Overview

overview

10

Static

static

8

c5fb0780d0...bc.exe

windows7-x64

10

c5fb0780d0...bc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    162s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 05:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe

  • Size

    255KB

  • MD5

    91cce18dd72b826d31a9bba6519aec8c

  • SHA1

    7c5915088642e7637c74a54453b32619201b8304

  • SHA256

    c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc

  • SHA512

    956f01171358d45a48f2e55d05e0ace3b9a885010a67c566045f017c5c1b2ca82904e9b5293c738b98532a11b79e98dd29ad32dd79fc18636896a67e2a027c86

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJH:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIc

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe
    "C:\Users\Admin\AppData\Local\Temp\c5fb0780d04345cf24bcb21baf3e833c9b1591d17989918d520b130e871bc0bc.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4184
    • C:\Windows\SysWOW64\apqxtuvxws.exe
      apqxtuvxws.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Windows\SysWOW64\dnmjfsjo.exe
        C:\Windows\system32\dnmjfsjo.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3096
    • C:\Windows\SysWOW64\mcnstmclepugvgx.exe
      mcnstmclepugvgx.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c aobqkblpwpkbh.exe
        3⤵
          PID:1076
      • C:\Windows\SysWOW64\dnmjfsjo.exe
        dnmjfsjo.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:396
      • C:\Windows\SysWOW64\aobqkblpwpkbh.exe
        aobqkblpwpkbh.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2140
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
        2⤵
        • Drops file in Windows directory
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1692

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Hidden Files and Directories

    2
    T1158

    Registry Run Keys / Startup Folder

    1
    T1060

    Winlogon Helper DLL

    1
    T1004

    Privilege Escalation

    Defense Evasion

    Hidden Files and Directories

    2
    T1158

    Modify Registry

    6
    T1112

    Disabling Security Tools

    2
    T1089

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    4
    T1012

    System Information Discovery

    5
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
      Filesize

      255KB

      MD5

      d88b74ea81fae7ab2eb299b272a3f3b1

      SHA1

      b9f0eb1343f4745c5a88f11a955ba05d8fe7f732

      SHA256

      665899caf9717857dfcbb2ea0acf126e27c4360403107abca10d0e2cff667943

      SHA512

      51c0081cddf41a425f6db36582b0b9a3637c0cf27d4d46efd35d8d39e1020d70f4e55b0563a7e639430225a43d5ae2c9f81cd4c0cecb4fda418328a5e2e017de

      Download Submit
    • C:\Windows\SysWOW64\aobqkblpwpkbh.exe
      Filesize

      255KB

      MD5

      8732e187878c6d412f0c844ed0a9943a

      SHA1

      64bf7722b9c1a1fcdfb64e166ac3beacd29a2943

      SHA256

      1bd2fc2d587e338761dead0aa10a211d45505bc4b80566212bf0cda8f8ea453b

      SHA512

      84f603800b503929423aa3e3ab4222f8ca8ac539dc3c623011b1bc581dc265e9d1f936e924e10a1969101769f491d6facd332d6dd4a62e569368311bb3e5d04e

      Download Submit
    • C:\Windows\SysWOW64\aobqkblpwpkbh.exe
      Filesize

      255KB

      MD5

      8732e187878c6d412f0c844ed0a9943a

      SHA1

      64bf7722b9c1a1fcdfb64e166ac3beacd29a2943

      SHA256

      1bd2fc2d587e338761dead0aa10a211d45505bc4b80566212bf0cda8f8ea453b

      SHA512

      84f603800b503929423aa3e3ab4222f8ca8ac539dc3c623011b1bc581dc265e9d1f936e924e10a1969101769f491d6facd332d6dd4a62e569368311bb3e5d04e

      Download Submit
    • C:\Windows\SysWOW64\apqxtuvxws.exe
      Filesize

      255KB

      MD5

      9961f9d7bb1f4a509b8cdbdfacff2e71

      SHA1

      c756d8f6555c39ae770744394d0e15c675d7d4e1

      SHA256

      53b117e2dd4786ac147cd832365eccd79dad9ac27d757f9dc3eba295029959b9

      SHA512

      4a9ff67249cd38e0c3b97ea04e829338c1e8c1fd08220cf19ada724ce1c830b857993085b127a2c1383a33b998dd6c11c6701e0644b5c9bd5efb67e3ebe77f93

      Download Submit
    • C:\Windows\SysWOW64\apqxtuvxws.exe
      Filesize

      255KB

      MD5

      9961f9d7bb1f4a509b8cdbdfacff2e71

      SHA1

      c756d8f6555c39ae770744394d0e15c675d7d4e1

      SHA256

      53b117e2dd4786ac147cd832365eccd79dad9ac27d757f9dc3eba295029959b9

      SHA512

      4a9ff67249cd38e0c3b97ea04e829338c1e8c1fd08220cf19ada724ce1c830b857993085b127a2c1383a33b998dd6c11c6701e0644b5c9bd5efb67e3ebe77f93

      Download Submit
    • C:\Windows\SysWOW64\dnmjfsjo.exe
      Filesize

      255KB

      MD5

      d979e91dbf3215d015b8d6c5c0d595b7

      SHA1

      d9804164bc30c78b950e4e59d8ac3317d86a56b8

      SHA256

      74a87af5ce332b4f0f1bc923b9a47e6c81211d83eb9b5424df7617eec2834c29

      SHA512

      cb1157d1f0b948da1d762ff7153c669e672e9d5304072ef399252c44d93403bfdb305ab22f311baadfee05066aaa45ec440eeb5e256e29fda7cc0f5d58883cd7

      Download Submit
    • C:\Windows\SysWOW64\dnmjfsjo.exe
      Filesize

      255KB

      MD5

      d979e91dbf3215d015b8d6c5c0d595b7

      SHA1

      d9804164bc30c78b950e4e59d8ac3317d86a56b8

      SHA256

      74a87af5ce332b4f0f1bc923b9a47e6c81211d83eb9b5424df7617eec2834c29

      SHA512

      cb1157d1f0b948da1d762ff7153c669e672e9d5304072ef399252c44d93403bfdb305ab22f311baadfee05066aaa45ec440eeb5e256e29fda7cc0f5d58883cd7

      Download Submit
    • C:\Windows\SysWOW64\dnmjfsjo.exe
      Filesize

      255KB

      MD5

      d979e91dbf3215d015b8d6c5c0d595b7

      SHA1

      d9804164bc30c78b950e4e59d8ac3317d86a56b8

      SHA256

      74a87af5ce332b4f0f1bc923b9a47e6c81211d83eb9b5424df7617eec2834c29

      SHA512

      cb1157d1f0b948da1d762ff7153c669e672e9d5304072ef399252c44d93403bfdb305ab22f311baadfee05066aaa45ec440eeb5e256e29fda7cc0f5d58883cd7

      Download Submit
    • C:\Windows\SysWOW64\mcnstmclepugvgx.exe
      Filesize

      255KB

      MD5

      de03ef8ce8b8a49343c875fdc29dbc61

      SHA1

      88740883307a165adc53ebd8bd5e85d571ff44e6

      SHA256

      8c7b1e9f544503e3df918812ae25b2e080e26a608f1ab525f4ed7a7e0fb87cb0

      SHA512

      bb918e459423b7a8dcd94b0b5602caa63ff5c9c865dd1b76fde7615b5617ee2d2257ac3e421f29a1a86b66a8e3ce25119b92a99c691cfdc9fb78559afed83bd9

      Download Submit
    • C:\Windows\SysWOW64\mcnstmclepugvgx.exe
      Filesize

      255KB

      MD5

      de03ef8ce8b8a49343c875fdc29dbc61

      SHA1

      88740883307a165adc53ebd8bd5e85d571ff44e6

      SHA256

      8c7b1e9f544503e3df918812ae25b2e080e26a608f1ab525f4ed7a7e0fb87cb0

      SHA512

      bb918e459423b7a8dcd94b0b5602caa63ff5c9c865dd1b76fde7615b5617ee2d2257ac3e421f29a1a86b66a8e3ce25119b92a99c691cfdc9fb78559afed83bd9

      Download Submit
    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit
    • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
      Filesize

      255KB

      MD5

      d88b74ea81fae7ab2eb299b272a3f3b1

      SHA1

      b9f0eb1343f4745c5a88f11a955ba05d8fe7f732

      SHA256

      665899caf9717857dfcbb2ea0acf126e27c4360403107abca10d0e2cff667943

      SHA512

      51c0081cddf41a425f6db36582b0b9a3637c0cf27d4d46efd35d8d39e1020d70f4e55b0563a7e639430225a43d5ae2c9f81cd4c0cecb4fda418328a5e2e017de

      Download Submit
    • memory/396-141-0x0000000000000000-mapping.dmp
      Download
    • memory/396-149-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/396-158-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/1076-147-0x0000000000000000-mapping.dmp
      Download
    • memory/1692-166-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1692-167-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1692-164-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1692-165-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1692-154-0x0000000000000000-mapping.dmp
      Download
    • memory/1692-163-0x00007FFDBE670000-0x00007FFDBE680000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1692-168-0x00007FFDBBF80000-0x00007FFDBBF90000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1692-169-0x00007FFDBBF80000-0x00007FFDBBF90000-memory.dmp
      Filesize

      64KB

      Download
    • memory/2068-148-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/2068-138-0x0000000000000000-mapping.dmp
      Download
    • memory/2068-157-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/2140-150-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/2140-159-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/2140-144-0x0000000000000000-mapping.dmp
      Download
    • memory/3096-162-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/3096-153-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/3096-151-0x0000000000000000-mapping.dmp
      Download
    • memory/4076-156-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4076-137-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4076-134-0x0000000000000000-mapping.dmp
      Download
    • memory/4184-155-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4184-132-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download
    • memory/4184-133-0x0000000000400000-0x00000000004A0000-memory.dmp
      Filesize

      640KB

      Download