Analysis
-
max time kernel
193s -
max time network
253s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 05:16
General
-
Target
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe
-
Size
255KB
-
MD5
cebc22f552c64fe39370be9ce5c100be
-
SHA1
12a65f6fb09bbcc5782f12c7974b09350438cc25
-
SHA256
4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f
-
SHA512
f60f0a1bc2188658a82ce4af01a638af940305d39a961ad346cbc3ed7977db6e2ce4b4185784a43c2c17fcf623d98b060a6653a8cab0f58408556b5b17f02673
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJm:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIl
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe"C:\Users\Admin\AppData\Local\Temp\4e88571ea7b27479b7380546145375462b9839b7c1d595697be06ec04ee9d13f.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ffygfmtqkp.exeffygfmtqkp.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gpkhhwtn.exeC:\Windows\system32\gpkhhwtn.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ijzmngradfwtbdb.exeijzmngradfwtbdb.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c zzphngkfdgrsj.exe3⤵
-
C:\Windows\SysWOW64\gpkhhwtn.exegpkhhwtn.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\zzphngkfdgrsj.exezzphngkfdgrsj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5a37ab36c704e894392578584a08c77ed
SHA1b254db66e1e2e4085a5e041fdc524b8a5be8089c
SHA25691d196807246a25bbcfa3349f7d5172c0a5da8a8eaf600bf8d38831af5a1b4ce
SHA5123adcf9025eea2163c32b4601de3235ce825abbe8c40f24a0fe9efde3e486fc6fab5f5a7f86a3b3e63ff86c94fec4cf2fafc7ecbbbdde113dc3b9c352a4d11926
-
Filesize
255KB
MD5afb0242dd3556be6c3ec7b7ac5da9478
SHA15e46e812b0dca87f7e5dc3e8bd9d82c94633c7aa
SHA256581de1c54dfaaf03c07a66900b08826f7b6f319fbad5167fadbd7557feb3fe9c
SHA51288567c7ce6c375835d584949cd5aa705ac1215ec333707ba762527ce4590af55e0a558b5a19d5ff941f695faf635e36fa704fb4b4173a55ef2f857909c4c18ea
-
Filesize
255KB
MD58fff626e68ba425674e4145f0efc113b
SHA16548ad2c2fbc9b3e7e95e32cc3101c3181fd9387
SHA256530946d7812834fa4203477d94927b0b8b95c7e6c4816dfb78a485ef570dad61
SHA512c9a1c28f39dafd7eafb5169cd32a7e5da7361831ef4a086c89b35922523e4597e3d4497ff8b702e85d27aa0815c4371e4f9e8bf760bf94f6bc4efab80cb4284f
-
Filesize
255KB
MD58fff626e68ba425674e4145f0efc113b
SHA16548ad2c2fbc9b3e7e95e32cc3101c3181fd9387
SHA256530946d7812834fa4203477d94927b0b8b95c7e6c4816dfb78a485ef570dad61
SHA512c9a1c28f39dafd7eafb5169cd32a7e5da7361831ef4a086c89b35922523e4597e3d4497ff8b702e85d27aa0815c4371e4f9e8bf760bf94f6bc4efab80cb4284f
-
Filesize
255KB
MD55dde7124f86bbb59cc510b086d5f58ac
SHA1f6ea5695523aae9e8e20dff596a93c80bef0bb68
SHA256a412442f5967789db90ba118786b77995535dde8e495cdc1f81271118133dd6e
SHA5129a87154a239a796923015643626ffcd9fbaa892c9287428b45099a63e31167f8570a35974f10699093b4d1b512e9fae1bef31fca61e55d567344f52a7ba1c7c1
-
Filesize
255KB
MD55dde7124f86bbb59cc510b086d5f58ac
SHA1f6ea5695523aae9e8e20dff596a93c80bef0bb68
SHA256a412442f5967789db90ba118786b77995535dde8e495cdc1f81271118133dd6e
SHA5129a87154a239a796923015643626ffcd9fbaa892c9287428b45099a63e31167f8570a35974f10699093b4d1b512e9fae1bef31fca61e55d567344f52a7ba1c7c1
-
Filesize
255KB
MD55dde7124f86bbb59cc510b086d5f58ac
SHA1f6ea5695523aae9e8e20dff596a93c80bef0bb68
SHA256a412442f5967789db90ba118786b77995535dde8e495cdc1f81271118133dd6e
SHA5129a87154a239a796923015643626ffcd9fbaa892c9287428b45099a63e31167f8570a35974f10699093b4d1b512e9fae1bef31fca61e55d567344f52a7ba1c7c1
-
Filesize
255KB
MD56c225a91408c2c03bb141b0a14d66599
SHA1e5dac4c5faaa388dc2fa17849ffe8573690cf05a
SHA2560325ae4baded9e3415c43bc7c743e2df6a1ae35a0cbb06b43adb501377fdead1
SHA51214308982d1ff63a8afaf2dd841c848e733dfc775c40d5a6dc7c8344c67ec0f7c82c0ca52ad9c174fe3b5a2c9666c2b4252742dc62a3eaf280da6ab1bd1e7a849
-
Filesize
255KB
MD56c225a91408c2c03bb141b0a14d66599
SHA1e5dac4c5faaa388dc2fa17849ffe8573690cf05a
SHA2560325ae4baded9e3415c43bc7c743e2df6a1ae35a0cbb06b43adb501377fdead1
SHA51214308982d1ff63a8afaf2dd841c848e733dfc775c40d5a6dc7c8344c67ec0f7c82c0ca52ad9c174fe3b5a2c9666c2b4252742dc62a3eaf280da6ab1bd1e7a849
-
Filesize
255KB
MD5efc92849ac9fcd1eec6d30d337cbb96d
SHA11fdbb3cf03a081339c29e907f0597e180aea20b7
SHA25600cb1a2cf81adb01e6adb2c33e46f59244b9d2f03cf0d544fff68fb094fdfa9f
SHA512713f4a04cf44153597aa8db3d69d202412bf48680e00b53cf291360e0a4fc2ee1d265eb3c89a012e40b45973304ca6fb4a2cb07ac3b2eb4e357f14efc8fdbfd0
-
Filesize
255KB
MD5efc92849ac9fcd1eec6d30d337cbb96d
SHA11fdbb3cf03a081339c29e907f0597e180aea20b7
SHA25600cb1a2cf81adb01e6adb2c33e46f59244b9d2f03cf0d544fff68fb094fdfa9f
SHA512713f4a04cf44153597aa8db3d69d202412bf48680e00b53cf291360e0a4fc2ee1d265eb3c89a012e40b45973304ca6fb4a2cb07ac3b2eb4e357f14efc8fdbfd0
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-