Analysis
-
max time kernel
188s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:07
General
-
Target
103f90b217ded80990f9967fe59fd0c09ec0f631f76e1476142248baf5c21a82.exe
-
Size
255KB
-
MD5
98517f9c412d1e224b62ac7f779feda5
-
SHA1
3b2cfdc9ba2177b640894f73c0d2709ca0969508
-
SHA256
103f90b217ded80990f9967fe59fd0c09ec0f631f76e1476142248baf5c21a82
-
SHA512
9edb988ce7dfb8bf36f521bd437aa45f97e2077fcd053eb175080a90b3e2056e1a24cdeca468c2e25d2e57cbbfbc9e1fdde6510fc94c4998826c05732439ee82
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJa:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIJ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\103f90b217ded80990f9967fe59fd0c09ec0f631f76e1476142248baf5c21a82.exe"C:\Users\Admin\AppData\Local\Temp\103f90b217ded80990f9967fe59fd0c09ec0f631f76e1476142248baf5c21a82.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ukdpefuifm.exeukdpefuifm.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rjfsmwoc.exeC:\Windows\system32\rjfsmwoc.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\filacfzbdywkdph.exefilacfzbdywkdph.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\rjfsmwoc.exerjfsmwoc.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\forvuyxwxytpo.exeforvuyxwxytpo.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5eeaaa67c2937e70e195fa1e00363caa0
SHA1a0ab0f98527344005e55460f087da8f9028d80d0
SHA2569679cc25d9828bda8fbbc89bece43985454be5f826c15a27b301bf78ecbb169e
SHA512287ad24d17335cd685749098bbdd3b44203b786024cbbab57972789f4232709a100c6a43d6de7bd52a73dc871e43400a643b83569260ba2c47090a07b628ee9f
-
Filesize
255KB
MD50956446b7b5b0107712a02bb4eacc445
SHA12bd40a8fe6efee32301ccdcdf74bd1dbad747b80
SHA256ac635a0e89ecc9ff5f20d3b00b9556607bfc8e025665ca9d3b86218f89bc6ef5
SHA51273a2083216a5b574ecd269ec4b8aa47789f68adb8c634d200c82770732340023cdb29f2705f173062c2ceea750f30c8a6128926cd06a5dd2cd6c9c128a0cb34e
-
Filesize
255KB
MD59959ce6e5ac10d385f4189ccb8a0cd64
SHA1cef5f332336d99b0fd15a6917129e69317284cfe
SHA2566e2bc85c9fc4ca7c9311af0e4382f777b1b218d633cc393d99560b2afb863674
SHA51273bfdc99f43ef900df77e963ac9f31db65979b79912aba7ecdb57b87dbed5644d5bfb4d7c29d7504a725b2b39a65cce867c830bfb86594ca2ae2c1af336772da
-
Filesize
255KB
MD59959ce6e5ac10d385f4189ccb8a0cd64
SHA1cef5f332336d99b0fd15a6917129e69317284cfe
SHA2566e2bc85c9fc4ca7c9311af0e4382f777b1b218d633cc393d99560b2afb863674
SHA51273bfdc99f43ef900df77e963ac9f31db65979b79912aba7ecdb57b87dbed5644d5bfb4d7c29d7504a725b2b39a65cce867c830bfb86594ca2ae2c1af336772da
-
Filesize
255KB
MD5e4f48dc2ebb2fb3e6e67d06f2bdff58d
SHA14af115c91997433546f156c22e7def3e61f5d184
SHA256b94e4d43ab5f0b4fe30ed67345aad8ae7faf2177904583435c3a6cff30ac053f
SHA512e4e05b9b5e32a286cda4eed45b7e2e0262f8069d268450cd6b198a8183fc0164b68105ca58b3d75c613c64fbcf08a257ad88f02d196d58e47a5e93317ddc1359
-
Filesize
255KB
MD5e4f48dc2ebb2fb3e6e67d06f2bdff58d
SHA14af115c91997433546f156c22e7def3e61f5d184
SHA256b94e4d43ab5f0b4fe30ed67345aad8ae7faf2177904583435c3a6cff30ac053f
SHA512e4e05b9b5e32a286cda4eed45b7e2e0262f8069d268450cd6b198a8183fc0164b68105ca58b3d75c613c64fbcf08a257ad88f02d196d58e47a5e93317ddc1359
-
Filesize
255KB
MD52f0f8519dabf518374db48152ce5a94b
SHA1da81f95a5c49e3d8eed90b828a48a600bb479ca3
SHA25653ea104e3ed8499f6dfbd3543f8f9e09b2e7c6316d0e61238e0dbf60e9204606
SHA512d8acb0ff06c81e8aa2fa9a63368aa4b003b7c518b3607024d6333d03ed082a35fd95aef75f04cdb90512875e7a01cbe12811b9b2f273f5372ebb87c6a1cca018
-
Filesize
255KB
MD52f0f8519dabf518374db48152ce5a94b
SHA1da81f95a5c49e3d8eed90b828a48a600bb479ca3
SHA25653ea104e3ed8499f6dfbd3543f8f9e09b2e7c6316d0e61238e0dbf60e9204606
SHA512d8acb0ff06c81e8aa2fa9a63368aa4b003b7c518b3607024d6333d03ed082a35fd95aef75f04cdb90512875e7a01cbe12811b9b2f273f5372ebb87c6a1cca018
-
Filesize
255KB
MD52f0f8519dabf518374db48152ce5a94b
SHA1da81f95a5c49e3d8eed90b828a48a600bb479ca3
SHA25653ea104e3ed8499f6dfbd3543f8f9e09b2e7c6316d0e61238e0dbf60e9204606
SHA512d8acb0ff06c81e8aa2fa9a63368aa4b003b7c518b3607024d6333d03ed082a35fd95aef75f04cdb90512875e7a01cbe12811b9b2f273f5372ebb87c6a1cca018
-
Filesize
255KB
MD50dae8cc51d3725108b2d5f8cbf22a59b
SHA1391a2b3879995334dc7ffa1ac8d13622a0cdf895
SHA2563fd69ba6c5144a6e73bab3d48537568a677b2ad4f114ab435a9cdf65477d0162
SHA51255fc6c6e861828e29ab98df194c1712445a355c1c0e258987fed3d934b07b450970516cd958e232c9db7657c08f1809afbaa03c84163dc1ef11a0d4ded170c0c
-
Filesize
255KB
MD50dae8cc51d3725108b2d5f8cbf22a59b
SHA1391a2b3879995334dc7ffa1ac8d13622a0cdf895
SHA2563fd69ba6c5144a6e73bab3d48537568a677b2ad4f114ab435a9cdf65477d0162
SHA51255fc6c6e861828e29ab98df194c1712445a355c1c0e258987fed3d934b07b450970516cd958e232c9db7657c08f1809afbaa03c84163dc1ef11a0d4ded170c0c
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB