Analysis
-
max time kernel
195s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:06
General
-
Target
1a0ddc66b62771262dd5cb37f834eb6abf77f7cb08184a34e3ecb746443e369c.exe
-
Size
255KB
-
MD5
f44a1675a9a7394032ce07ab9f4fd112
-
SHA1
d4e578dae6f63917cdb886776df3f77ca92fc697
-
SHA256
1a0ddc66b62771262dd5cb37f834eb6abf77f7cb08184a34e3ecb746443e369c
-
SHA512
c14eab876165291a62ca3e8faffe7c7751b32acb384e026e4dbba30a7be3b7e6247bfab3d3ee9e9b2fa325f61c95319ef297acbfe2f86fef4826de42e5b3a26a
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJn:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIm
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a0ddc66b62771262dd5cb37f834eb6abf77f7cb08184a34e3ecb746443e369c.exe"C:\Users\Admin\AppData\Local\Temp\1a0ddc66b62771262dd5cb37f834eb6abf77f7cb08184a34e3ecb746443e369c.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\qilbdhszcc.exeqilbdhszcc.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gidbkpnm.exeC:\Windows\system32\gidbkpnm.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\rmmleaehdmhzaqo.exermmleaehdmhzaqo.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\gidbkpnm.exegidbkpnm.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\klkakyayrqxfx.exeklkakyayrqxfx.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5679ff1f7e45aff9d9fefd35a98e922d1
SHA1985fda4bad3832a7a970a29430c4c4c04f7346ed
SHA25635aabd72ae2aac842425a7471d1ef6cc507c882e2fc95260ec8cb2b62b31f7e5
SHA512c28071ed5b2801910401a1ddb9e693a37d08a151783a36284a6031fb9b9e0d5cd13d7a91bd8ae2b28a244b808ef1dfa63921b453ff3453c46b0848a7a43cf6e3
-
Filesize
255KB
MD563f9044a19cf9b8707cc0f9888c35013
SHA18e81bcc1e127c9647ef8f350b61d5d7ee6e1bff8
SHA2563070697e8fe9058a0beef403239a815b2624c5f32be6ded7be2aaf5d68f5d90a
SHA512877ab423c2f549e9fbc4244370de159179376a8672a68d8b74ed65bf51a320b8cfe96bc5f233f3e7ea103c1943ecdf1e1431786acaa6fe111e3942d68a15b880
-
Filesize
255KB
MD563f9044a19cf9b8707cc0f9888c35013
SHA18e81bcc1e127c9647ef8f350b61d5d7ee6e1bff8
SHA2563070697e8fe9058a0beef403239a815b2624c5f32be6ded7be2aaf5d68f5d90a
SHA512877ab423c2f549e9fbc4244370de159179376a8672a68d8b74ed65bf51a320b8cfe96bc5f233f3e7ea103c1943ecdf1e1431786acaa6fe111e3942d68a15b880
-
Filesize
255KB
MD563f9044a19cf9b8707cc0f9888c35013
SHA18e81bcc1e127c9647ef8f350b61d5d7ee6e1bff8
SHA2563070697e8fe9058a0beef403239a815b2624c5f32be6ded7be2aaf5d68f5d90a
SHA512877ab423c2f549e9fbc4244370de159179376a8672a68d8b74ed65bf51a320b8cfe96bc5f233f3e7ea103c1943ecdf1e1431786acaa6fe111e3942d68a15b880
-
Filesize
255KB
MD5b8ef28637aded84c54178fc5e1dc9d16
SHA1f72f91d993683550c06731cca4a3b3eef7e8b43e
SHA256bde0c4b37b6774daa884399caec94d8fb8c0857374bb82bad352d89e14ff21b9
SHA512dedcafc3431d28c6c2209d26b2c55d54b47816f6f12f1a53ced26b0f52d908c2d6729c58b6ce4e65742f0944dcc06dfca3146b798bb8491a60caf144796c5ec8
-
Filesize
255KB
MD5b8ef28637aded84c54178fc5e1dc9d16
SHA1f72f91d993683550c06731cca4a3b3eef7e8b43e
SHA256bde0c4b37b6774daa884399caec94d8fb8c0857374bb82bad352d89e14ff21b9
SHA512dedcafc3431d28c6c2209d26b2c55d54b47816f6f12f1a53ced26b0f52d908c2d6729c58b6ce4e65742f0944dcc06dfca3146b798bb8491a60caf144796c5ec8
-
Filesize
255KB
MD51487c48de2ed891663b5ac273ad65e37
SHA1549b6fe462352984d6d564cea3cf372be1814358
SHA256514c5834bd55df056320a120a4e7e6e4b6370cb6883bc54565817bc966866e3a
SHA5127b3d80f027fd8f709df80a8e4fced83377a7fb93dae7d305f75276fd837140aba5a9fbd3fd304dceb7b127f72d449504f5735207ece8bb4fdea1081ff37f7e2a
-
Filesize
255KB
MD51487c48de2ed891663b5ac273ad65e37
SHA1549b6fe462352984d6d564cea3cf372be1814358
SHA256514c5834bd55df056320a120a4e7e6e4b6370cb6883bc54565817bc966866e3a
SHA5127b3d80f027fd8f709df80a8e4fced83377a7fb93dae7d305f75276fd837140aba5a9fbd3fd304dceb7b127f72d449504f5735207ece8bb4fdea1081ff37f7e2a
-
Filesize
255KB
MD5696f667f772fd2c7bb5a1b2b036a2e51
SHA15d39b0dac13e5bfe388712a30218ef89d3dec289
SHA256cbdc97b0f1d5e92d2d7b7ebeb541d4c7a0e63554e3c5fecce4b46bf720b3a2b1
SHA512cda83024d746b2c12197eecd9c6e2d7697ff365dd48c7c957f862ece08eeb77b280719880acab81f703ea49d49f74a12dae2d690171d6ed07d1cb747d27272ca
-
Filesize
255KB
MD5696f667f772fd2c7bb5a1b2b036a2e51
SHA15d39b0dac13e5bfe388712a30218ef89d3dec289
SHA256cbdc97b0f1d5e92d2d7b7ebeb541d4c7a0e63554e3c5fecce4b46bf720b3a2b1
SHA512cda83024d746b2c12197eecd9c6e2d7697ff365dd48c7c957f862ece08eeb77b280719880acab81f703ea49d49f74a12dae2d690171d6ed07d1cb747d27272ca
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
-
Filesize
640KB