Analysis
-
max time kernel
173s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:05
General
-
Target
3bc869c60a864e68ce866b7c6ee609698e75d2f6f7593e07ed486a565da206f6.exe
-
Size
255KB
-
MD5
bf1923af592952598b5edca36609ed91
-
SHA1
a699dc7008fda7e889c2bb6ea18e755c92b39935
-
SHA256
3bc869c60a864e68ce866b7c6ee609698e75d2f6f7593e07ed486a565da206f6
-
SHA512
2f5a7d95b28f12c2af079260a27a282bb628697e725d0b9a79fa2c760b8d580719c067e254554240e94d27fde97425ea6bcff8ff85f36c0d8312529d15d7646e
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ9:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIS
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 24 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bc869c60a864e68ce866b7c6ee609698e75d2f6f7593e07ed486a565da206f6.exe"C:\Users\Admin\AppData\Local\Temp\3bc869c60a864e68ce866b7c6ee609698e75d2f6f7593e07ed486a565da206f6.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\kndidwwdlk.exekndidwwdlk.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\adlghmly.exeC:\Windows\system32\adlghmly.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\fadwwkhxngcilly.exefadwwkhxngcilly.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\adlghmly.exeadlghmly.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\fyevhccilxxyz.exefyevhccilxxyz.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5e70731bf36917dca57047971258a1aea
SHA169c96000e457a958ce8fe8c49a67ada7d418f355
SHA2565e0d0a9f7ab19190c10bd974881e2addb59feba45c88aa101977e8f2de2dc64e
SHA51245a6b5f0a75a0eaadf52dbe7a9027dd0bbc13e7c5da945324817358965707b997b33fab950003c26fe178578226425f178c217af5beddb775c83fb6c1ec62087
-
Filesize
255KB
MD5e70731bf36917dca57047971258a1aea
SHA169c96000e457a958ce8fe8c49a67ada7d418f355
SHA2565e0d0a9f7ab19190c10bd974881e2addb59feba45c88aa101977e8f2de2dc64e
SHA51245a6b5f0a75a0eaadf52dbe7a9027dd0bbc13e7c5da945324817358965707b997b33fab950003c26fe178578226425f178c217af5beddb775c83fb6c1ec62087
-
Filesize
255KB
MD5846ff1c1c638f3c9bf2de6757d6aa99b
SHA1850847765b5a0296fc58f33b90bf5f33dd2eb802
SHA256f64719dfacb91a4b225868a71a1fc5b3f99abc2faa2c4acacb627c812e381f61
SHA512186266b3ae8b805edfe3b0371b9a4f3db92cf0525fc6c6b50281c8f4dcbe7e1919aa5fc0ac6904add7595dd9120f0c97bd9ae733e979b9a586fc55c7fc5425f7
-
Filesize
255KB
MD59d77c777f9207285cf2c857a6ea5b368
SHA1b394f6cef47b844c26b41c98392b6335bfc134f5
SHA25670fa92bc7046ab6c224e4cd4fc33b4290f55f674defe9286b00b5f26ec1f2448
SHA51276bcf5ee0479581d7a142ea492124300982a2820e65ca0e3b239c20cf75e3012c725c3c29c71386afc6a8721219db33cb2463cbb20650e642adba0a7874580cf
-
Filesize
255KB
MD50e176707bb6982665134a23d5b48d876
SHA1d74bdeea1cdcfe215044d17a4bd1bbb686c235bc
SHA256f0d0868fe2e6ab719eda16c6fd6f4d1abb37bd45bb239c9548603b05e1f7f591
SHA5121298aff7da2783c29d937ec18d7e8c2320de56c2249cad150159e06ec25c5971a72f4330a6e946bd3036a81756130511ec878d82108dcccd27803224c473730d
-
Filesize
255KB
MD5fcf3ffdae13cec96b98be568524511f8
SHA1654f012935233d478baed816882a80bed1a17783
SHA25605086d714002e93a2605c10712228632e56b486b62e2b2089c42a81ffa387812
SHA5121407c9d44000d7e46aa45fa23841b3706e5bde7e7839b4f4a2ebf048b90d717875be5ce5f15c32e0300f14f4e964f0206a272ff52b3b07c6d17cc77a8157f1fb
-
Filesize
255KB
MD524624c9bfbb2a0bab8777c3ed5279114
SHA1f92d61b782147100879ac3d099ca98ea4a2bf38a
SHA256704aca2b1ecf930d2c43a7fa831c6355aa2d5e4c3a627ca151c5523da9a7d5d3
SHA512db256721ed7bfec6d8495d403d586de3b4fcff0e5f64810b4d335a1470577f870bcad44c65815a0509331a2041d54f1c13474aa4b0c02a0974fca2e693bd622f
-
Filesize
255KB
MD524624c9bfbb2a0bab8777c3ed5279114
SHA1f92d61b782147100879ac3d099ca98ea4a2bf38a
SHA256704aca2b1ecf930d2c43a7fa831c6355aa2d5e4c3a627ca151c5523da9a7d5d3
SHA512db256721ed7bfec6d8495d403d586de3b4fcff0e5f64810b4d335a1470577f870bcad44c65815a0509331a2041d54f1c13474aa4b0c02a0974fca2e693bd622f
-
Filesize
255KB
MD524624c9bfbb2a0bab8777c3ed5279114
SHA1f92d61b782147100879ac3d099ca98ea4a2bf38a
SHA256704aca2b1ecf930d2c43a7fa831c6355aa2d5e4c3a627ca151c5523da9a7d5d3
SHA512db256721ed7bfec6d8495d403d586de3b4fcff0e5f64810b4d335a1470577f870bcad44c65815a0509331a2041d54f1c13474aa4b0c02a0974fca2e693bd622f
-
Filesize
255KB
MD5090d9773de3218a3cd3bbbcf6d701bf1
SHA1043d2349c5ef0632f794f9150f7572a7cc63d805
SHA2565c3194991612a9af8e75094a9b1d656a002d31bb73ab68cce3cef1f110e4b806
SHA512fb3105ba433411df6242dd07ce367625a5ce3061de2f6e88ce5d59311fe497002283b72170e180f7561bc30d26d76c30bb60bddf7398e7082c45549390d0ac43
-
Filesize
255KB
MD5090d9773de3218a3cd3bbbcf6d701bf1
SHA1043d2349c5ef0632f794f9150f7572a7cc63d805
SHA2565c3194991612a9af8e75094a9b1d656a002d31bb73ab68cce3cef1f110e4b806
SHA512fb3105ba433411df6242dd07ce367625a5ce3061de2f6e88ce5d59311fe497002283b72170e180f7561bc30d26d76c30bb60bddf7398e7082c45549390d0ac43
-
Filesize
255KB
MD50c3b7ecf99deea78535ce1c8bd5e607c
SHA1e2d0aec2980ec649fb58e29ad2323716ab3b6a3a
SHA25614d75e855b04bc2e641b5f3a6b73eb2ed0f22f6596536f9e6cb1f7cf1ae8138d
SHA51207eba0f5c44f42860b75eb14062b981a608e2fe47c970ad44ff31b131813d8b1d9c5cb281e0efe7416206716935920b7d5e36e179e7306a710f7aa87eeebbe9f
-
Filesize
255KB
MD50c3b7ecf99deea78535ce1c8bd5e607c
SHA1e2d0aec2980ec649fb58e29ad2323716ab3b6a3a
SHA25614d75e855b04bc2e641b5f3a6b73eb2ed0f22f6596536f9e6cb1f7cf1ae8138d
SHA51207eba0f5c44f42860b75eb14062b981a608e2fe47c970ad44ff31b131813d8b1d9c5cb281e0efe7416206716935920b7d5e36e179e7306a710f7aa87eeebbe9f
-
Filesize
255KB
MD57419c210753118c16d9ba10e9d41fd0a
SHA1a0b4e525e45ae49f534454b0021f8cb0b29295df
SHA256796696ea4fa60213097f1b267fe312b3311f0d972a4788c378f5c4b5b97bbf8e
SHA512d91327ecbf3a65fd6f22c3a6b71674469b3b682df77738aab6162bc929a59eb7f5d8d43acb6b90c5ac9e2a6e3af72da82185227a5b3076fa0084093a39ea8638
-
Filesize
255KB
MD57419c210753118c16d9ba10e9d41fd0a
SHA1a0b4e525e45ae49f534454b0021f8cb0b29295df
SHA256796696ea4fa60213097f1b267fe312b3311f0d972a4788c378f5c4b5b97bbf8e
SHA512d91327ecbf3a65fd6f22c3a6b71674469b3b682df77738aab6162bc929a59eb7f5d8d43acb6b90c5ac9e2a6e3af72da82185227a5b3076fa0084093a39ea8638
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5bc332247b06098cf818eede1713400c2
SHA1cb12110ae49cb459cd70454ba38359f710c24319
SHA25646a4ebbf400dc3daaabfd0b4dce8b5fac64670d60b7efe9727cc2d5f123f4bd6
SHA5126ada1eea2252e01a5e9a66e554e738c16d22eedec845506f624ec10e0ad92f1d19e102f9bbaad9ae299ed05c13b1eec0502dc01691323165e4b5cc72eee88652
-
Filesize
255KB
MD59d77c777f9207285cf2c857a6ea5b368
SHA1b394f6cef47b844c26b41c98392b6335bfc134f5
SHA25670fa92bc7046ab6c224e4cd4fc33b4290f55f674defe9286b00b5f26ec1f2448
SHA51276bcf5ee0479581d7a142ea492124300982a2820e65ca0e3b239c20cf75e3012c725c3c29c71386afc6a8721219db33cb2463cbb20650e642adba0a7874580cf
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-