Analysis
-
max time kernel
200s -
max time network
414s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:05
General
-
Target
42c09b6976b3fbe1561bd557dd507f59a867923cd1373805984916ac17497b45.exe
-
Size
255KB
-
MD5
ed25d30340fe9957c96fbcd2d020bf70
-
SHA1
9a59595cd3cd724bba5b8df9c99d44366a974868
-
SHA256
42c09b6976b3fbe1561bd557dd507f59a867923cd1373805984916ac17497b45
-
SHA512
8fd5eeed02980481981529212bd2718214334ef779742d67bcbab5bfce684bd515b3da617dd9e3ab39d032be66c504154f6e4e1347bddf9d3f20a8871cdbbe19
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJo:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42c09b6976b3fbe1561bd557dd507f59a867923cd1373805984916ac17497b45.exe"C:\Users\Admin\AppData\Local\Temp\42c09b6976b3fbe1561bd557dd507f59a867923cd1373805984916ac17497b45.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\liohtgcius.exeliohtgcius.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gqcstlhu.exeC:\Windows\system32\gqcstlhu.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\sjqphqmkfbubeph.exesjqphqmkfbubeph.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\gqcstlhu.exegqcstlhu.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\yuxsjhabogdgp.exeyuxsjhabogdgp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD51df3f988fe5f5682896336af71ced571
SHA192643761b42acde4c8598d9b52144137ed1de6e3
SHA256c7ba02e60a303587ee533f8a094e8e4ada72ff3bf3d71cedaed83fd2093abe18
SHA51237cda629b56f8007784c29a1b9ce6e3f92e75f647eb06559cc5f9e0f739cce2674aa97f0e5d7a9022d78fd7d968bf3ab8255ad6d46c5ed10aedd6472ca6ba63f
-
Filesize
255KB
MD5ccf52af50c7319b1391a720711f37e0d
SHA1fb0b0de6b1da92d58f260209c1f15af88775c125
SHA25607ffb8a70a9b8fc6634c5a0484094ef4f006abaf75ee555571b1306858d5db16
SHA512f7da1b66d81518429f7f55656d1a17fc8f84280cd30b92067ddc53769eba1370ebfbe65749537474aade08863a45c172933c4f2907e83e5cf93a6427169a37d7
-
Filesize
255KB
MD5090ed7d6db53e5990cc572bb39e348c1
SHA130005eeb7af2a5be3792b390fbdf6679c009ac2c
SHA2565e50f9484759e80735785e923b244a883609ef6969aa55b12b3ffff1083688e3
SHA512ea514e71f64c12f98f8e76cc71c19c244cfbd3d1b01364783485e77f9e8211ac8f2840e1699fbee87cffe727c58f331cf7eb8b4a348fee0d86ab3870d56abbc6
-
Filesize
255KB
MD5090ed7d6db53e5990cc572bb39e348c1
SHA130005eeb7af2a5be3792b390fbdf6679c009ac2c
SHA2565e50f9484759e80735785e923b244a883609ef6969aa55b12b3ffff1083688e3
SHA512ea514e71f64c12f98f8e76cc71c19c244cfbd3d1b01364783485e77f9e8211ac8f2840e1699fbee87cffe727c58f331cf7eb8b4a348fee0d86ab3870d56abbc6
-
Filesize
255KB
MD5090ed7d6db53e5990cc572bb39e348c1
SHA130005eeb7af2a5be3792b390fbdf6679c009ac2c
SHA2565e50f9484759e80735785e923b244a883609ef6969aa55b12b3ffff1083688e3
SHA512ea514e71f64c12f98f8e76cc71c19c244cfbd3d1b01364783485e77f9e8211ac8f2840e1699fbee87cffe727c58f331cf7eb8b4a348fee0d86ab3870d56abbc6
-
Filesize
255KB
MD54d0edbc8a653f011dd555a4efc2393c0
SHA1f06357bf303d0ffa4048606545f327b4bff7b4c8
SHA25622c7e9967ce9e9c19a2071a7d90eeb708d18f8921ceb969be40772fb942f3eca
SHA512a3b1880f817e62601b03ba407591b629c68ebd87b5e8706cf806b89d809ad2d0cda578b5f628f2f768cd880295da346e8d0d85b3609364c9094a2caf0d0db063
-
Filesize
255KB
MD54d0edbc8a653f011dd555a4efc2393c0
SHA1f06357bf303d0ffa4048606545f327b4bff7b4c8
SHA25622c7e9967ce9e9c19a2071a7d90eeb708d18f8921ceb969be40772fb942f3eca
SHA512a3b1880f817e62601b03ba407591b629c68ebd87b5e8706cf806b89d809ad2d0cda578b5f628f2f768cd880295da346e8d0d85b3609364c9094a2caf0d0db063
-
Filesize
255KB
MD5a1c5d7364d5bdd8d71e8e51d51a58ef7
SHA1917cf2551f2d40ccc8e621314663090640a5439f
SHA2560021ed4c1ea6d155e3f839649db34e5f25efd456b2a2274e639ff7640c8d20a7
SHA512ddef4c419119dc18d3d474ec05c0240e03aa502c18aa09cb0cc596ac243c9d033682ca13271465c396786ccedbd91cc8a6056ca3b7dcd9b8d0f6f5a0dc21fbb3
-
Filesize
255KB
MD5a1c5d7364d5bdd8d71e8e51d51a58ef7
SHA1917cf2551f2d40ccc8e621314663090640a5439f
SHA2560021ed4c1ea6d155e3f839649db34e5f25efd456b2a2274e639ff7640c8d20a7
SHA512ddef4c419119dc18d3d474ec05c0240e03aa502c18aa09cb0cc596ac243c9d033682ca13271465c396786ccedbd91cc8a6056ca3b7dcd9b8d0f6f5a0dc21fbb3
-
Filesize
255KB
MD57cbad41d2d50cedeaafe3cb0409c605c
SHA16c195f691e76714273c265613e58dd66df1bcfc0
SHA2566a853be26632535d70ff532739e85c50d301ac0c811e27cdd9edaf2267534cd8
SHA5121b1c3697c2d58a02e29fcbdbf17d24bd3fd49857c643d367eb1c01fb816d46fd7fe15986668f419826f50245febe4aac519e0e79cd1348987150f69b00766169
-
Filesize
255KB
MD57cbad41d2d50cedeaafe3cb0409c605c
SHA16c195f691e76714273c265613e58dd66df1bcfc0
SHA2566a853be26632535d70ff532739e85c50d301ac0c811e27cdd9edaf2267534cd8
SHA5121b1c3697c2d58a02e29fcbdbf17d24bd3fd49857c643d367eb1c01fb816d46fd7fe15986668f419826f50245febe4aac519e0e79cd1348987150f69b00766169
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB