Analysis
-
max time kernel
152s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
24-11-2022 05:21
General
-
Target
4260039b22e54e96067f65c97c2cf944569ea40891bc8134b4216403e93b486a.exe
-
Size
255KB
-
MD5
426f8893a86aa3232ed527e12f36b57b
-
SHA1
5911a050ed852a78aee5799611c86abe12493a6a
-
SHA256
4260039b22e54e96067f65c97c2cf944569ea40891bc8134b4216403e93b486a
-
SHA512
c05aed47f9a631920ee1927170b1dde6790edd53b03a7d1314bca3bc1eda876fcf40ca59a9c838f70a96a04a16c3c507afb31ccb6d5ee57030f1dc66d967e1ec
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIu
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4260039b22e54e96067f65c97c2cf944569ea40891bc8134b4216403e93b486a.exe"C:\Users\Admin\AppData\Local\Temp\4260039b22e54e96067f65c97c2cf944569ea40891bc8134b4216403e93b486a.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\turbemnogk.exeturbemnogk.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xwyxanpd.exeC:\Windows\system32\xwyxanpd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\btfgggxbbydzain.exebtfgggxbbydzain.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\xwyxanpd.exexwyxanpd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ekdbwtcknlkmh.exeekdbwtcknlkmh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD58c3c7a83440b223016109da1bca3ab24
SHA19b1410f5121e12a9d4bd9efe7765490e08b74ddc
SHA256a108ba6e26bea4f1f7c6b4b7b0650c9dc81425e31763e8b5c3be8515faa9b87c
SHA51294115eddbd41a6389b66815cc270ee99c973a674f54fdc8006f6bdb2c141cbe0af4db1a79591cfbb6c3459762a9c5d404d399351648059a0d8878b536ee3f801
-
Filesize
255KB
MD57fb0bef0a8cfaa2d81c623107f3327d4
SHA1dd9483aae8815a4401e77797de7c21ec074ebb4e
SHA256cf83826735410abba0dc6a558b3c3882fbc0af284c6f9914a21c356fc0ad01f2
SHA512976492d5606aef72528c9736e7f14a617e8bde5f1e85449fe192f593d9661cb30c64505419b8482538461a423daea2b395d9b854ef78496ee5357cbed503a346
-
Filesize
255KB
MD559a64715df2d83876c550d7dfc477e36
SHA1e05aa4df3910af64c8332efeedee24e3a4b56682
SHA256c45c2eaa1e34a4a26c1cdbfaaaa10fa0a81bb00f514e8e84c54cf4e7f862959f
SHA51222ba9e21e99f7616b7700061f4590dada063402ea2b07e8015da22487e2bc2a82781c7b17a7cd97043157e7f5ff7042dcd17e6243907d86bd39bf1f1ead375fd
-
Filesize
255KB
MD5ba418943c48f03cc347227bc16b5aa89
SHA1fdf33c1a09cae4c87020e0f2b528c2fdc9be9b1c
SHA25613ae2b42673646cea509f299c1089cd9f4c20bc14a849c975a8a8288b4cd60d1
SHA5125513d2e93db6e2c7e584d2a09ea932592a7975531b9db79d99127378caa7f30cfef8c4d928a1a64a6c1fc6a720f251fbeafd95eec80b16a9316460a24fcbf7a7
-
Filesize
255KB
MD5ba418943c48f03cc347227bc16b5aa89
SHA1fdf33c1a09cae4c87020e0f2b528c2fdc9be9b1c
SHA25613ae2b42673646cea509f299c1089cd9f4c20bc14a849c975a8a8288b4cd60d1
SHA5125513d2e93db6e2c7e584d2a09ea932592a7975531b9db79d99127378caa7f30cfef8c4d928a1a64a6c1fc6a720f251fbeafd95eec80b16a9316460a24fcbf7a7
-
Filesize
255KB
MD5f80cffd7baa31ea37c5efdb0131e658e
