Analysis
-
max time kernel
154s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 21:07
General
-
Target
15374c0ab314edc72f35a43bfa02f56a41eb7ed98d4fc03f226b59212e201ea2.exe
-
Size
255KB
-
MD5
88f4d95cd04a4e8243ccb4c0d11bb9ca
-
SHA1
c819d5a1d9857db7f951630b774c60f62566e8d5
-
SHA256
15374c0ab314edc72f35a43bfa02f56a41eb7ed98d4fc03f226b59212e201ea2
-
SHA512
5c377d65bcb89a49b348845ea012e5020c88bdbf667be132c5695f1051c5df17c94c018b5872ec9b60cb08264af539bc4da629f2030a54b5731cca8f873005c2
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJU:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIJ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 29 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 5 IoCs
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 29 IoCs
-
Drops file in Windows directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 33 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 60 IoCs
-
Suspicious use of SendNotifyMessage 47 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15374c0ab314edc72f35a43bfa02f56a41eb7ed98d4fc03f226b59212e201ea2.exe"C:\Users\Admin\AppData\Local\Temp\15374c0ab314edc72f35a43bfa02f56a41eb7ed98d4fc03f226b59212e201ea2.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ukdpefuifm.exeukdpefuifm.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rjfsmwoc.exeC:\Windows\system32\rjfsmwoc.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\filacfzbdywkdph.exefilacfzbdywkdph.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\rjfsmwoc.exerjfsmwoc.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\forvuyxwxytpo.exeforvuyxwxytpo.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5b063423429a58cc3bda312657d9668da
SHA1aa123ccf42a5edd9c106670eb1f3778aecb2667b
SHA2565f10fb9ae50080641b1b33b5e0220778d1e3a7ac759cd601971b9b46ac4f1dc7
SHA512a7f8c78b6c2289c7e1bf7eb5a2636b55a692810b9209accf9a0c48b656279b43a32806821970114d94447d2422ad48a67d1c0d50d407b6b636d87acbca7b9ca2
-
Filesize
255KB
MD5ad3372d1ad5c6b358ed6754751ef51b1
SHA1cb3b92a46cabcf538176c842a30636f52fcf8f10
SHA256755c576cf2e6e5fc33cabfd21a32a7474aaba0019118fefd13fc9a2e8a3f047f
SHA5126c6aa2d0a4dcced0ae889ad39633ab585ae999a74052c8b5df665b057f60d1494e345f3a5b7aea5b7c1e26ed7f31997c85cf61635d8268e4029217c115e8fa96
-
Filesize
255KB
MD5eed2a64e4e75932f703f5b4ee9fea6c2
SHA1f14a4afab2bf25d284983ab85f06e1080c52e6dd
SHA25689bade0de0de60e60aea2c565a9e49ced3792be11d88be47b23c94e5b01adbf0
SHA512e72a309f47806efbdafceb49a420153f9d4eee36c3b9968ee2ecb9c08400cf9fd60cef3a0215c72c80e8872868372ebcddf3514a2ced02e31d033bc6e8c8a30d
-
Filesize
255KB
MD5eed2a64e4e75932f703f5b4ee9fea6c2
SHA1f14a4afab2bf25d284983ab85f06e1080c52e6dd
SHA25689bade0de0de60e60aea2c565a9e49ced3792be11d88be47b23c94e5b01adbf0
SHA512e72a309f47806efbdafceb49a420153f9d4eee36c3b9968ee2ecb9c08400cf9fd60cef3a0215c72c80e8872868372ebcddf3514a2ced02e31d033bc6e8c8a30d
-
Filesize
255KB
MD531cda3ab13d6528bcd0a4fd2b25f2944
SHA1ee2b4275716844e51bee44c41f8f957751339d74
SHA25603c2a5b99f68d9ebbe608f6720ad287a9d04bb5058b96de60bf281180d16a9d8
SHA512b9dd95a963919d8786f5fcef28f6dc3a3a3f78d600ab2d36cdb8332a8fb51d17bdf5f83eb4e9ac57ae5e69059ac57deb485fac89b6c7f83a5cd125d3ce131bab
-
Filesize
255KB
MD531cda3ab13d6528bcd0a4fd2b25f2944
SHA1ee2b4275716844e51bee44c41f8f957751339d74
SHA25603c2a5b99f68d9ebbe608f6720ad287a9d04bb5058b96de60bf281180d16a9d8
SHA512b9dd95a963919d8786f5fcef28f6dc3a3a3f78d600ab2d36cdb8332a8fb51d17bdf5f83eb4e9ac57ae5e69059ac57deb485fac89b6c7f83a5cd125d3ce131bab
-
Filesize
255KB
MD5e1057e9e3f391f4ce154dfbf24ab3d58
SHA1234d56c5b70c28223718428c565ebb9c6fb21d75
SHA2564478338f643c0966d1b0c9b9aa754b4a6df28205cd4684bbdd04118837e22d8a
SHA512a3bf0e84f4abc9105469954c2f45c62b5080965bfcf1f5fccd1d51023af8e05a452bfbd7156c5a26363032561209d9243ae4f08163349d17cde5933282b889e0
-
Filesize
255KB
MD5e1057e9e3f391f4ce154dfbf24ab3d58
SHA1234d56c5b70c28223718428c565ebb9c6fb21d75
SHA2564478338f643c0966d1b0c9b9aa754b4a6df28205cd4684bbdd04118837e22d8a
SHA512a3bf0e84f4abc9105469954c2f45c62b5080965bfcf1f5fccd1d51023af8e05a452bfbd7156c5a26363032561209d9243ae4f08163349d17cde5933282b889e0
-
Filesize
255KB
MD5e1057e9e3f391f4ce154dfbf24ab3d58
SHA1234d56c5b70c28223718428c565ebb9c6fb21d75
SHA2564478338f643c0966d1b0c9b9aa754b4a6df28205cd4684bbdd04118837e22d8a
SHA512a3bf0e84f4abc9105469954c2f45c62b5080965bfcf1f5fccd1d51023af8e05a452bfbd7156c5a26363032561209d9243ae4f08163349d17cde5933282b889e0
-
Filesize
255KB
MD526fd399bd21bf79d6b40d4e89e8f4979
SHA1a18c89a72c2853507b56ecb5c1d2b4d9600a2bfc
SHA256292fcf46c1fb29cf98f86e2909df205e3240df8f85e8b60e272ed2e48ae3a71c
SHA51240dc85782e018db7bc97ee491532a1c08492c3a52cdddb73b6ad12a5a1768e5c06a5fdee0dd49be5cae4e28f91a3849038bc2a9b5ad15e847e2cd3eeb2a77420
-
Filesize
255KB
MD526fd399bd21bf79d6b40d4e89e8f4979
SHA1a18c89a72c2853507b56ecb5c1d2b4d9600a2bfc
SHA256292fcf46c1fb29cf98f86e2909df205e3240df8f85e8b60e272ed2e48ae3a71c
SHA51240dc85782e018db7bc97ee491532a1c08492c3a52cdddb73b6ad12a5a1768e5c06a5fdee0dd49be5cae4e28f91a3849038bc2a9b5ad15e847e2cd3eeb2a77420
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5b063423429a58cc3bda312657d9668da
SHA1aa123ccf42a5edd9c106670eb1f3778aecb2667b
SHA2565f10fb9ae50080641b1b33b5e0220778d1e3a7ac759cd601971b9b46ac4f1dc7
SHA512a7f8c78b6c2289c7e1bf7eb5a2636b55a692810b9209accf9a0c48b656279b43a32806821970114d94447d2422ad48a67d1c0d50d407b6b636d87acbca7b9ca2
-
Filesize
255KB
MD5eed2a64e4e75932f703f5b4ee9fea6c2
SHA1f14a4afab2bf25d284983ab85f06e1080c52e6dd
SHA25689bade0de0de60e60aea2c565a9e49ced3792be11d88be47b23c94e5b01adbf0
SHA512e72a309f47806efbdafceb49a420153f9d4eee36c3b9968ee2ecb9c08400cf9fd60cef3a0215c72c80e8872868372ebcddf3514a2ced02e31d033bc6e8c8a30d
-
Filesize
255KB
MD531cda3ab13d6528bcd0a4fd2b25f2944
SHA1ee2b4275716844e51bee44c41f8f957751339d74
SHA25603c2a5b99f68d9ebbe608f6720ad287a9d04bb5058b96de60bf281180d16a9d8
SHA512b9dd95a963919d8786f5fcef28f6dc3a3a3f78d600ab2d36cdb8332a8fb51d17bdf5f83eb4e9ac57ae5e69059ac57deb485fac89b6c7f83a5cd125d3ce131bab
-
Filesize
255KB
MD5e1057e9e3f391f4ce154dfbf24ab3d58
SHA1234d56c5b70c28223718428c565ebb9c6fb21d75
SHA2564478338f643c0966d1b0c9b9aa754b4a6df28205cd4684bbdd04118837e22d8a
SHA512a3bf0e84f4abc9105469954c2f45c62b5080965bfcf1f5fccd1d51023af8e05a452bfbd7156c5a26363032561209d9243ae4f08163349d17cde5933282b889e0
-
Filesize
255KB
MD5e1057e9e3f391f4ce154dfbf24ab3d58
SHA1234d56c5b70c28223718428c565ebb9c6fb21d75
SHA2564478338f643c0966d1b0c9b9aa754b4a6df28205cd4684bbdd04118837e22d8a
SHA512a3bf0e84f4abc9105469954c2f45c62b5080965bfcf1f5fccd1d51023af8e05a452bfbd7156c5a26363032561209d9243ae4f08163349d17cde5933282b889e0
-
Filesize
255KB
MD526fd399bd21bf79d6b40d4e89e8f4979
SHA1a18c89a72c2853507b56ecb5c1d2b4d9600a2bfc
SHA256292fcf46c1fb29cf98f86e2909df205e3240df8f85e8b60e272ed2e48ae3a71c
SHA51240dc85782e018db7bc97ee491532a1c08492c3a52cdddb73b6ad12a5a1768e5c06a5fdee0dd49be5cae4e28f91a3849038bc2a9b5ad15e847e2cd3eeb2a77420
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
12KB
-
Filesize
8KB
-
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
8KB
-
Filesize
8KB
-
-
Filesize
8KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB