Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
24-11-2022 05:32
General
-
Target
55fe48934916056165c51c2b38b8af56fe85edb4a2d7ecc2c710e6426801e33b.exe
-
Size
255KB
-
MD5
cd257c04c8e61ce945a5e33ed36d881e
-
SHA1
8abd43b6c9f8473c37e50c52a676537195845a23
-
SHA256
55fe48934916056165c51c2b38b8af56fe85edb4a2d7ecc2c710e6426801e33b
-
SHA512
6eb0cb6e1df0d1d07141d0735fb8fdab2ce2db04cc2155b41d2f0a6db64fbf63272da16b5486bdae91140cf61c7f591a1aefa06465b71d29a3660ae27e3b0f4e
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ+:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI7
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55fe48934916056165c51c2b38b8af56fe85edb4a2d7ecc2c710e6426801e33b.exe"C:\Users\Admin\AppData\Local\Temp\55fe48934916056165c51c2b38b8af56fe85edb4a2d7ecc2c710e6426801e33b.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nehaixqmfd.exenehaixqmfd.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zssywajy.exeC:\Windows\system32\zssywajy.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\zhinbpfhrvudrgm.exezhinbpfhrvudrgm.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\zssywajy.exezssywajy.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\xcedfhqtnhmcy.exexcedfhqtnhmcy.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD54b16e32c9bd2bd7b3ae687ae6c1cb067
SHA1084560df9c2d9b2e1f5d4f1d5cacc606472dc0be
SHA256102867f0176e9d7a058d17f3adae8ec4201a74514b92f34e7064860dde097ee1
SHA5128149013bc4f630fdb04d57d2c9940d11b6d98eec6310692f3dc6d9522bee261f742a62d29ed8a49beeea987622af2c1705f851056e97988196fdd1e70b342550
-
Filesize
255KB
MD5807e8342cd8e5e6f48db7b0687d97bd3
SHA1cbdd7eb922da418bdee721f351f8e259ede1441e
SHA256ce00cdd619e980727fcdeae36cd7054eb1f7fc378a88065cdbd6a12643b71a4e
SHA512f3e67acec5ac096c6c9789340073b66d94b231572c087afbaba1648c14436dd8729d5f5fc5549a21c3228e09800f789b39fade9db52f075043060f754028745c
-
Filesize
255KB
MD5807e8342cd8e5e6f48db7b0687d97bd3
SHA1cbdd7eb922da418bdee721f351f8e259ede1441e
SHA256ce00cdd619e980727fcdeae36cd7054eb1f7fc378a88065cdbd6a12643b71a4e
SHA512f3e67acec5ac096c6c9789340073b66d94b231572c087afbaba1648c14436dd8729d5f5fc5549a21c3228e09800f789b39fade9db52f075043060f754028745c
-
Filesize
255KB
MD5ded8562432059d9fbe1ae8670363cdac
SHA1b836a6a29128c927168888720de4b68d2b5483b6
SHA256263437d6ec048026848a11c17bae7b67f0491b0e513ac9f43a656a191d03d868
SHA5123648ec0843fb9a776f8ee92b7e8d6c580af6c9675388ed2d4e62da3932d6cf4c96a8fa227e1724ac9d77cbe91d25e887e9750aff81f9d496c1a17a0fb04472c2
-
Filesize
255KB
MD5ded8562432059d9fbe1ae8670363cdac
SHA1b836a6a29128c927168888720de4b68d2b5483b6
SHA256263437d6ec048026848a11c17bae7b67f0491b0e513ac9f43a656a191d03d868
SHA5123648ec0843fb9a776f8ee92b7e8d6c580af6c9675388ed2d4e62da3932d6cf4c96a8fa227e1724ac9d77cbe91d25e887e9750aff81f9d496c1a17a0fb04472c2
-
Filesize
255KB
MD561a26d7865d988420bfb70029ee5e6f1
SHA123a9d9d19bddce0133346f934d90437e6c1861ec
SHA2568bfdfd89605e939090b8a9520b9751141c253f4d81a1c6783203742384c89257
SHA5128668a316d28eb7010c9fe689cf9b5df3fbc595d43b2f073de3607aba247eaadd4246d230fcdce946de1fb0e806e9166350ae6bad279af16551fc0ead95124b8c
-
Filesize
255KB
MD561a26d7865d988420bfb70029ee5e6f1
SHA123a9d9d19bddce0133346f934d90437e6c1861ec
SHA2568bfdfd89605e939090b8a9520b9751141c253f4d81a1c6783203742384c89257
SHA5128668a316d28eb7010c9fe689cf9b5df3fbc595d43b2f073de3607aba247eaadd4246d230fcdce946de1fb0e806e9166350ae6bad279af16551fc0ead95124b8c
-
Filesize
255KB
MD57a34a5e793bccc1690a8f758c0627d55
SHA1d9bb1b834125c457c439f677ba6a104d76c6dac6
SHA256b427f946783c047da553bc57ad017b4c7f3e49e8767ba6b8096b80314fe7e6a3
SHA5120feb45fe67f8389540533efe2bb0ca92b8041754112eb745bd4889ccd25884ff9f21f7995b202b3b46fda80ec01b966cb1a098cf3f64871121caecea57540b25
-
Filesize
255KB
MD57a34a5e793bccc1690a8f758c0627d55
SHA1d9bb1b834125c457c439f677ba6a104d76c6dac6
SHA256b427f946783c047da553bc57ad017b4c7f3e49e8767ba6b8096b80314fe7e6a3
SHA5120feb45fe67f8389540533efe2bb0ca92b8041754112eb745bd4889ccd25884ff9f21f7995b202b3b46fda80ec01b966cb1a098cf3f64871121caecea57540b25
-
Filesize
255KB
MD56fcc7afe10473d69234fc12db1be5d6d
SHA14e35badb97affbe5f810d277ac8b945f6e598995
SHA2566c5521707f7c1b62f1558df67410776751e4d7be0be2c33838fd579dcdb6f2ad
SHA512fda5d806176523a824d2047124fb297b6afae77fe8282abe6a1a04ced6f895d4a41a2052bed8aa3420e4209b9c20c2cf36006f8e67315bd3078223606161ea0c
-
Filesize
255KB
MD56fcc7afe10473d69234fc12db1be5d6d
SHA14e35badb97affbe5f810d277ac8b945f6e598995
SHA2566c5521707f7c1b62f1558df67410776751e4d7be0be2c33838fd579dcdb6f2ad
SHA512fda5d806176523a824d2047124fb297b6afae77fe8282abe6a1a04ced6f895d4a41a2052bed8aa3420e4209b9c20c2cf36006f8e67315bd3078223606161ea0c
-
Filesize
255KB
MD56fcc7afe10473d69234fc12db1be5d6d
SHA14e35badb97affbe5f810d277ac8b945f6e598995
SHA2566c5521707f7c1b62f1558df67410776751e4d7be0be2c33838fd579dcdb6f2ad
SHA512fda5d806176523a824d2047124fb297b6afae77fe8282abe6a1a04ced6f895d4a41a2052bed8aa3420e4209b9c20c2cf36006f8e67315bd3078223606161ea0c
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD594b7d3fc868246ba57599b7a161da1ca
SHA1833af6534869e70eb2ea9e9d368c56dff45daad0
SHA25622f0be1c5e5f95d1400060b9985d48453639da399fd6df887abf504cd5af165e
SHA512d07ae226ee4d947a89f781cd81c2fffe39428f8234d12699a1497fc166ef39c37cff9b11ed64767e5efe0aa3ebc06b95677936328440981ed0c9935952b4ebb8
-
Filesize
255KB
MD5a2da643b7e0b46d5795c1a039de9c2b1
SHA1b9c53a8e2515c3feca3829f952cd4e4b09830c44
SHA25612182bf0183f7ef832ee592aea4160a5c8a8104a9d85f98c321d99bf63050072
SHA512b9299535143c049d15e883d669a0befa09c08ca77f5edcfd9cc5d5b5c906dd430e60a03786d37471f09b959672e07789689754422e6c547706bcda56e044cdea
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB