Analysis
-
max time kernel
368s -
max time network
386s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:05
General
-
Target
36576b591ec239f59a93342e9c6e4b0390abbca28e5044a3a51e5ad1028a94fd.exe
-
Size
255KB
-
MD5
9166a8f9f0b8d5655ccd437bf6edbc98
-
SHA1
efc27cb3a6158409c9c9bdfb113049690e8d8687
-
SHA256
36576b591ec239f59a93342e9c6e4b0390abbca28e5044a3a51e5ad1028a94fd
-
SHA512
152dcfb08b943f63ffb2d92d29c6c660bbc56ddc51e148d711e14be54b164238302c1a36efcb581a239c20fb5a8f013ab425d16509e694ab90b96d13d0737be6
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ/:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 20 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36576b591ec239f59a93342e9c6e4b0390abbca28e5044a3a51e5ad1028a94fd.exe"C:\Users\Admin\AppData\Local\Temp\36576b591ec239f59a93342e9c6e4b0390abbca28e5044a3a51e5ad1028a94fd.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tnkkbxkkwi.exetnkkbxkkwi.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zdqkuexc.exeC:\Windows\system32\zdqkuexc.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\pjkwvgpuzkevfab.exepjkwvgpuzkevfab.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c fthnxpkdoeeuj.exe3⤵
-
C:\Windows\SysWOW64\zdqkuexc.exezdqkuexc.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\fthnxpkdoeeuj.exefthnxpkdoeeuj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD512bef9229bc833ab8347f240da3b1e4c
SHA1c11a104a3f3bb851546eba2f6e4821cc5affa55c
SHA2568a06c7b714fcde04fb2c3eba3a00e0da232ed7ed026a813acae49637d7544f12
SHA512fc89b3437db762835bfec5d70d6c41a0a3b70b0abd514fc238f9913381d73048fa310e3c03b450c0570376f17788b24ff17a16e858cfbbee7ed5af934e6c5fd1
-
Filesize
255KB
MD512bef9229bc833ab8347f240da3b1e4c
SHA1c11a104a3f3bb851546eba2f6e4821cc5affa55c
SHA2568a06c7b714fcde04fb2c3eba3a00e0da232ed7ed026a813acae49637d7544f12
SHA512fc89b3437db762835bfec5d70d6c41a0a3b70b0abd514fc238f9913381d73048fa310e3c03b450c0570376f17788b24ff17a16e858cfbbee7ed5af934e6c5fd1
-
Filesize
255KB
MD576c61f65329a2a4c93fe7c2a0ba597b9
SHA1349cd17ecf34f1db8586d1b1f0280be2016a8458
SHA25611ebd5a336e48698e3279a785e27ecc7d1923704ef0bfc7f6e6dc77785b6b6ac
SHA512c28d9f87ddfa7fe92f0ae0f2e6be2943693fb4dc1a5e01d7092d89f025ec4543a23981fbe1d7b20a809c06728b3bd0773d210d4434c5b3fe3eab505b78792ece
-
Filesize
255KB
MD576c61f65329a2a4c93fe7c2a0ba597b9
SHA1349cd17ecf34f1db8586d1b1f0280be2016a8458
SHA25611ebd5a336e48698e3279a785e27ecc7d1923704ef0bfc7f6e6dc77785b6b6ac
SHA512c28d9f87ddfa7fe92f0ae0f2e6be2943693fb4dc1a5e01d7092d89f025ec4543a23981fbe1d7b20a809c06728b3bd0773d210d4434c5b3fe3eab505b78792ece
-
Filesize
255KB
MD59244826d00624999679e9314ee27ae75
SHA1cf993441350fb12ec91c1bf15e37d60a552ee1a2
SHA256405039a3ff9166798c240657e2edc20ac9eadfc4e3cd922f482471cbbbcf4dff
SHA51270392d43b6ffbaa7c1459804699a5489f34c409b9bfa74308abbca92d045d3d6b252225e290ffd0c35fb03747e22ee4a34d208d820a718b67511d7c65aa120f1
-
Filesize
255KB
MD59244826d00624999679e9314ee27ae75
SHA1cf993441350fb12ec91c1bf15e37d60a552ee1a2
SHA256405039a3ff9166798c240657e2edc20ac9eadfc4e3cd922f482471cbbbcf4dff
SHA51270392d43b6ffbaa7c1459804699a5489f34c409b9bfa74308abbca92d045d3d6b252225e290ffd0c35fb03747e22ee4a34d208d820a718b67511d7c65aa120f1
-
Filesize
255KB
MD548ad45beb0ca79af62d04b5ed45c6a91
SHA18f8c0ad2a6759a7ff49e624b36b5a94873cee113
SHA25629b4b56ec427d7d02afadb9e2da6d5c72baafa9c09afa2a93bc69bf83cfd613c
SHA5128e49620d9b051881cc59e2f1f6410cf755baab1bf151535768e4912880491bd646dff747bfdc80c9e23d77b0627b366d121abd7fcac7a19e1e0b0340c0753dbb
-
Filesize
255KB
MD548ad45beb0ca79af62d04b5ed45c6a91
SHA18f8c0ad2a6759a7ff49e624b36b5a94873cee113
SHA25629b4b56ec427d7d02afadb9e2da6d5c72baafa9c09afa2a93bc69bf83cfd613c
SHA5128e49620d9b051881cc59e2f1f6410cf755baab1bf151535768e4912880491bd646dff747bfdc80c9e23d77b0627b366d121abd7fcac7a19e1e0b0340c0753dbb
-
Filesize
255KB
MD548ad45beb0ca79af62d04b5ed45c6a91
SHA18f8c0ad2a6759a7ff49e624b36b5a94873cee113
SHA25629b4b56ec427d7d02afadb9e2da6d5c72baafa9c09afa2a93bc69bf83cfd613c
SHA5128e49620d9b051881cc59e2f1f6410cf755baab1bf151535768e4912880491bd646dff747bfdc80c9e23d77b0627b366d121abd7fcac7a19e1e0b0340c0753dbb
-
-
Filesize
640KB
-
-
-
Filesize
640KB
-
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB