Analysis
-
max time kernel
202s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 11:57
General
-
Target
b1b12061853b367d9861af573b136a0d43f71de83f7c90f2f7f8b8ea028dc54a.exe
-
Size
255KB
-
MD5
6f438af8b6dc45926ea51be69d9cceba
-
SHA1
b4c4e5e1a12a6f5aa2443850ea0079334e2ff094
-
SHA256
b1b12061853b367d9861af573b136a0d43f71de83f7c90f2f7f8b8ea028dc54a
-
SHA512
edfc91930d1364763c42c95f054181feec2f65b6b707b2961faaf513b270b287991360977d332e1bf4607676c2c02f16fe6ef1210442fa20a90aac35da23fc66
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ8:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIp
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 22 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1b12061853b367d9861af573b136a0d43f71de83f7c90f2f7f8b8ea028dc54a.exe"C:\Users\Admin\AppData\Local\Temp\b1b12061853b367d9861af573b136a0d43f71de83f7c90f2f7f8b8ea028dc54a.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\djuaimrxoj.exedjuaimrxoj.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wtusafop.exeC:\Windows\system32\wtusafop.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\pdxvwzshmkkfpwj.exepdxvwzshmkkfpwj.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\wtusafop.exewtusafop.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ikiizjcqmxyru.exeikiizjcqmxyru.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5f29a19206ebd36615c4771ddc676e1ea
SHA1a43c8832fb0d894472a62ccf3438819a9dc175d6
SHA256e31485f1903237e2372c6b8ab4c2f8ccbff125abc772829ea3f3c0197a9e73ea
SHA5120294d57a0e801f45a3b1070b40020c2d9c9865d60eb433e4080d7bf97ac07e6474f2d95c1082701208603e7356b239c98e11bda20d827c5bc96de3b4e2ff4cac
-
Filesize
255KB
MD552760a51d8f6c1a006d283b967e6d86d
SHA145aa7f462b0a29982c44989b11bf6f601e62aa7e
SHA256e18905e3dd51b6fe414a665bea4629b2fa2ec2e24e56aff86fd4cbb0ecba0c50
SHA51248218774486064a73f98b0927efc8075c287ba63296301d2421f13258c69f487d2a2435c17e396d1425353f91eddafca84834e29289668e6343bcf5e14bc1afb
-
Filesize
255KB
MD5294960750c12db303da4eb144050d4d3
SHA1402e6b77f2f6440450868836ddf6ad67065fd407
SHA25602d8a0176fe1b33c744da09910e8eb3b726aaa5030e788ea9e98b830fa3e4f63
SHA512a3f4596ba98099245c87b7f1a11f0eb1b00d2f1c8ac714f3dbe0bf8707439b1222265acc9bf59a088590e47ce3f76cb6c1fdf38f0b3fdac3b24b9bb1e225759e
-
Filesize
255KB
MD5294960750c12db303da4eb144050d4d3
SHA1402e6b77f2f6440450868836ddf6ad67065fd407
SHA25602d8a0176fe1b33c744da09910e8eb3b726aaa5030e788ea9e98b830fa3e4f63
SHA512a3f4596ba98099245c87b7f1a11f0eb1b00d2f1c8ac714f3dbe0bf8707439b1222265acc9bf59a088590e47ce3f76cb6c1fdf38f0b3fdac3b24b9bb1e225759e
-
Filesize
255KB
MD5baa35c4015503d5353055d50b21a9873
SHA180ce42996e52391587b3010a25e023aa75c80f41
SHA256e4aa4625ffa2e7c9a08a1d8b65c4c1595d9e135bd13f6aafca77a28d892ab176
SHA512f710648de9171c1353f36b98add838e1479c8ab2eb6739dad4bca45bca061da026650c84e5adbefc16d16c11280557c4d33c8f9db115db95d6de0cff197f1740
-
Filesize
255KB
MD5baa35c4015503d5353055d50b21a9873
SHA180ce42996e52391587b3010a25e023aa75c80f41
SHA256e4aa4625ffa2e7c9a08a1d8b65c4c1595d9e135bd13f6aafca77a28d892ab176
SHA512f710648de9171c1353f36b98add838e1479c8ab2eb6739dad4bca45bca061da026650c84e5adbefc16d16c11280557c4d33c8f9db115db95d6de0cff197f1740
-
Filesize
255KB
MD5bfec4f66aa2f31625844a86f96ca03d7
SHA1b6bb70d1e625ab78e448b241f39507fe5d8c063c
SHA256744391cea08d3067e78eb3786ff5e193885e6ef1972f8f24e78e3989a5bdb8ac
SHA512306c059c06f1aae10b365940deff18c219ed69d30c7187b5f28409ddad13c525ca4f9302c2199bccdb0ea1e7ff0d4ce7c2394df032e6ab440bf6b20b92799731
-
Filesize
255KB
MD5bfec4f66aa2f31625844a86f96ca03d7
SHA1b6bb70d1e625ab78e448b241f39507fe5d8c063c
SHA256744391cea08d3067e78eb3786ff5e193885e6ef1972f8f24e78e3989a5bdb8ac
SHA512306c059c06f1aae10b365940deff18c219ed69d30c7187b5f28409ddad13c525ca4f9302c2199bccdb0ea1e7ff0d4ce7c2394df032e6ab440bf6b20b92799731
-
Filesize
255KB
MD5f11453ce5e8c777a376d471886ee010e
SHA1a7ecdbcef484929690dff021702837cdde69de1d
SHA2565c5eaf9f7258475c9523885a987369fdde1d17faa91b829c10941243a088ada1
SHA512f75e31f77cc21f12082a69e236e49cce9f61fb6127e34ecbc38c8477831731afc0650c6bd8abada8a9c75463dc55366ae9ff90d3ac906ade705b39295f58b62b
-
Filesize
255KB
MD5f11453ce5e8c777a376d471886ee010e
SHA1a7ecdbcef484929690dff021702837cdde69de1d
SHA2565c5eaf9f7258475c9523885a987369fdde1d17faa91b829c10941243a088ada1
SHA512f75e31f77cc21f12082a69e236e49cce9f61fb6127e34ecbc38c8477831731afc0650c6bd8abada8a9c75463dc55366ae9ff90d3ac906ade705b39295f58b62b
-
Filesize
255KB
MD5f11453ce5e8c777a376d471886ee010e
SHA1a7ecdbcef484929690dff021702837cdde69de1d
SHA2565c5eaf9f7258475c9523885a987369fdde1d17faa91b829c10941243a088ada1
SHA512f75e31f77cc21f12082a69e236e49cce9f61fb6127e34ecbc38c8477831731afc0650c6bd8abada8a9c75463dc55366ae9ff90d3ac906ade705b39295f58b62b
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-