Analysis
-
max time kernel
161s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:04
General
-
Target
5d60f53b1aee1a136d1f5e8acdf1c12bb2e094a4547b9dd20e9f8935440148d3.exe
-
Size
255KB
-
MD5
976029ff747858a500d02ae8d82be4fd
-
SHA1
82d3668bf501d003fba3bfc027bef6437978ee89
-
SHA256
5d60f53b1aee1a136d1f5e8acdf1c12bb2e094a4547b9dd20e9f8935440148d3
-
SHA512
8fab9d6e91532641cc23585dd855b5a1fd9020a7b18eab2b1e396dc2cf1d70adbe58b202219751190556feb2d54624787361bc805b133ec4739477adec86601f
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJa:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d60f53b1aee1a136d1f5e8acdf1c12bb2e094a4547b9dd20e9f8935440148d3.exe"C:\Users\Admin\AppData\Local\Temp\5d60f53b1aee1a136d1f5e8acdf1c12bb2e094a4547b9dd20e9f8935440148d3.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\aysdpzhcqi.exeaysdpzhcqi.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vznmmmdj.exeC:\Windows\system32\vznmmmdj.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\zdgexajzlbvwqfg.exezdgexajzlbvwqfg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\vznmmmdj.exevznmmmdj.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\cciavxhajwbdw.execciavxhajwbdw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD52c232a2e8645092b994189bc3e6b8c86
SHA1ceaa8811948824c48750dfe5e2123eba864b2007
SHA256a5aadf83996a78057cdfff1f6ac5b3bf34274c35e77711f5fa34c56ebd3fce50
SHA512f277415d8f33a2a7c71d4f3de792d248c23150e8583ecedb296fa8eb44265ead9f6540777d07488923a04960d37775e3771e70bbd7fcf8127db7a08d0593eb90
-
Filesize
255KB
MD54a51ca0397bd2a6962572016488c3a1f
SHA1c35cd7ec17d7a1ffa35c0ba1d63697d29a6b9227
SHA2561129d20a792c20057b5481827d46f744dff8d103baf197576dd80505e8ed967d
SHA512d2a60d64c206fb6afd3402332594bdc371720176b1585949dc18b0b57f924e1e7be41f4909c49bc55ac65b70fe70efe10e08d982d312948f97973b9173be67f8
-
Filesize
255KB
MD5d4a9edec9332d43f4bf4e1efef4c1275
SHA12e3fc647eb2e72aa34904a7691a67a4cdbd2f9c9
SHA256dc36763e4f41c804d325778fecea7b5cf90b01e5dc9de6c1ee074ae69cc08967
SHA512d948f61d5e65212c7bf78c8bd8c6b098403e26579d1e713202572efbe056dc4337d9643eff881649af28e6dad92fea821f26c15d8859ab03cf80abb3f58cccf4
-
Filesize
255KB
MD5d4a9edec9332d43f4bf4e1efef4c1275
SHA12e3fc647eb2e72aa34904a7691a67a4cdbd2f9c9
SHA256dc36763e4f41c804d325778fecea7b5cf90b01e5dc9de6c1ee074ae69cc08967
SHA512d948f61d5e65212c7bf78c8bd8c6b098403e26579d1e713202572efbe056dc4337d9643eff881649af28e6dad92fea821f26c15d8859ab03cf80abb3f58cccf4
-
Filesize
255KB
MD5a5b1665e14c5606596b0326c9e481373
SHA1b882b18f58dda17a6baa4f5f3146173e4d2078eb
SHA2566573cecc5bd497b2abedbacfb085f9eca44b0ced3c8500f9207024f27a885e4f
SHA51293c59dc121e6ffdddeec96f1f77395c3c3fb14777a8093cb4abda27229f356688054c96193aea3d46b60373fca5687a69d6ff9b9047c68889a611df226eb438d
-
Filesize
255KB
MD5a5b1665e14c5606596b0326c9e481373
SHA1b882b18f58dda17a6baa4f5f3146173e4d2078eb
SHA2566573cecc5bd497b2abedbacfb085f9eca44b0ced3c8500f9207024f27a885e4f
SHA51293c59dc121e6ffdddeec96f1f77395c3c3fb14777a8093cb4abda27229f356688054c96193aea3d46b60373fca5687a69d6ff9b9047c68889a611df226eb438d
-
Filesize
255KB
MD59f4ea1e58b7fa002b71e47e5f58aafec
SHA1670f8e912165612bfdc4d58e5302d43ccbd8dd41
SHA2565239cdadb51c5a568d98203c27c4705fd996bdd17cc7bf90eb5b3cdd41e73c12
SHA5128fa306aac019d2e74cd62cf695f2320d5ea9e48d1b298d8eaeac8a0e905271c2f99aa23e540583bd25facad7bb7546952ade2ab8dbabaa13df978e474e3e5b7f
-
Filesize
255KB
MD59f4ea1e58b7fa002b71e47e5f58aafec
SHA1670f8e912165612bfdc4d58e5302d43ccbd8dd41
SHA2565239cdadb51c5a568d98203c27c4705fd996bdd17cc7bf90eb5b3cdd41e73c12
SHA5128fa306aac019d2e74cd62cf695f2320d5ea9e48d1b298d8eaeac8a0e905271c2f99aa23e540583bd25facad7bb7546952ade2ab8dbabaa13df978e474e3e5b7f
-
Filesize
255KB
MD59f4ea1e58b7fa002b71e47e5f58aafec
SHA1670f8e912165612bfdc4d58e5302d43ccbd8dd41
SHA2565239cdadb51c5a568d98203c27c4705fd996bdd17cc7bf90eb5b3cdd41e73c12
SHA5128fa306aac019d2e74cd62cf695f2320d5ea9e48d1b298d8eaeac8a0e905271c2f99aa23e540583bd25facad7bb7546952ade2ab8dbabaa13df978e474e3e5b7f
-
Filesize
255KB
MD5fe3b2095748c99b6e6c03d2d5e54423e
SHA106f304269699899f3db3b01a2e4fc9bde1f9ef77
SHA25698aa7709c2cee0265ac215ff10bd4e24477269287cdfd76d6e8d887fe44243ba
SHA512050275caf54b974b605f525223fcd9cd4e05710f686338a216ce9314ccd65b09b4685291880105e19226750b59fb1da0e11873495e4f92b27f0019b61c78946b
-
Filesize
255KB
MD5fe3b2095748c99b6e6c03d2d5e54423e
SHA106f304269699899f3db3b01a2e4fc9bde1f9ef77
SHA25698aa7709c2cee0265ac215ff10bd4e24477269287cdfd76d6e8d887fe44243ba
SHA512050275caf54b974b605f525223fcd9cd4e05710f686338a216ce9314ccd65b09b4685291880105e19226750b59fb1da0e11873495e4f92b27f0019b61c78946b
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB