Analysis
-
max time kernel
174s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
24-11-2022 12:16
General
-
Target
d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe
-
Size
255KB
-
MD5
91508f21b1ba973fe183e1244754aeb5
-
SHA1
6941b0b0681a97d59b4cd93d62a8ebe0da8ada8d
-
SHA256
d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1
-
SHA512
26982abf999b485387c76ff5b36cf54ad6b1045bd9b4f79e8970976bef613fe1e00fbe8f9d305953d6ef4341f74a6306980efe76a4955b6abe9add09f7857030
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJp:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI+
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe"C:\Users\Admin\AppData\Local\Temp\d7fd3919c0dd467f3381d9a5760b02de6e95e328a814fb8aea53b7bcf2a2d4e1.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ynkaofwqia.exeynkaofwqia.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ltoalelr.exeC:\Windows\system32\ltoalelr.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\pqdizwnjnkgevwa.exepqdizwnjnkgevwa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ltoalelr.exeltoalelr.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\fowbgangxyysc.exefowbgangxyysc.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD53e06159c2a623f90998edc6a10662839
SHA1e0ce4c2fe674534ec720627e98bc2823d4b04b23
SHA256377ef64728822bb15feb7a6f4943bb3b41591ab3ddb4d23081c585dbfcdc30d2
SHA51202aae3138273a99648839876ebe841f42722976fdf83f083127d5b7e3dcdcffb98e023e64b270a4fe2883cb8742f55f28dc734e2873b0859d3742a3efe7b8b14
-
Filesize
255KB
MD54310752d2916ca52ffca7a2828c25b3f
SHA1968332730508d1aba0c1c721254281cc9b66de6d
SHA256b9371fe44a33aa158b476d79e4f03908d93b6898b016bc80100798390ee7f96d
SHA512a144ee5d98c90b43dcae0a0f7f031a8dbe733e9443e7a4d4c8b44d3a4a80e470ae6e0d0b3b9dc7b283d10d89854cecfdf5dc8a0985b423b3b8e1e55e77676d3f
-
Filesize
255KB
MD5dbe9234c7986c529976364dd8edcd3f5
SHA1ebec18b88976a38f96b64c822efca2428bac7fc0
SHA2568867ad9f62a67533159ab32c151d6fcd7aa28c0bcbd49b82cd682ffe095b7a93
SHA512ae5b210c74803ef9a478db3befd9f0503fb56fc2e8956a9d2c828128b8ea8e4dd217ceb65c901f083ac4c6e0b3aefca2314ec5357e22c2651e25ec8bbde7be21
-
Filesize
255KB
MD5dbe9234c7986c529976364dd8edcd3f5
SHA1ebec18b88976a38f96b64c822efca2428bac7fc0
SHA2568867ad9f62a67533159ab32c151d6fcd7aa28c0bcbd49b82cd682ffe095b7a93
SHA512ae5b210c74803ef9a478db3befd9f0503fb56fc2e8956a9d2c828128b8ea8e4dd217ceb65c901f083ac4c6e0b3aefca2314ec5357e22c2651e25ec8bbde7be21
-
Filesize
255KB
MD5e97d53ba154504b2b3048381b9d705bd
SHA1c78ba5c7289649919bfa319bfb0b7702be9966d8
SHA256a1738c72d57c2e9c50ea71460d42d621bb90005a235eb65878cc9730f6d22cff
SHA5124a46d259c48bc779333918b1bfdbc483ef821ecd1c7af685fbe3d61568ea073d76a072afc82d77d1506deb2ce0741780256633d032b1f92c49c8f18b752d77a0
-
Filesize
255KB
MD5e97d53ba154504b2b3048381b9d705bd
SHA1c78ba5c7289649919bfa319bfb0b7702be9966d8
SHA256a1738c72d57c2e9c50ea71460d42d621bb90005a235eb65878cc9730f6d22cff
SHA5124a46d259c48bc779333918b1bfdbc483ef821ecd1c7af685fbe3d61568ea073d76a072afc82d77d1506deb2ce0741780256633d032b1f92c49c8f18b752d77a0
-
Filesize
255KB
MD5e97d53ba154504b2b3048381b9d705bd
SHA1c78ba5c7289649919bfa319bfb0b7702be9966d8
SHA256a1738c72d57c2e9c50ea71460d42d621bb90005a235eb65878cc9730f6d22cff
SHA5124a46d259c48bc779333918b1bfdbc483ef821ecd1c7af685fbe3d61568ea073d76a072afc82d77d1506deb2ce0741780256633d032b1f92c49c8f18b752d77a0
-
Filesize
255KB
MD573a6e426ba08a626ef71f2b64f6f0421
SHA1c56b3a7b4d02b3f5dcdc6bea5ae973510686cbe9
SHA2567fa908dd7bc20b32e0a4677ae7e5a0ff96d6e70481da36f5c643facaeb230ebd
SHA512784c34c2a2aba8e1d26089612d35053a771374df93c07525dce31d5e0734b8be408305d22159d932d3e0aa7516d29beb9063e2f900cb3bcb622ae07b0bac8fd3
-
Filesize
255KB
MD573a6e426ba08a626ef71f2b64f6f0421
SHA1c56b3a7b4d02b3f5dcdc6bea5ae973510686cbe9
SHA2567fa908dd7bc20b32e0a4677ae7e5a0ff96d6e70481da36f5c643facaeb230ebd
SHA512784c34c2a2aba8e1d26089612d35053a771374df93c07525dce31d5e0734b8be408305d22159d932d3e0aa7516d29beb9063e2f900cb3bcb622ae07b0bac8fd3
-
Filesize
255KB
MD5c4dbc4001d80752ebe72b291deffc9c2
SHA1eddfaeea884b8c2c1b19155cf5fadea78239ced7
SHA2567d8c5169bb96a2a69123c5e8b2aa566ca0c02a97348dc98f9e36abd8c3580ded
SHA51228cce9944d133faf5b2e8c3fb156cd40993cd594f0b1001b1de05a6111dc3cf1d1d8a25509018aeffa9376c2ef5a34b1c6c30cc656a4c7ee11eaedadb7555fd5
-
Filesize
255KB
MD5c4dbc4001d80752ebe72b291deffc9c2
SHA1eddfaeea884b8c2c1b19155cf5fadea78239ced7
SHA2567d8c5169bb96a2a69123c5e8b2aa566ca0c02a97348dc98f9e36abd8c3580ded
SHA51228cce9944d133faf5b2e8c3fb156cd40993cd594f0b1001b1de05a6111dc3cf1d1d8a25509018aeffa9376c2ef5a34b1c6c30cc656a4c7ee11eaedadb7555fd5
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD54310752d2916ca52ffca7a2828c25b3f
SHA1968332730508d1aba0c1c721254281cc9b66de6d
SHA256b9371fe44a33aa158b476d79e4f03908d93b6898b016bc80100798390ee7f96d
SHA512a144ee5d98c90b43dcae0a0f7f031a8dbe733e9443e7a4d4c8b44d3a4a80e470ae6e0d0b3b9dc7b283d10d89854cecfdf5dc8a0985b423b3b8e1e55e77676d3f
-
Filesize
255KB
MD59f350c9b7ebc3a0eab7963e9cb65f1d5
SHA1c84bc1ac8b81525533a0a1a34c94f9061541ce70
SHA25632b6937d03e5893539b3d839a596c6cbfec011df19421b30fddf7b8f133a3dce
SHA5122204340fbb832e9da97f394d1afd2c5003c5a79749b2fffc126b9c843f46bb9bdb88e8f90ade8efd60ebb6b49b5e629fc2ce54822f0df143765aef5d2cf71e09
-
Filesize
255KB
MD53e7e79ce5e9915760f0708f1cddab6c6
SHA11e00e2ed7aa90c671b205795a735722a2f9cadf7
SHA2560086be2e5056e3495c2f7767af6ca90758c3901ce393df38c0dba3857a67c3e8
SHA512e5421305d0008548117ea9455189808f5194d560918e1f79c603dfc7d2e5f2caec7f795e8384a0b11270e2061e76929b0b196a43d79fc9bee692f18b377c8d9a
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB