Analysis
-
max time kernel
157s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
23-11-2022 21:05
General
-
Target
2c6a0836c143cbf05286be296ddaa5e4a2b92c4e1138bd8729e4f7afbe8b0439.exe
-
Size
255KB
-
MD5
8be341eaf35bac80ed683063e0f9bf78
-
SHA1
e64f112c382130e37133419a350c681633a368db
-
SHA256
2c6a0836c143cbf05286be296ddaa5e4a2b92c4e1138bd8729e4f7afbe8b0439
-
SHA512
b7f4f36949483546c6868f3d46adde869fd6963b870d849b977353494dfefdc227c9ec067c843d2272bf3d6adb1197f85b612229bd0e70615dd89e46ae03f73a
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ0:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 11 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c6a0836c143cbf05286be296ddaa5e4a2b92c4e1138bd8729e4f7afbe8b0439.exe"C:\Users\Admin\AppData\Local\Temp\2c6a0836c143cbf05286be296ddaa5e4a2b92c4e1138bd8729e4f7afbe8b0439.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\jkeyczywyy.exejkeyczywyy.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\eddpxlhk.exeC:\Windows\system32\eddpxlhk.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\nmsetifbuilhcku.exenmsetifbuilhcku.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\eddpxlhk.exeeddpxlhk.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\uqihlzyqqgeqt.exeuqihlzyqqgeqt.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5bc939d66961f4cdcafd536c01342d94c
SHA15f9fd1789a7fb8921d8ccd0fe0a773968d344d81
SHA25685a77c8e0ecb4d9fed2b2b18cb51ff32acc504a6d64f15b8d8d63eedac2cccad
SHA512f17dfc2dea55d49bc2c31729018915a20783309a472e5d040d7cb07cbf718e9588d71c43ea2f69c1929c667b766ecb4a93c1446f86b6c67edc8717bc531188df
-
Filesize
255KB
MD550392b580f909a31dad66ec32c5767db
SHA1282620cff3d4bf01e7ad9f869c9d63c56f8f9366
SHA2567d00aa787f2f1b056a15864afc6f45a36445788d8e5951803a30d16dfb718920
SHA5128ca7e1c20ea61a0fdc7ef9523bd97fad9465989beb3c2b1724273335c4ec4d15844b87302822b5eaecd3fcc71f31ed1b8ef79cf38ac30047f8ca5dbcebb6bb23
-
Filesize
255KB
MD559fd2cb9489ce8be48ef16e32cc0efad
SHA1cf61f34793df10faefd2c72aae3c9ed4aa1e2a2d
SHA256df0b2efa93eb585c5953f0eeb365a142631088151b6973725fa10c32203b30d2
SHA51227f29c87201d13d7f66c20b087d7126b1450514b0eda6ba6ce102525d4c9a92177f16bab290b26d998e457003a31942bf8c778c997f3d5f81bedba88ddadf23f
-
Filesize
255KB
MD5ba1a1c57cfe0cfe3ea0697d813fce4b3
SHA1cb3de6c2038ad911069bcc86d6c2f3148ad9d346
SHA256e3ac829bed794facc3d9652a0e1e9c739728ab1a009eef02853ec1854445d44e
SHA512196a9e040708b451ca88c4f32d2c5234c3816313c06156c66cc51553a21dd088be3871bdbd93fe701f2fbaffd64b8553447559a1df2ea1227365816f88d1a334
-
Filesize
255KB
MD5ba1a1c57cfe0cfe3ea0697d813fce4b3
SHA1cb3de6c2038ad911069bcc86d6c2f3148ad9d346
SHA256e3ac829bed794facc3d9652a0e1e9c739728ab1a009eef02853ec1854445d44e
SHA512196a9e040708b451ca88c4f32d2c5234c3816313c06156c66cc51553a21dd088be3871bdbd93fe701f2fbaffd64b8553447559a1df2ea1227365816f88d1a334
-
Filesize
255KB
MD5ba1a1c57cfe0cfe3ea0697d813fce4b3
SHA1cb3de6c2038ad911069bcc86d6c2f3148ad9d346
SHA256e3ac829bed794facc3d9652a0e1e9c739728ab1a009eef02853ec1854445d44e
SHA512196a9e040708b451ca88c4f32d2c5234c3816313c06156c66cc51553a21dd088be3871bdbd93fe701f2fbaffd64b8553447559a1df2ea1227365816f88d1a334
-
Filesize
255KB
MD5c2789821c0ae588ca08d5e355ee8f7c5
SHA154700a9627a313fa1e08eb8f2ba783e7126c7d61
SHA25690d4b028909823e8a07d4aa4b400549649c461778fa6060c411da8cecfefc4c7
SHA5129e9e9b5ec16e99c6f894f6e4c1982c018ad9d663c2140b67f0884d78738429432dac73a8a60216c6dc5dd9134a337f347739d53401c653be0db9e724ee8ed8ea
-
Filesize
255KB
MD5c2789821c0ae588ca08d5e355ee8f7c5
SHA154700a9627a313fa1e08eb8f2ba783e7126c7d61
SHA25690d4b028909823e8a07d4aa4b400549649c461778fa6060c411da8cecfefc4c7
SHA5129e9e9b5ec16e99c6f894f6e4c1982c018ad9d663c2140b67f0884d78738429432dac73a8a60216c6dc5dd9134a337f347739d53401c653be0db9e724ee8ed8ea
-
Filesize
255KB
MD5bb165a5e16a5b011d9346c0e94adcb22
SHA12b9675f3a8def77eb1f0658462317c0e24ab8b75
SHA256bb1b6937182be857ee2c0039f82444774a53734097856988a2e9884a8d7f2b2d
SHA512965f432a4bc0d5de084f9f5ec4adc46a787f03b62f0066834c9685e02b234efae4c36f4f0986a67c4ef187dd5bb07a6eebf9ed373ec52bfd65071d5db4362502
-
Filesize
255KB
MD5bb165a5e16a5b011d9346c0e94adcb22
SHA12b9675f3a8def77eb1f0658462317c0e24ab8b75
SHA256bb1b6937182be857ee2c0039f82444774a53734097856988a2e9884a8d7f2b2d
SHA512965f432a4bc0d5de084f9f5ec4adc46a787f03b62f0066834c9685e02b234efae4c36f4f0986a67c4ef187dd5bb07a6eebf9ed373ec52bfd65071d5db4362502
-
Filesize
255KB
MD570b8460a22d65be8184a91841cf96a23
SHA14e6f536e87fb48877926027bde1d450f79c31f7d
SHA2565281edb17e399199910702a0083d0a5e7bb42dd7a19b874cbf8ab40707976653
SHA5120bb72192b72ddf666383346f7110d55faf6d3d5f0f3eb613ad81ac2083b0e94589a36459da4fbfb977c93d9a637a8c5ae93900561641b26eef848ab896170603
-
Filesize
255KB
MD570b8460a22d65be8184a91841cf96a23
SHA14e6f536e87fb48877926027bde1d450f79c31f7d
SHA2565281edb17e399199910702a0083d0a5e7bb42dd7a19b874cbf8ab40707976653
SHA5120bb72192b72ddf666383346f7110d55faf6d3d5f0f3eb613ad81ac2083b0e94589a36459da4fbfb977c93d9a637a8c5ae93900561641b26eef848ab896170603
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5727a10fd9a2f964e43ceda4752eb36b3
SHA1035ccfd1b4107b5224b08d0d9c5a0642275045b6
SHA25699a93e8d3c2b5762444d3113a6145b8dd4172f8a4ca5c5cd4fd1bb5bda51e5e5
SHA5125fda0c789475ad84dd46dd0bd19aa7526210979e4b1f62d7bf43999b8c90cbc7a5281a7775a8045a25a556b81a1d1b2329295b000f3f88c1a52ba3c86c7f21b0
-
Filesize
255KB
MD504a8e684fb59fbaaa334e15cd9752bcb
SHA1fada5718507d6ed5e1c269bc898b831e6ee22ba9
SHA25648bec1d0158010e408d79b8d5d5e173d913478233ec971cb25d11a2aec20bd5f
SHA5122cc31101e8d0ae21b4008e57bc218f9885d4cfbe42dfe240ec263bb184e3ac30a6c349fc6347b3bad8175a320328c5ef6f1a15a2f8ab4226e7a69a8d77818f0e
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB