Analysis
-
max time kernel
205s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 21:07
General
-
Target
0e9509ba1470b7f72f38627437c0f48d47cf779aa027264485bff8e5aa8b6c16.exe
-
Size
255KB
-
MD5
d3437a13f5f27c51b9d160e3ad55c085
-
SHA1
19857514dac771276ef5d0d46eeed319762d52c1
-
SHA256
0e9509ba1470b7f72f38627437c0f48d47cf779aa027264485bff8e5aa8b6c16
-
SHA512
be03fa8f37d1a21c5fd6d7c33226632dd87dc9530085983561a749276e6a4be742247e30d347a29292b31eea1ba4d586ca242ad006f9c247cde4b5ca44c9fa05
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ4:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIZ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e9509ba1470b7f72f38627437c0f48d47cf779aa027264485bff8e5aa8b6c16.exe"C:\Users\Admin\AppData\Local\Temp\0e9509ba1470b7f72f38627437c0f48d47cf779aa027264485bff8e5aa8b6c16.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\qgbxfsagel.exeqgbxfsagel.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zjexiyon.exeC:\Windows\system32\zjexiyon.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\unjjgjuumigxnab.exeunjjgjuumigxnab.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\zjexiyon.exezjexiyon.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\adtwvlxztvwer.exeadtwvlxztvwer.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5e9d22d91eda42493960974aa671961d8
SHA1cdfa87a785c0626c53d94cbdad3749e187e06890
SHA2565dbfff72ec0da168d1ec5f00dc4fdde97f626cb7ec33b483e2711e63dc1e025a
SHA512dbbfe64956dc3012d4d3032fe2e8113f8a94b1f8de239278802174ce3337e462879794e2d2e492d379ad51aeb0d4a24c1368f3490adecd9519e164ace81016dc
-
Filesize
255KB
MD5554704f40b4f64d9803431e9b484a535
SHA1aa1d1977c13b84b174583232d28065eaeaf32b61
SHA256efce474048e153d02ce794fc02f5d1211551ded8ba0277c7f8e7da36964bf0a2
SHA5120f8fc9e6e98bb9f02defb4134d5bcf73ee23a0cec3938584920c34aa6d685c15551e1afa568984cc2917284c1eb5bac21717af1c79dfd345d57518fac9a2e2fb
-
Filesize
255KB
MD595f6abaecfcbe2bb0956dc83f5012390
SHA117028df1506749bbe9338732544553fac1b38c63
SHA256d46f6088548f3be52b73f0be8d0a3639bf5f039a83ab4522cc969513e098e213
SHA512915ef6c22abe2a45911b4bd55ee672f867c858e9ff46cf89f7291fa7e8f0e956b7115fcf3a6fb66aac70d0ffff9cb41865d138d7c1f49fb6f310cf15b42d1970
-
Filesize
255KB
MD595f6abaecfcbe2bb0956dc83f5012390
SHA117028df1506749bbe9338732544553fac1b38c63
SHA256d46f6088548f3be52b73f0be8d0a3639bf5f039a83ab4522cc969513e098e213
SHA512915ef6c22abe2a45911b4bd55ee672f867c858e9ff46cf89f7291fa7e8f0e956b7115fcf3a6fb66aac70d0ffff9cb41865d138d7c1f49fb6f310cf15b42d1970
-
Filesize
255KB
MD5217f5102dcc59f0021e8f93462ebb312
SHA162b0cdb4d6eab6a47072e1166b55898e12ed4c61
SHA2563cdccdd2b5ba8ee2f0b71dc57e89478d49abead0b3be7d100c9e6caa0e58062a
SHA51277af469bd28c02c9729affe36778f55762334ca4a924bf32d363456024217b758952ac09cc7c9924c972f5c250c7615fdf183c2184fb8f1d0e8573a2aa993eeb
-
Filesize
255KB
MD5217f5102dcc59f0021e8f93462ebb312
SHA162b0cdb4d6eab6a47072e1166b55898e12ed4c61
SHA2563cdccdd2b5ba8ee2f0b71dc57e89478d49abead0b3be7d100c9e6caa0e58062a
SHA51277af469bd28c02c9729affe36778f55762334ca4a924bf32d363456024217b758952ac09cc7c9924c972f5c250c7615fdf183c2184fb8f1d0e8573a2aa993eeb
-
Filesize
255KB
MD570c68ee34008548dd6f9484a66200f22
SHA1bfdbe213036af5412b0cb8526c5853b17a3ad444
SHA256e2a88cb3f281e2106b95eb2040515dc7304641a442a76ce420c6d46e9636a059
SHA512cbc1d3139ff6071ce5d1e908c9d1fe138a0086d520784b6daf92941e99305eb23ed1f72c4dac5ad60cc04902fdd142b8ea8eba7f162a32e447359739ecaa94cb
-
Filesize
255KB
MD570c68ee34008548dd6f9484a66200f22
SHA1bfdbe213036af5412b0cb8526c5853b17a3ad444
SHA256e2a88cb3f281e2106b95eb2040515dc7304641a442a76ce420c6d46e9636a059
SHA512cbc1d3139ff6071ce5d1e908c9d1fe138a0086d520784b6daf92941e99305eb23ed1f72c4dac5ad60cc04902fdd142b8ea8eba7f162a32e447359739ecaa94cb
-
Filesize
255KB
MD594a60f3fef2c78bf52e00f8c61155fb1
SHA1d3eca872e43c9eb23bf59ea00cf10cfdbe839f02
SHA2564d1f41a16f684c9335ae5dff4492ba0b8674e895b62eba68f8847131dc2e4eda
SHA512d643641b58d377898d1cb3852f858945e1821be35dce2f19bc1806caa4adc70bb16f28384948693e5e24c3221c3e7869b5b096c3518960fb666f927daa278184
-
Filesize
255KB
MD594a60f3fef2c78bf52e00f8c61155fb1
SHA1d3eca872e43c9eb23bf59ea00cf10cfdbe839f02
SHA2564d1f41a16f684c9335ae5dff4492ba0b8674e895b62eba68f8847131dc2e4eda
SHA512d643641b58d377898d1cb3852f858945e1821be35dce2f19bc1806caa4adc70bb16f28384948693e5e24c3221c3e7869b5b096c3518960fb666f927daa278184
-
Filesize
255KB
MD594a60f3fef2c78bf52e00f8c61155fb1
SHA1d3eca872e43c9eb23bf59ea00cf10cfdbe839f02
SHA2564d1f41a16f684c9335ae5dff4492ba0b8674e895b62eba68f8847131dc2e4eda
SHA512d643641b58d377898d1cb3852f858945e1821be35dce2f19bc1806caa4adc70bb16f28384948693e5e24c3221c3e7869b5b096c3518960fb666f927daa278184
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5554704f40b4f64d9803431e9b484a535
SHA1aa1d1977c13b84b174583232d28065eaeaf32b61
SHA256efce474048e153d02ce794fc02f5d1211551ded8ba0277c7f8e7da36964bf0a2
SHA5120f8fc9e6e98bb9f02defb4134d5bcf73ee23a0cec3938584920c34aa6d685c15551e1afa568984cc2917284c1eb5bac21717af1c79dfd345d57518fac9a2e2fb
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB