b63b96cf77a9cc76cf1653bb5737773f4b608c54cd01be3be1b7c7
SHA5127919208cf37dc0c9b299d8c14f1ff84e69dbac57aff9817fbe9591d3091f09bc318ac89bb1c382642996a30af09becf35b1ed798b635484b29ad577e099d8ac0
-
Filesize
255KB
MD56c14631a743dac06b9864084fc7a8841
SHA1c91cd0c3b3818bad280b9d99ab918015f19a2183
SHA256f3ef3a8b13b63b96cf77a9cc76cf1653bb5737773f4b608c54cd01be3be1b7c7
SHA5127919208cf37dc0c9b299d8c14f1ff84e69dbac57aff9817fbe9591d3091f09bc318ac89bb1c382642996a30af09becf35b1ed798b635484b29ad577e099d8ac0
-
Filesize
255KB
MD56c14631a743dac06b9864084fc7a8841
SHA1c91cd0c3b3818bad280b9d99ab918015f19a2183
SHA256f3ef3a8b13b63b96cf77a9cc76cf1653bb5737773f4b608c54cd01be3be1b7c7
SHA5127919208cf37dc0c9b299d8c14f1ff84e69dbac57aff9817fbe9591d3091f09bc318ac89bb1c382642996a30af09becf35b1ed798b635484b29ad577e099d8ac0
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD597d6bd5028cff50c538414f08e098477
SHA1ef63f6524abbb2df60f6f979a010c961e1899fe8
SHA256778be2fec9dbb442d695ea0dcde0168014b8d14b4b66289562f9103ea42ff08b
SHA512f476f4a395ecec269dd9f2b4e09c90e4eb06aeef3b19f1153aa0387635f1449ad078a7ed9229f536323dc37d9d33c88e0c73313370dcdbf8d73226ceee0150b5
-
Filesize
255KB
MD571d2c85c3090baf33c62e0c5d873dc55
SHA18c4a6f1ace439e2c2f2944e47e44c206aeb86c07
SHA25654c1612fcb18e04fd815475a388d1b51138cbf3d5fe4ff92a55434a0d511af74
SHA512351875840664fa2c7000086023f39165cc448881d57c7ea2e0f6eda1526c6465f56ea6a365b885a185a3970586694d55e89dadbac6c901044d69f5aa0a20d84d
-
Filesize
255KB
MD53db14e9efebbcd1bba26fb5937b369ba
SHA169d87acbcc196d20387dd47dde3d758dd00e16f3
SHA2569063637b35e25da83f5b3a19a352fcaddb9179cdcf66ced458593aa5f50b5237
SHA512e940517f41a9467ab0515c9a0d6f679cd7d1a9833958329fedd84e9479eed540c653ac7328ae59ffb52fce0847529b646d0a4f9ad3dfc3186608f371c197654b
-
Filesize
255KB
MD53db14e9efebbcd1bba26fb5937b369ba
SHA169d87acbcc196d20387dd47dde3d758dd00e16f3
SHA2569063637b35e25da83f5b3a19a352fcaddb9179cdcf66ced458593aa5f50b5237
SHA512e940517f41a9467ab0515c9a0d6f679cd7d1a9833958329fedd84e9479eed540c653ac7328ae59ffb52fce0847529b646d0a4f9ad3dfc3186608f371c197654b
-
Filesize
255KB
MD56c14631a743dac06b9864084fc7a8841
SHA1c91cd0c3b3818bad280b9d99ab918015f19a2183
SHA256f3ef3a8b13b63b96cf77a9cc76cf1653bb5737773f4b608c54cd01be3be1b7c7
SHA5127919208cf37dc0c9b299d8c14f1ff84e69dbac57aff9817fbe9591d3091f09bc318ac89bb1c382642996a30af09becf35b1ed798b635484b29ad577e099d8ac0
-
Filesize
255KB
MD56c14631a743dac06b9864084fc7a8841
SHA1c91cd0c3b3818bad280b9d99ab918015f19a2183
SHA256f3ef3a8b13b63b96cf77a9cc76cf1653bb5737773f4b608c54cd01be3be1b7c7
SHA5127919208cf37dc0c9b299d8c14f1ff84e69dbac57aff9817fbe9591d3091f09bc318ac89bb1c382642996a30af09becf35b1ed798b635484b29ad577e099d8ac0
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
64KB
-
-
Filesize
44KB
-
Filesize
44KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
8KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB