Analysis
-
max time kernel
151s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 05:06
General
-
Target
44fd27540b2416a14d527ca1b2c6c95c7bf511feaae7901d59cfd9402188e064.exe
-
Size
255KB
-
MD5
056e799d30c5361c5391990a4497a468
-
SHA1
9714f11169f35799dc1f606163622d59b650ce7f
-
SHA256
44fd27540b2416a14d527ca1b2c6c95c7bf511feaae7901d59cfd9402188e064
-
SHA512
4856779c6f67839710fbd223515dee821e8100db84278e41a374e7591faed5137e3e40d895877796a3c5cb8c14e2c538873429378115483f5ab1e43c603affd6
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ8:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44fd27540b2416a14d527ca1b2c6c95c7bf511feaae7901d59cfd9402188e064.exe"C:\Users\Admin\AppData\Local\Temp\44fd27540b2416a14d527ca1b2c6c95c7bf511feaae7901d59cfd9402188e064.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\fvllhsdkst.exefvllhsdkst.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iprmchfd.exeC:\Windows\system32\iprmchfd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\lohkarvvzdzqkwp.exelohkarvvzdzqkwp.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c abjnzwcypacbn.exe3⤵
-
C:\Windows\SysWOW64\iprmchfd.exeiprmchfd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\abjnzwcypacbn.exeabjnzwcypacbn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5636b8a7564d38bc1e76a47876915aa86
SHA1617d987307df96e9201e46fa1f049433bab70fb7
SHA256d0ed638a199aa30b1091961eb46960e989f2c59afe4000c5fc25101f3350c2af
SHA5123db3e300fbdb75c6b528a4dadfb5fd3038d1cd7cb99f8ceb57286acd47389a91058f44ab17cd24136e39f09bd94d5eb728789b95442ac5294ffe1a1340ea565e
-
Filesize
255KB
MD5f6630f4916326e22e873b1d1992c338e
SHA14962484c46721a265ef79eb70a1d51cdbfb17dbd
SHA256ee7f4243615792768040c348c40a5233ead8906991449cf5cf3741acbf4eb422
SHA512a38748357f3d88d02e2b82da2fce45f07bf2d47eaa046fa3210a65b25e1f2a809c9abac69e832d64fe1ba3a262a7d6aca4226c72b43d29bdd6d21f36be3552e6
-
Filesize
255KB
MD56dab17b27e04d916f013166bd2e83406
SHA18f7a0c1a1c022e0fac28cdc052cb594626e423db
SHA256deaff0d39fe868e8de0bbc1122b7aa3812de928e58210baaab4331c98acabb16
SHA51225b8873b4f5de648e9a6fc15bd0a1946a91b654c6e4f0b6187dae7ed42ba248d51adfceab4e250391e0fbb94762eecba751df704525e0982f246069b687feabb
-
Filesize
255KB
MD56dab17b27e04d916f013166bd2e83406
SHA18f7a0c1a1c022e0fac28cdc052cb594626e423db
SHA256deaff0d39fe868e8de0bbc1122b7aa3812de928e58210baaab4331c98acabb16
SHA51225b8873b4f5de648e9a6fc15bd0a1946a91b654c6e4f0b6187dae7ed42ba248d51adfceab4e250391e0fbb94762eecba751df704525e0982f246069b687feabb
-
Filesize
255KB
MD5f6630f4916326e22e873b1d1992c338e
SHA14962484c46721a265ef79eb70a1d51cdbfb17dbd
SHA256ee7f4243615792768040c348c40a5233ead8906991449cf5cf3741acbf4eb422
SHA512a38748357f3d88d02e2b82da2fce45f07bf2d47eaa046fa3210a65b25e1f2a809c9abac69e832d64fe1ba3a262a7d6aca4226c72b43d29bdd6d21f36be3552e6
-
Filesize
255KB
MD5f6630f4916326e22e873b1d1992c338e
SHA14962484c46721a265ef79eb70a1d51cdbfb17dbd
SHA256ee7f4243615792768040c348c40a5233ead8906991449cf5cf3741acbf4eb422
SHA512a38748357f3d88d02e2b82da2fce45f07bf2d47eaa046fa3210a65b25e1f2a809c9abac69e832d64fe1ba3a262a7d6aca4226c72b43d29bdd6d21f36be3552e6
-
Filesize
255KB
MD5f75ec6877dc680c63c90f97d6f42e793
SHA1e75a8ca60913a6e2c03f3cf7e4958d8bd954d6d2
SHA256612851303a881f52ad0934316b508147b5728e13c062055a58aee99cbaecd6dc
SHA5128fcb6b9eb890a9c4cdae4134ad79f368e1aa31908bd3ec2bec94532c067345b49a54775682ba3fc01a9655793cdafe7870e25bdbe1fba2a2143a8c745b6abed5
-
Filesize
255KB
MD5f75ec6877dc680c63c90f97d6f42e793
SHA1e75a8ca60913a6e2c03f3cf7e4958d8bd954d6d2
SHA256612851303a881f52ad0934316b508147b5728e13c062055a58aee99cbaecd6dc
SHA5128fcb6b9eb890a9c4cdae4134ad79f368e1aa31908bd3ec2bec94532c067345b49a54775682ba3fc01a9655793cdafe7870e25bdbe1fba2a2143a8c745b6abed5
-
Filesize
255KB
MD5f75ec6877dc680c63c90f97d6f42e793
SHA1e75a8ca60913a6e2c03f3cf7e4958d8bd954d6d2
SHA256612851303a881f52ad0934316b508147b5728e13c062055a58aee99cbaecd6dc
SHA5128fcb6b9eb890a9c4cdae4134ad79f368e1aa31908bd3ec2bec94532c067345b49a54775682ba3fc01a9655793cdafe7870e25bdbe1fba2a2143a8c745b6abed5
-
Filesize
255KB
MD50de180eb623184d3496160031ff2ff14
SHA146b4810be60dcd6c33b969bb90df24f88b47c1db
SHA256040e670034097aae0603221df97f82838ab7426ff44e1830c0fff606eabc71f8
SHA5125bd0b4a9c6c90c71ee98ef6e4d3c1a579c06aa86209213f66208e2f3c1ea275031515abb8b835188936d8b657e5c4c430b6258109b824de5febdebd7d018b06b
-
Filesize
255KB
MD50de180eb623184d3496160031ff2ff14
SHA146b4810be60dcd6c33b969bb90df24f88b47c1db
SHA256040e670034097aae0603221df97f82838ab7426ff44e1830c0fff606eabc71f8
SHA5125bd0b4a9c6c90c71ee98ef6e4d3c1a579c06aa86209213f66208e2f3c1ea275031515abb8b835188936d8b657e5c4c430b6258109b824de5febdebd7d018b06b
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB