Analysis
-
max time kernel
206s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:07
General
-
Target
1704c4d430de068a53f58f4f25b1910c7e38f4fbf901d8a4ed77749e01d358f6.exe
-
Size
255KB
-
MD5
89943527e8ca797d5669709673dea613
-
SHA1
9a0c1d4c1e04cd5302d02d475c77d5e75097454c
-
SHA256
1704c4d430de068a53f58f4f25b1910c7e38f4fbf901d8a4ed77749e01d358f6
-
SHA512
9d52400b0c5c9163fc43bb9165d430091ee9265df6959dbcc041ca507c09b5f57eb7b756f9f6b5912417998d10125ae7ddf4758180f8c91da475eeabee693997
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJu:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIp
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1704c4d430de068a53f58f4f25b1910c7e38f4fbf901d8a4ed77749e01d358f6.exe"C:\Users\Admin\AppData\Local\Temp\1704c4d430de068a53f58f4f25b1910c7e38f4fbf901d8a4ed77749e01d358f6.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mcrdzkachk.exemcrdzkachk.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\pjvcthep.exeC:\Windows\system32\pjvcthep.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\kqacdypcxbldwvl.exekqacdypcxbldwvl.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\pjvcthep.exepjvcthep.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\jazctmfiuzdkf.exejazctmfiuzdkf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5617b5adf17d6713bf0b513d2a53a31ef
SHA1b5a300e98720d6420553f3b10ad2a699ee487105
SHA2560d458242e8e77cabd1da0389cc09374f7c3c0672c75370d5384d8bad431081dc
SHA5127acc6fef88c2789cc388915a21e0d654ebe0ef3a36bbbd3a36c90c4dcf8f1eb891ab95466142e1aa20f42144c90bdedc1f2d51858a2c1b9f9e9313d00a2138d0
-
Filesize
255KB
MD50fcc7c849ec145749453b18f55e2804e
SHA19b9dd9e0d81e642b7231c2559b18cf803a20d018
SHA256aa049a4fb8f0f22200fcc01bb33c75bcf0669cc8d960d7fcdd512b4c34423c46
SHA512cff0f2ce6126b35c9027646c367413f04b7ab6e722e168e05d2ddf7dc6d548b8b70a7a22bdac7b63b743f3155e69ce096ad6adee37da5ee801841d02d040258f
-
Filesize
255KB
MD54f0c2cb1da5b7a98206f302890deff58
SHA1e28e13e13c3f6bccbc88ce99d25f836fef38f906
SHA2562827c2912a092050d0a47fd8853ab13a4621c34da874ecf754bc1a3974174d02
SHA512beee620af38762f93c3af50a9f129463bc2fc31593a7fc4ee9300a1894e70356a0d078becebe779f7b0771762e8d1680662884afebc8c1d0dd2358bab88d1d46
-
Filesize
255KB
MD58833ae089a00fe374b16c1120be86ed0
SHA1c220f9904d22009bb81fab30252136af34af3fb6
SHA25676e402d7f5556a0e4ad6bdb439db4a7f80d5944777d859c6407cb7a3a08a8b05
SHA5128d33b45251e50b22fdb0ce9f076a9c10cefba63f91b00e037028f18984cf583c6c7509e2309bccb67375641c940910faf847f2eba86c40e1cb5ccd32338b6484
-
Filesize
255KB
MD58833ae089a00fe374b16c1120be86ed0
SHA1c220f9904d22009bb81fab30252136af34af3fb6
SHA25676e402d7f5556a0e4ad6bdb439db4a7f80d5944777d859c6407cb7a3a08a8b05
SHA5128d33b45251e50b22fdb0ce9f076a9c10cefba63f91b00e037028f18984cf583c6c7509e2309bccb67375641c940910faf847f2eba86c40e1cb5ccd32338b6484
-
Filesize
255KB
MD511a1edc279e1564f75dfbedd7111fcf0
SHA1585adf8f921ccee166cbe236c33e0c3704e8c0c9
SHA2562b1e9240d4b82ca0394fd108f215f41287ca2d1c694c49203c8ce50b0d2d2333
SHA512ffcda404cfeadc29c76c9189bae70a4cbc9ea9cd44dbb123d1c5190352a9425421f0cadf28ab2d649ce4e885160fc5f1973fa86e7195315a7234e15575edd7e0
-
Filesize
255KB
MD511a1edc279e1564f75dfbedd7111fcf0
SHA1585adf8f921ccee166cbe236c33e0c3704e8c0c9
SHA2562b1e9240d4b82ca0394fd108f215f41287ca2d1c694c49203c8ce50b0d2d2333
SHA512ffcda404cfeadc29c76c9189bae70a4cbc9ea9cd44dbb123d1c5190352a9425421f0cadf28ab2d649ce4e885160fc5f1973fa86e7195315a7234e15575edd7e0
-
Filesize
255KB
MD514ef03e50badca45640125b1555e2b0a
SHA1070c70f39da6023b19fc6dde47cb7b4a105db215
SHA256076a7293845c6eb4b3599b82b77768f53a1212050dd4ffe74e895e57325d678d
SHA51243a24f198bdcf5c5db1313d6c98c9c1932b04036de39ef3bb7ed646e841ccb0722a95e76b92b6aa27c524e3db2d5a08e4843c396b7d5a5004ebbe2f8e486cc08
-
Filesize
255KB
MD514ef03e50badca45640125b1555e2b0a
SHA1070c70f39da6023b19fc6dde47cb7b4a105db215
SHA256076a7293845c6eb4b3599b82b77768f53a1212050dd4ffe74e895e57325d678d
SHA51243a24f198bdcf5c5db1313d6c98c9c1932b04036de39ef3bb7ed646e841ccb0722a95e76b92b6aa27c524e3db2d5a08e4843c396b7d5a5004ebbe2f8e486cc08
-
Filesize
255KB
MD503c932be64f78a1ed1c015aa99c3643f
SHA18de069e9a108ef04f0755835472b214d5b8cd263
SHA2561b2ec15d4c0f527ae0c1cb0dcf3d1bbb0bbd5632828403d6bedf21f8b18e7343
SHA512f2ff82748bf5629d764801a2e7d76afa5be03bbe78fdc4282fb6f619a0f43c30295aed7d08d889af9df63fff9e2e33747faa56f425f37d01c9f40a5d7b03cc82
-
Filesize
255KB
MD503c932be64f78a1ed1c015aa99c3643f
SHA18de069e9a108ef04f0755835472b214d5b8cd263
SHA2561b2ec15d4c0f527ae0c1cb0dcf3d1bbb0bbd5632828403d6bedf21f8b18e7343
SHA512f2ff82748bf5629d764801a2e7d76afa5be03bbe78fdc4282fb6f619a0f43c30295aed7d08d889af9df63fff9e2e33747faa56f425f37d01c9f40a5d7b03cc82
-
Filesize
255KB
MD503c932be64f78a1ed1c015aa99c3643f
SHA18de069e9a108ef04f0755835472b214d5b8cd263
SHA2561b2ec15d4c0f527ae0c1cb0dcf3d1bbb0bbd5632828403d6bedf21f8b18e7343
SHA512f2ff82748bf5629d764801a2e7d76afa5be03bbe78fdc4282fb6f619a0f43c30295aed7d08d889af9df63fff9e2e33747faa56f425f37d01c9f40a5d7b03cc82
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB