Analysis
-
max time kernel
161s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:04
General
-
Target
5f479875969fe0464e825e609f3db2c1b5723d7952247829d1a3027f85ae021e.exe
-
Size
255KB
-
MD5
d87d54f52eb49e3109965b0b921b1d4b
-
SHA1
96237acc62c67613933af6ebc539d1ae41b7051f
-
SHA256
5f479875969fe0464e825e609f3db2c1b5723d7952247829d1a3027f85ae021e
-
SHA512
c93ec62dd9ec32bd583489e7bf4f19b427c5472c1c4fe0c8cf36c1c0ce714f0c843d77ec7aec9b1bc83f0a025dcd609909846c0eb210e812abcd003a29b439c6
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJO:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIN
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f479875969fe0464e825e609f3db2c1b5723d7952247829d1a3027f85ae021e.exe"C:\Users\Admin\AppData\Local\Temp\5f479875969fe0464e825e609f3db2c1b5723d7952247829d1a3027f85ae021e.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\aysdpzhcqi.exeaysdpzhcqi.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vznmmmdj.exeC:\Windows\system32\vznmmmdj.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\zdgexajzlbvwqfg.exezdgexajzlbvwqfg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c cciavxhajwbdw.exe3⤵
-
C:\Windows\SysWOW64\vznmmmdj.exevznmmmdj.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cciavxhajwbdw.execciavxhajwbdw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5d56d5591d6979a33c40e5b08654739b4
SHA1f153d8cc5efa752ca48ad4570f1de20dc3c449eb
SHA2564794021283a8c6269b5ddae9c4d31e09e433ba8777e684978506454d14edab34
SHA512c6db6337772b3ae1652a98fde1ee57f86920eed5e89bca645e0f305eaef1621646633fd722858f050ab8f82dc512343ed5fbdfc70143c76285ea3df6a02b5461
-
Filesize
255KB
MD5d56d5591d6979a33c40e5b08654739b4
SHA1f153d8cc5efa752ca48ad4570f1de20dc3c449eb
SHA2564794021283a8c6269b5ddae9c4d31e09e433ba8777e684978506454d14edab34
SHA512c6db6337772b3ae1652a98fde1ee57f86920eed5e89bca645e0f305eaef1621646633fd722858f050ab8f82dc512343ed5fbdfc70143c76285ea3df6a02b5461
-
Filesize
255KB
MD51f4022624dbb4eea255418b2600a9b6e
SHA129922abaa2e126de3d50b609f7bf7818aab76296
SHA256044d7cce3652705a62eec8cc655fe320484e2114698c68b9f969b3f6eae5a99d
SHA5120af705788d0140e32446c5ae96366cfa91a0bfe09f881b4085b93aab51122889c649f8dac2dbee4f94e1ec722dd2c30f3b70ffa40b3b3078d53fa3dcde98cc56
-
Filesize
255KB
MD5542c66af06d534d7b98684a296973ffc
SHA1ac9330dfd3f95f379611015aa1f0229bbcbeab78
SHA2565a2148977ee14e16121ee50fbd21b97e397f200c15d9cb686388b8d018bf905d
SHA51210e80c313aa71edd62f86db41bd0a58c0164e06ce810734665f05c73be30332cf7254092115415adfc0842bcdfa04c607724cf56a8957864649bfa201cdb7368
-
Filesize
255KB
MD51642dd6b359de5db229038ae3ee5c25a
SHA12d0decb11331eb349953961db92408f8c2ae9f70
SHA256a448f899ce2681fae5c84d1e0ac1d1f6ca045038fc2c520c12636f51a9753198
SHA5125abbefdc9ee0bd631015887ddda59837dc37a3738605be3614b627ff8d9252952324b1d743401839d4d52ce1331ce9955649049e02be6e7d3647cd8a962f8a5c
-
Filesize
255KB
MD51642dd6b359de5db229038ae3ee5c25a
SHA12d0decb11331eb349953961db92408f8c2ae9f70
SHA256a448f899ce2681fae5c84d1e0ac1d1f6ca045038fc2c520c12636f51a9753198
SHA5125abbefdc9ee0bd631015887ddda59837dc37a3738605be3614b627ff8d9252952324b1d743401839d4d52ce1331ce9955649049e02be6e7d3647cd8a962f8a5c
-
Filesize
255KB
MD536af7462cfb2f07e14c546bbb70ee19b
SHA10cad74cace445658fb4cbe286dbda3277b3e1488
SHA25613759d4f6d6c03c7e66d9a6d2bcaddb6826957bb4c3ba86fbf186d43367eee58
SHA51299b3b59303257805bff05ca980c4d5d7daf10443f6499c1d8dcd729eeb210605c40c59296c18705984320eb195a00bc0ec7331708bba87afe21e30dbef0112cd
-
Filesize
255KB
MD536af7462cfb2f07e14c546bbb70ee19b
SHA10cad74cace445658fb4cbe286dbda3277b3e1488
SHA25613759d4f6d6c03c7e66d9a6d2bcaddb6826957bb4c3ba86fbf186d43367eee58
SHA51299b3b59303257805bff05ca980c4d5d7daf10443f6499c1d8dcd729eeb210605c40c59296c18705984320eb195a00bc0ec7331708bba87afe21e30dbef0112cd
-
Filesize
255KB
MD565c8db78d8cac58f0b3736d456e0a31c
SHA16a5442372cd85773203ed767c260d46745a3dcdf
SHA256d1b3def258471d760ba9bd32614be9e8b93dfeac6c8d0801687f349420b0bb54
SHA5127f4aa9c3db8561ade0662b5c663e6459d4bb6519c77607fffd7af8096a476965762f944918e694fffbb7ca6e07d7d4efbf1f384112eac9d327895004009024b0
-
Filesize
255KB
MD565c8db78d8cac58f0b3736d456e0a31c
SHA16a5442372cd85773203ed767c260d46745a3dcdf
SHA256d1b3def258471d760ba9bd32614be9e8b93dfeac6c8d0801687f349420b0bb54
SHA5127f4aa9c3db8561ade0662b5c663e6459d4bb6519c77607fffd7af8096a476965762f944918e694fffbb7ca6e07d7d4efbf1f384112eac9d327895004009024b0
-
Filesize
255KB
MD565c8db78d8cac58f0b3736d456e0a31c
SHA16a5442372cd85773203ed767c260d46745a3dcdf
SHA256d1b3def258471d760ba9bd32614be9e8b93dfeac6c8d0801687f349420b0bb54
SHA5127f4aa9c3db8561ade0662b5c663e6459d4bb6519c77607fffd7af8096a476965762f944918e694fffbb7ca6e07d7d4efbf1f384112eac9d327895004009024b0
-
Filesize
255KB
MD588eef89b4e740248a6a27a09c395143a
SHA176dcbc980635b48c35ca05e39080bb2687a4eb9d
SHA256c607660b9723cd7649dc3baf7b904ad38255a593ca0fdec45fe594e3aaebb1f9
SHA512f91a16ac1805aa38e19bc9771e99f5f288d996f4e11efacff96963c608fd8c1d8a3d263d9309279ed61d046c347fac0c5f1e63a6a1f2ff78ca54eb64eb388ea6
-
Filesize
255KB
MD588eef89b4e740248a6a27a09c395143a
SHA176dcbc980635b48c35ca05e39080bb2687a4eb9d
SHA256c607660b9723cd7649dc3baf7b904ad38255a593ca0fdec45fe594e3aaebb1f9
SHA512f91a16ac1805aa38e19bc9771e99f5f288d996f4e11efacff96963c608fd8c1d8a3d263d9309279ed61d046c347fac0c5f1e63a6a1f2ff78ca54eb64eb388ea6
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB