Analysis
-
max time kernel
176s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:07
General
-
Target
15374c0ab314edc72f35a43bfa02f56a41eb7ed98d4fc03f226b59212e201ea2.exe
-
Size
255KB
-
MD5
88f4d95cd04a4e8243ccb4c0d11bb9ca
-
SHA1
c819d5a1d9857db7f951630b774c60f62566e8d5
-
SHA256
15374c0ab314edc72f35a43bfa02f56a41eb7ed98d4fc03f226b59212e201ea2
-
SHA512
5c377d65bcb89a49b348845ea012e5020c88bdbf667be132c5695f1051c5df17c94c018b5872ec9b60cb08264af539bc4da629f2030a54b5731cca8f873005c2
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJU:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIJ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15374c0ab314edc72f35a43bfa02f56a41eb7ed98d4fc03f226b59212e201ea2.exe"C:\Users\Admin\AppData\Local\Temp\15374c0ab314edc72f35a43bfa02f56a41eb7ed98d4fc03f226b59212e201ea2.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ztshkowyov.exeztshkowyov.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\lebodrqc.exeC:\Windows\system32\lebodrqc.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\wgkcshktygfoppy.exewgkcshktygfoppy.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c bfqkkjygccisw.exe3⤵
-
-
-
C:\Windows\SysWOW64\lebodrqc.exelebodrqc.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\bfqkkjygccisw.exebfqkkjygccisw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD57eac9a687898530ca423916ebfec8b77
SHA1f184491e28d8c0ebaa0adac6e654fee3137a5501
SHA2563fe05157865c278c99b319189c3a96f1e4b5cc16eeb2c32a815a94ac42be1c71
SHA51213a6065ea62fe0ed4374c3faa95975f53392732fef6879a959b34b1835d8c1559aadd54fb4164bb436981f035e22075dd0bb265bb24e093c20ba163ad9e04400
-
Filesize
255KB
MD57eac9a687898530ca423916ebfec8b77
SHA1f184491e28d8c0ebaa0adac6e654fee3137a5501
SHA2563fe05157865c278c99b319189c3a96f1e4b5cc16eeb2c32a815a94ac42be1c71
SHA51213a6065ea62fe0ed4374c3faa95975f53392732fef6879a959b34b1835d8c1559aadd54fb4164bb436981f035e22075dd0bb265bb24e093c20ba163ad9e04400
-
Filesize
255KB
MD5a6c0aa0ddd1f72cb87a8f10e8a4fd52b
SHA15041f39f5d4a619b2ac92e912ce28ef63b5dc6fe
SHA25683550a7a0d982ec82de9717c0720d139a0039797e3f9ab44ca1f6cc98c3deecc
SHA512010126d38cdeb88007d7fff75be33c72eda8bac5f3a17fb597bc29f5ac97ba4505db19faff382939a5836ec45a16ce8d2a117f2bb2b92cef459b46ed1a76754b
-
Filesize
255KB
MD534d955c4267036f2a10b5fef4456fcb3
SHA13a2b8f51cb8e4132ed9d3dd77c0474c9818ce855
SHA256d04ff7f0d70373a0a49730b9f0de55c807a14292aad5b31451d7b4dbd63747cd
SHA512a0fba41fab69171c3bae55ccec1f1e4640672fbabb741e4ba017a8776420fde97c78a1ce145a34171e7758050fc87f5dc763294abd22c4a5af2b0763731a27d8
-
Filesize
255KB
MD534d955c4267036f2a10b5fef4456fcb3
SHA13a2b8f51cb8e4132ed9d3dd77c0474c9818ce855
SHA256d04ff7f0d70373a0a49730b9f0de55c807a14292aad5b31451d7b4dbd63747cd
SHA512a0fba41fab69171c3bae55ccec1f1e4640672fbabb741e4ba017a8776420fde97c78a1ce145a34171e7758050fc87f5dc763294abd22c4a5af2b0763731a27d8
-
Filesize
255KB
MD5e90647943e01d8f855a248957ff0bfa6
SHA1c7f6e5215c1c4bddc39a11858158e191aa5dd0c0
SHA2569f172f1f3423585d889a8fddad560750a0f54402fa9d9592944a30684d73f5fe
SHA512533285b38d7b1d83c46d53fbceae88605a94d9bd7b2bc7d3470b6970463489ced0004c03672e0638dea0d37d44b43ac390628ea6d3adb6609e790472676f64af
-
Filesize
255KB
MD5e90647943e01d8f855a248957ff0bfa6
SHA1c7f6e5215c1c4bddc39a11858158e191aa5dd0c0
SHA2569f172f1f3423585d889a8fddad560750a0f54402fa9d9592944a30684d73f5fe
SHA512533285b38d7b1d83c46d53fbceae88605a94d9bd7b2bc7d3470b6970463489ced0004c03672e0638dea0d37d44b43ac390628ea6d3adb6609e790472676f64af
-
Filesize
255KB
MD5e90647943e01d8f855a248957ff0bfa6
SHA1c7f6e5215c1c4bddc39a11858158e191aa5dd0c0
SHA2569f172f1f3423585d889a8fddad560750a0f54402fa9d9592944a30684d73f5fe
SHA512533285b38d7b1d83c46d53fbceae88605a94d9bd7b2bc7d3470b6970463489ced0004c03672e0638dea0d37d44b43ac390628ea6d3adb6609e790472676f64af
-
Filesize
255KB
MD508efe7a1cc7482fe8fc32d3bc6dfbc77
SHA1aa8f8e83d7dffc393fa0811f8945797fa806bd32
SHA2561f15ac07ccee2959b9a10f4507648ac076daba4b839b8d40c070b296ed52ccde
SHA5126e75124d4a5f566f2f888ed6fbaddd321c8a63ab185863bdc4974007f2041fafeeef0e8e30be013fd5173e8aa757d0a58895bed33c08bace4e874b9678ef02db
-
Filesize
255KB
MD508efe7a1cc7482fe8fc32d3bc6dfbc77
SHA1aa8f8e83d7dffc393fa0811f8945797fa806bd32
SHA2561f15ac07ccee2959b9a10f4507648ac076daba4b839b8d40c070b296ed52ccde
SHA5126e75124d4a5f566f2f888ed6fbaddd321c8a63ab185863bdc4974007f2041fafeeef0e8e30be013fd5173e8aa757d0a58895bed33c08bace4e874b9678ef02db
-
Filesize
255KB
MD51975ec7c59c2f67024f0fc5d313176cd
SHA17d8258c1790150553055df860ea1dd75e2ba6744
SHA256d55a612aa65afa2acec7c7eeee10da7694d7339b15b67d4c80087faf7ba1cd9f
SHA512dc190c89b633fb95461c1b8ef2a2d427f58602ed137313759213be417fd06d4a439da1d7b445d4636b0d1706498865690cd54c85b5959b1791d3a306c17ca37b
-
Filesize
255KB
MD51975ec7c59c2f67024f0fc5d313176cd
SHA17d8258c1790150553055df860ea1dd75e2ba6744
SHA256d55a612aa65afa2acec7c7eeee10da7694d7339b15b67d4c80087faf7ba1cd9f
SHA512dc190c89b633fb95461c1b8ef2a2d427f58602ed137313759213be417fd06d4a439da1d7b445d4636b0d1706498865690cd54c85b5959b1791d3a306c17ca37b
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-