Analysis
-
max time kernel
160s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 21:06
General
-
Target
25fd2967c800ae3c3a8db53dec530585b64a8c846213cc6e2e17b025cb5d065b.exe
-
Size
255KB
-
MD5
58e8d3fc8f35fc196a924d00e903b83f
-
SHA1
71aca274aeb4d41e0f6141173a98b7607aa374dc
-
SHA256
25fd2967c800ae3c3a8db53dec530585b64a8c846213cc6e2e17b025cb5d065b
-
SHA512
0524fcb1222d4f567b648858594669ce411ca92f45a566a27320016eedd6ec0de6550a4667b22f3dcd3a9a09cebf3e7c928026d5418c2bcf48af50dd35aa0c9e
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIs
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\25fd2967c800ae3c3a8db53dec530585b64a8c846213cc6e2e17b025cb5d065b.exe"C:\Users\Admin\AppData\Local\Temp\25fd2967c800ae3c3a8db53dec530585b64a8c846213cc6e2e17b025cb5d065b.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wyfpopqtlb.exewyfpopqtlb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xsiytbno.exeC:\Windows\system32\xsiytbno.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\lvzmarqkzyxopwl.exelvzmarqkzyxopwl.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\xsiytbno.exexsiytbno.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\tdzodaewrcrjn.exetdzodaewrcrjn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD54131bb0ee66b15f0f272e7f851140113
SHA1b1d661a2c5765711fe04bd6c6666b7a8cd972a3c
SHA2563baf6c710e0bbee10c5c26f5361eb76a78c38e30c2ed82c03d4b727470b795ce
SHA51260fbdc3b1fbce7229363bb88fae08ade4b44f218b32b8a5603bd52c81b66eb1eae58cd16728daecedc87cd2dda2fecdce5499084e57748922bf14c7ef19cd10c
-
Filesize
255KB
MD506f80c41829cfedb616c468875e09dbf
SHA10cdc08a18a50877a73762260f580cdde86873351
SHA256b798f42779d7406674ee9b296d7c7c6d34b4e29cd50c44ba88a1e8c6fd836c5e
SHA5120cb624dbd7191809dd69b0674aa980b96ebe04ee8169ac73d17112e477a81bbec783686ad9508884c2530bbb536129dc8e4127a7742bdeac19d25fd4bf48ffac
-
Filesize
255KB
MD5bd610c6ef4444944e1c33b940d29743e
SHA15007bf5081c9e23d72d941aefca12dbfaf2a28b2
SHA25664459c119d9dd96d682444fcb1ef130d6363f2a119a4e9808afcd258229a75ed
SHA512e4d5e8f5b5634586dfe5f2ba3270bcd2ef4e7216e1f3cc17b058ffee7f71d4f639a7643b165851759060f59c75d6d76351debeaf69a596068f423491aeccd7cf
-
Filesize
255KB
MD51ec11e1de2c75c3da550507462fd257f
SHA12b7fbd7717d3d3e6a8e1310d0fb452afcd6ad902
SHA256f9c12de5dfb754c8298b23f04076b23e93fec84b71e654b60786ac882f90e496
SHA5122b7211857da6a2832d68255b1deece9956d305f1642bd12a3d45cc8a2782f4de22d8b9a22a61e7a0d70bc1e510ef99855862056f8aa97c4006db0bd1ba8a6adb
-
Filesize
255KB
MD51ec11e1de2c75c3da550507462fd257f
SHA12b7fbd7717d3d3e6a8e1310d0fb452afcd6ad902
SHA256f9c12de5dfb754c8298b23f04076b23e93fec84b71e654b60786ac882f90e496
SHA5122b7211857da6a2832d68255b1deece9956d305f1642bd12a3d45cc8a2782f4de22d8b9a22a61e7a0d70bc1e510ef99855862056f8aa97c4006db0bd1ba8a6adb
-
Filesize
255KB
MD51066e4e40de89857976fc6d65be57b2b
SHA1aa4d29c3c5928e1a39ac1cb0d7c4256baa3f7608
SHA256dd040c9d11466ab28851fd3399cb18109aa494c313f81ba278b04924326aeb90
SHA512736ab2afbb51e0f348954fdca6afda4000661a5e6a8f2ae202090fe4f2055d1e8a8bb62234bf13f12b1ad9f18c4acc17a6f1b7206bcf903ae04118aa1e4536b9
-
Filesize
255KB
MD51066e4e40de89857976fc6d65be57b2b
SHA1aa4d29c3c5928e1a39ac1cb0d7c4256baa3f7608
SHA256dd040c9d11466ab28851fd3399cb18109aa494c313f81ba278b04924326aeb90
SHA512736ab2afbb51e0f348954fdca6afda4000661a5e6a8f2ae202090fe4f2055d1e8a8bb62234bf13f12b1ad9f18c4acc17a6f1b7206bcf903ae04118aa1e4536b9
-
Filesize
255KB
MD5f5b042e09969c9dce7eaa4e6c7e9f880
SHA1ccf33568b5a7ffb04983a2f7a8413da96ba7b52f
SHA2560feec1c696ad8bed4723452dca68c82adddf5e429d47c1bdf410f5d1474674ba
SHA512d9877f7d6e93357594fe9898b3cf169c9cd4ce56a75f961f49fda0b531bf4883bec49c699b6e459aa72f25fafbfcb03d391cd93980c0a32841719425f52d9eba
-
Filesize
255KB
MD5f5b042e09969c9dce7eaa4e6c7e9f880
SHA1ccf33568b5a7ffb04983a2f7a8413da96ba7b52f
SHA2560feec1c696ad8bed4723452dca68c82adddf5e429d47c1bdf410f5d1474674ba
SHA512d9877f7d6e93357594fe9898b3cf169c9cd4ce56a75f961f49fda0b531bf4883bec49c699b6e459aa72f25fafbfcb03d391cd93980c0a32841719425f52d9eba
-
Filesize
255KB
MD58b86fad1ac3e1e9d0c55046bd71a5330
SHA17b14d1bd0fb17ee09c28efb2574ca4edce07c74c
SHA256b714cab9fe63afcd31aace3d97b9eee13879fb2dee341a4758361b943495d8b4
SHA51225473b1f9ad5cba052743ea4e2fc0ed530b96c4f1369f979281aeb6f85d5fbea4d7091f15ee606098dbcb730611a1d0fdbaeb65581229e5d99c0372204f9bc66
-
Filesize
255KB
MD58b86fad1ac3e1e9d0c55046bd71a5330
SHA17b14d1bd0fb17ee09c28efb2574ca4edce07c74c
SHA256b714cab9fe63afcd31aace3d97b9eee13879fb2dee341a4758361b943495d8b4
SHA51225473b1f9ad5cba052743ea4e2fc0ed530b96c4f1369f979281aeb6f85d5fbea4d7091f15ee606098dbcb730611a1d0fdbaeb65581229e5d99c0372204f9bc66
-
Filesize
255KB
MD58b86fad1ac3e1e9d0c55046bd71a5330
SHA17b14d1bd0fb17ee09c28efb2574ca4edce07c74c
SHA256b714cab9fe63afcd31aace3d97b9eee13879fb2dee341a4758361b943495d8b4
SHA51225473b1f9ad5cba052743ea4e2fc0ed530b96c4f1369f979281aeb6f85d5fbea4d7091f15ee606098dbcb730611a1d0fdbaeb65581229e5d99c0372204f9bc66
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD506f80c41829cfedb616c468875e09dbf
SHA10cdc08a18a50877a73762260f580cdde86873351
SHA256b798f42779d7406674ee9b296d7c7c6d34b4e29cd50c44ba88a1e8c6fd836c5e
SHA5120cb624dbd7191809dd69b0674aa980b96ebe04ee8169ac73d17112e477a81bbec783686ad9508884c2530bbb536129dc8e4127a7742bdeac19d25fd4bf48ffac
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-