Analysis
-
max time kernel
171s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:04
General
-
Target
6c9e2c8ccb2b9be3af6acff61672d6b23d960760271d196b2ab523d4b9fb45bf.exe
-
Size
255KB
-
MD5
ce0ed782372f927078e9b0e797c1de0a
-
SHA1
c5b8b40c1faa59a9ee5ed99cb4eb7c2857acfadb
-
SHA256
6c9e2c8ccb2b9be3af6acff61672d6b23d960760271d196b2ab523d4b9fb45bf
-
SHA512
9e3edb00d8332ef97519fcf397eedb679075a7f6b6229211969c08951f9cbc2273e250f0940b29feed323b80bf08c922e7866e5f54d4ec5488b8068cbfc44434
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ3:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIm
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c9e2c8ccb2b9be3af6acff61672d6b23d960760271d196b2ab523d4b9fb45bf.exe"C:\Users\Admin\AppData\Local\Temp\6c9e2c8ccb2b9be3af6acff61672d6b23d960760271d196b2ab523d4b9fb45bf.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tgqlplvvjw.exetgqlplvvjw.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\pyogxjrx.exeC:\Windows\system32\pyogxjrx.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\vgstobfjhlujqum.exevgstobfjhlujqum.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\pyogxjrx.exepyogxjrx.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ceiblppwmyoyn.execeiblppwmyoyn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5c42c936e9bb479dd1280b1db5e2a5d61
SHA1fc8db273a8b6d05e6f12cb1c7e1b0a8f8a8890a4
SHA256d700c83ebe9eaabd4d31a8730eee234f921961c28be5aa336a23292a6e2e6695
SHA512ed72a4791b4606db2e9be313b0c2b921a84ebac38d230fafeb4268199f8c801b75e4d01412e81391b2c7686d6215f695485711953b63c4098dbaa60fc5bc1ab2
-
Filesize
255KB
MD575b4b17476139f987e18e9d3b28d4b96
SHA115cef1ac12ae9f8587774f60350a3545e496c1ae
SHA256fbc18fb7b9ea36a94b47b58480949520d74cf135c3ec2d886004c43ec2a52b53
SHA512c9fab0d2aef381b69752b90230b6d374eafdb4674780680db4edbffb9a979d08db19fdae95dc5ad89adc5cec80cbc36b39bc303b560a6a4902d6fc36b2d4f4fc
-
Filesize
255KB
MD575b4b17476139f987e18e9d3b28d4b96
SHA115cef1ac12ae9f8587774f60350a3545e496c1ae
SHA256fbc18fb7b9ea36a94b47b58480949520d74cf135c3ec2d886004c43ec2a52b53
SHA512c9fab0d2aef381b69752b90230b6d374eafdb4674780680db4edbffb9a979d08db19fdae95dc5ad89adc5cec80cbc36b39bc303b560a6a4902d6fc36b2d4f4fc
-
Filesize
255KB
MD5f32bac73d66c7d0800158893c194227c
SHA11ed2a37eca01a0dce06b18f33e35db95afb46868
SHA2564e6a195c882aff170100f69a7e2a32e54f90aab1df6fa63799987ad82f470fd4
SHA512e92a318bcc10395486b74751d74afbab5ec3cb65841de41b928feed7d28015cf76bb413bc9525bd197158b619d0bc5c4100b2962a41e283a283aa2ab4c57fb63
-
Filesize
255KB
MD5f32bac73d66c7d0800158893c194227c
SHA11ed2a37eca01a0dce06b18f33e35db95afb46868
SHA2564e6a195c882aff170100f69a7e2a32e54f90aab1df6fa63799987ad82f470fd4
SHA512e92a318bcc10395486b74751d74afbab5ec3cb65841de41b928feed7d28015cf76bb413bc9525bd197158b619d0bc5c4100b2962a41e283a283aa2ab4c57fb63
-
Filesize
255KB
MD5f32bac73d66c7d0800158893c194227c
SHA11ed2a37eca01a0dce06b18f33e35db95afb46868
SHA2564e6a195c882aff170100f69a7e2a32e54f90aab1df6fa63799987ad82f470fd4
SHA512e92a318bcc10395486b74751d74afbab5ec3cb65841de41b928feed7d28015cf76bb413bc9525bd197158b619d0bc5c4100b2962a41e283a283aa2ab4c57fb63
-
Filesize
255KB
MD5df0cbc3cf1ffc1cae1377589837910ee
SHA1d1f7be763c97d886adcd376263b19f2a753897cd
SHA256962d5410119eaa59ba30a3e6776323e7e47b208edcb3297eab5d88a8d2b5ee45
SHA5122a98e095afe4209cfac691f10854b66684224b9f0541324d8c22a66057b851c044b18ee5b8230de0df645ce35939b8ecbd8042a1336680fe7b4aa480f1ebd449
-
Filesize
255KB
MD5df0cbc3cf1ffc1cae1377589837910ee
SHA1d1f7be763c97d886adcd376263b19f2a753897cd
SHA256962d5410119eaa59ba30a3e6776323e7e47b208edcb3297eab5d88a8d2b5ee45
SHA5122a98e095afe4209cfac691f10854b66684224b9f0541324d8c22a66057b851c044b18ee5b8230de0df645ce35939b8ecbd8042a1336680fe7b4aa480f1ebd449
-
Filesize
255KB
MD565233cfc25d1320096bd4d3bf8d89054
SHA1e6527e17abc66ae75b0b6578c473ef305677ca5e
SHA256a2705e700bb8adcd0656c75180846ed3d4769b44f494db62d188039ed1c19586
SHA512e9e3b3ca529d37480c32a5d654c55c2df7b7dd52b2ba7d481ede4dda383cd3cb6bcb8d8cf8afbbf0821427fe016add4b2deb944c5154e89c1c78022d7c7048c3
-
Filesize
255KB
MD565233cfc25d1320096bd4d3bf8d89054
SHA1e6527e17abc66ae75b0b6578c473ef305677ca5e
SHA256a2705e700bb8adcd0656c75180846ed3d4769b44f494db62d188039ed1c19586
SHA512e9e3b3ca529d37480c32a5d654c55c2df7b7dd52b2ba7d481ede4dda383cd3cb6bcb8d8cf8afbbf0821427fe016add4b2deb944c5154e89c1c78022d7c7048c3
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD50560276a502401920895f6c35e2fc1d5
SHA18fe192d927be5bc1d72da29f7f5ef9ab7e3cbdd1
SHA2567cc70a5aca98c2417f82a531b714f44736fb38711accda83dc26b2a79f87255c
SHA512f4b4b0108e2c9387010a2027602d1796a4e0b2f0a3cd5fad2b10318493878974eb5361f92b033c4f4ad20b98503abece7606d3eea739954b7157d9838c23d7da
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-