SHA12ba1fef9db9db946a45be3855092f6a9d3f8bbf7
SHA2568d3faad137dd5b259e776626aafe8fd9ec2b1f407988dd353513cd951855332d
SHA512c8e2e090a079d983b1853ec773bf763cfb9d3fccd9281aaa499e1aff772bd9d0588485c444587b59dd47dd3a4f56471f7e1929b57261e33d9235c05ab5c4c070
-
Filesize
255KB
MD5f80cffd7baa31ea37c5efdb0131e658e
SHA12ba1fef9db9db946a45be3855092f6a9d3f8bbf7
SHA2568d3faad137dd5b259e776626aafe8fd9ec2b1f407988dd353513cd951855332d
SHA512c8e2e090a079d983b1853ec773bf763cfb9d3fccd9281aaa499e1aff772bd9d0588485c444587b59dd47dd3a4f56471f7e1929b57261e33d9235c05ab5c4c070
-
Filesize
255KB
MD55bd625a0db866c7da19bfe7d8798ee6d
SHA1e1fc2aa2a7b378163a67adc70ad2a1f9a16f9087
SHA2567ffc6beb4d4dd4747612ce79585263b882f228d65c9faa9ab9a9c22882c7eece
SHA512e528bdd84d9073c8e10cf6736c8e8059301c1fcf3ccabfeb92dc26501cbb492506db7603a6971ef550b47d5b385322bf15c3c3f8b5e81b253242467ec8690868
-
Filesize
255KB
MD55bd625a0db866c7da19bfe7d8798ee6d
SHA1e1fc2aa2a7b378163a67adc70ad2a1f9a16f9087
SHA2567ffc6beb4d4dd4747612ce79585263b882f228d65c9faa9ab9a9c22882c7eece
SHA512e528bdd84d9073c8e10cf6736c8e8059301c1fcf3ccabfeb92dc26501cbb492506db7603a6971ef550b47d5b385322bf15c3c3f8b5e81b253242467ec8690868
-
Filesize
255KB
MD5e0210317578058cba5168b50d3c4aaab
SHA1becc0e7645577062f3ad82f90bb4291a6b710615
SHA25603553c10954da7a59342dd52bfc1e7e8107ef4a8fa7d4311dc1cafca73f47513
SHA512b51593a7d9e08e130b0d6a132040dfe75f867fe87f25fc24160b772c212667a122a44e52e648615db1297eb13c83067fbc66e5f88a37e9550aaef9758962d3b7
-
Filesize
255KB
MD5e0210317578058cba5168b50d3c4aaab
SHA1becc0e7645577062f3ad82f90bb4291a6b710615
SHA25603553c10954da7a59342dd52bfc1e7e8107ef4a8fa7d4311dc1cafca73f47513
SHA512b51593a7d9e08e130b0d6a132040dfe75f867fe87f25fc24160b772c212667a122a44e52e648615db1297eb13c83067fbc66e5f88a37e9550aaef9758962d3b7
-
Filesize
255KB
MD5e0210317578058cba5168b50d3c4aaab
SHA1becc0e7645577062f3ad82f90bb4291a6b710615
SHA25603553c10954da7a59342dd52bfc1e7e8107ef4a8fa7d4311dc1cafca73f47513
SHA512b51593a7d9e08e130b0d6a132040dfe75f867fe87f25fc24160b772c212667a122a44e52e648615db1297eb13c83067fbc66e5f88a37e9550aaef9758962d3b7
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5f7e2ecc8a34bcb2c1416be8f00b1259c
SHA1d150360b349b62e3368abf4dc48c29afdc9b95c6
SHA256ee7e2a9e12ec7f1ea56bbed539e30037d8aa03c22f4293c63e142568f98a2733
SHA5123aa9ecf1a30d626b7d7680779d7bd7e1cffb685604f3076fa2c26d364ad78b56b46d6a85999772e4ac5fb91983c99ce96537833c239669796050d318a543dab9
-
Filesize
255KB
MD532f74d6f64c870a10d9fefbae32bcf9f
SHA12b498006677f5045dd401fcce2f795e086f40a39
SHA256de6865e4f30c3f7c389c45f6a9d60fc42aa4a6d3e23b627ae9a5b7c2b5e373f8
SHA512a5bf793cd4f29970a3283a6140da0b4d0194cfac83a15ac8d053716665744eeadb28bff948e46c12cbdc2fb6f702189bc1155691c96f52c58cae5e9871eac37d
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB