Analysis
-
max time kernel
177s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
24-11-2022 13:06
General
-
Target
06230a9b23af1d5992b5e3b53fab006b97abaff28bfe5796c1df0c777ce51ef0.exe
-
Size
255KB
-
MD5
4b73b2f70055858cac755f272b7bd6f9
-
SHA1
a685f822209eb53ee994bb933366c483f39750c4
-
SHA256
06230a9b23af1d5992b5e3b53fab006b97abaff28bfe5796c1df0c777ce51ef0
-
SHA512
05a00222c037d8121e837b9b93fc05fc8038263ca78fb034ba7bf35ab6ebaa7a3c64d63663f4b90de18ee6d4b37d47c0642b9a98ad083d75918ba9fa6dd8a45d
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJN:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIy
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06230a9b23af1d5992b5e3b53fab006b97abaff28bfe5796c1df0c777ce51ef0.exe"C:\Users\Admin\AppData\Local\Temp\06230a9b23af1d5992b5e3b53fab006b97abaff28bfe5796c1df0c777ce51ef0.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vytwglsrop.exevytwglsrop.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\maqojibp.exeC:\Windows\system32\maqojibp.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\upxygvyxtrzthrk.exeupxygvyxtrzthrk.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\maqojibp.exemaqojibp.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\tqyzhhjzdnnzj.exetqyzhhjzdnnzj.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5a3db1c4e2fb7c00943170063f6fac697
SHA1ff4c964dfda1cae28046f65705c4750e53f0edaa
SHA256cf53337aa2fabb4a0444585cb077e059f7384de279f8406ba2d8605d6733f969
SHA5124fa438847371208a07bf15ba52181f75f9c451bc6fcd4a71921fff57170c8d5af962673fc58f238582894f22d3bb88fb4809530686029b0a826896bd48d28df9
-
Filesize
255KB
MD54bfaf89295b56334c1cbccb4bc08048f
SHA176ea997b5b131843a96aff938c5a32efa9074f88
SHA256b54a61c6b4069360103ac26e736cfc5fadbe38d4301c624c353b402edc0e2841
SHA5125832cd3f9999430eeda756c6510b32ffadf2c831ffbd6e39edac3eea95aa517a8384f198b425c1fcfec8f28aab74c86cf5ac0b5fc023f21f652e2a5a52cbfe84
-
Filesize
255KB
MD54d13ac357778c024fb0acb0864523d22
SHA1e5797c1e4365a3b2d673ad823e44d634882c3558
SHA2562ec6d41d4464035cab2012fdd6fda6dbb0e5be90f9b577278ab8d2c4e6c1b35a
SHA512f57411824935bd582117099dfb245351b09ed59f57fc5b858c1238332b217dc803c50d9d5acc85cbb2771ef70e06cc4631abfd6a2b0ddfc22039e0e2a77c648b
-
Filesize
255KB
MD527238545b3d525440dab9e6a4a38e5bf
SHA1dcd1874210c954facf6078d3af03d4ada9fce837
SHA256b0824ab4240cd498ae016c1a285e5757c18d134568c085a7a816388ad09df568
SHA5125f922ec133be9323a8b368b1a48f9dbb29303ac0dc3fd5d0ca91eb8a52002cda51209c6c39015c7bb1c497d54a2300aa4e20e519220393bad6f58481bcbb2a83
-
Filesize
255KB
MD54e66201b910d51ab1630373e043ceeff
SHA1cda97454add79b7e803d18ab5880463d4ef1a404
SHA25615c24cdaf3342e50c3b4730c5093b652542f70f5f1e30c66d429ea14b0bb26c5
SHA512a6c54450c0238bf345921c22b3eaf8f7b068dc51efb3f3f3a9805e572a015eeff74843cf80da586310b29e975ed38c8faa763ebb9b48206b9ced3a972fb9e36b
-
Filesize
255KB
MD54e66201b910d51ab1630373e043ceeff
SHA1cda97454add79b7e803d18ab5880463d4ef1a404
SHA25615c24cdaf3342e50c3b4730c5093b652542f70f5f1e30c66d429ea14b0bb26c5
SHA512a6c54450c0238bf345921c22b3eaf8f7b068dc51efb3f3f3a9805e572a015eeff74843cf80da586310b29e975ed38c8faa763ebb9b48206b9ced3a972fb9e36b
-
Filesize
255KB
MD54e66201b910d51ab1630373e043ceeff
SHA1cda97454add79b7e803d18ab5880463d4ef1a404
SHA25615c24cdaf3342e50c3b4730c5093b652542f70f5f1e30c66d429ea14b0bb26c5
SHA512a6c54450c0238bf345921c22b3eaf8f7b068dc51efb3f3f3a9805e572a015eeff74843cf80da586310b29e975ed38c8faa763ebb9b48206b9ced3a972fb9e36b
-
Filesize
255KB
MD56a40ae238e32e0e8374d76377fb9a4e3
SHA10e6a70124bd4a925bd9ef5e822b9a1ed5fcd676d
SHA256fbbfc57c4ed275cc3545a625a1860f75be0be83d037835d8fb9ae180d0e6fda2
SHA5120b721aa6dd3519da55660147aa572f2161c991578aead5870d8913ba44bd9d176d6fe707ed48f7f3a3f1867b05c24b9c5ea7f9edd24435fb85b8a783d7569ba6
-
Filesize
255KB
MD56a40ae238e32e0e8374d76377fb9a4e3
SHA10e6a70124bd4a925bd9ef5e822b9a1ed5fcd676d
SHA256fbbfc57c4ed275cc3545a625a1860f75be0be83d037835d8fb9ae180d0e6fda2
SHA5120b721aa6dd3519da55660147aa572f2161c991578aead5870d8913ba44bd9d176d6fe707ed48f7f3a3f1867b05c24b9c5ea7f9edd24435fb85b8a783d7569ba6
-
Filesize
255KB
MD5fc117fa1c30fe86e242dddb212213b62
SHA1fcc8f6963fa199b771faa585d67ec4c34adca43f
SHA256aed2624ef43488fb4192e0896d6061174a13bcbe45cc4ba03e71d4a2447bd07f
SHA5127004d546f95af2cd5e816410772e789dfda71e2779e67e7f939a94ad5e85721c5cb2d524fcf956e5c3cfa684cfdb620b651de4d247a5ecb75807e017c045d2ce
-
Filesize
255KB
MD5fc117fa1c30fe86e242dddb212213b62
SHA1fcc8f6963fa199b771faa585d67ec4c34adca43f
SHA256aed2624ef43488fb4192e0896d6061174a13bcbe45cc4ba03e71d4a2447bd07f
SHA5127004d546f95af2cd5e816410772e789dfda71e2779e67e7f939a94ad5e85721c5cb2d524fcf956e5c3cfa684cfdb620b651de4d247a5ecb75807e017c045d2ce
-
Filesize
255KB
MD5176a87c05962f9a9b4a83dc581137b38
SHA1367357d63d2a1273f602dc7095598a817645514a
SHA2564adf0d3425e3f96f2d8b328575aeda94ad4f02a93591cb4638fe5ce015cc4851
SHA512f823a8236cc7188304b1d6c368ffa4da03a9d70bcef052208f78057721da5911cd62f64c2a3f0baa3ca2816b10e2ca51161b4252196c817f55067d577b9ba130
-
Filesize
255KB
MD5176a87c05962f9a9b4a83dc581137b38
SHA1367357d63d2a1273f602dc7095598a817645514a
SHA2564adf0d3425e3f96f2d8b328575aeda94ad4f02a93591cb4638fe5ce015cc4851
SHA512f823a8236cc7188304b1d6c368ffa4da03a9d70bcef052208f78057721da5911cd62f64c2a3f0baa3ca2816b10e2ca51161b4252196c817f55067d577b9ba130
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD54d13ac357778c024fb0acb0864523d22
SHA1e5797c1e4365a3b2d673ad823e44d634882c3558
SHA2562ec6d41d4464035cab2012fdd6fda6dbb0e5be90f9b577278ab8d2c4e6c1b35a
SHA512f57411824935bd582117099dfb245351b09ed59f57fc5b858c1238332b217dc803c50d9d5acc85cbb2771ef70e06cc4631abfd6a2b0ddfc22039e0e2a77c648b
-
Filesize
255KB
MD5c0d3f80296e9488404712ef5fe2b9b94
SHA1aa2f07e50c92dce0bd8a0c209ce249331f622365
SHA25690621fbd0880ea5c2de2039f445d3cb2504798259c45c2aa6f0b6d634daf3749
SHA512243ed9e144ce63f93213e7f3f3cadd9605a73676c094885e94d686227d9161e7abea64e24110f86044fe4a24d5c52550bdbb3272ff694309b26db0ce9d2a940e
-
Filesize
255KB
MD59b1e1070d21f93ed443732a72cc9b6a8
SHA14f1d2ce8579bd404540322a2ff99bd7c25246244
SHA2566f6447e0f56cdbe04d88188bb4ccadf0b68f13261f80427040225e2975a0e1ef
SHA512e60c23ab4de4f0268c57b3b742c254550b385387050d1d3bf22f8b44aad2a8b2889001ba5f2b8aa76cf31c06a42a26a39325084220575c6191ebcc7820fa6bf6
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB