Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
26-11-2022 23:05
General
-
Target
d75b0206d07968cd625e3b036acd8d6005fa03ae52da634cb3f136d3966444e7.exe
-
Size
255KB
-
MD5
7f403b4816ec91f88abf2de514aca49d
-
SHA1
de1c5d153add188afeeee51e7d6456189355038e
-
SHA256
d75b0206d07968cd625e3b036acd8d6005fa03ae52da634cb3f136d3966444e7
-
SHA512
77dcb2fe88ff6249098ab747fc478e738e73344286f4c4e16ebd5e7e1e9ec0c72b7713f2fc493c6b665e70e2f55300d86355f6c0e558b678ef556bcb8d1e6d95
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJM:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI9
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d75b0206d07968cd625e3b036acd8d6005fa03ae52da634cb3f136d3966444e7.exe"C:\Users\Admin\AppData\Local\Temp\d75b0206d07968cd625e3b036acd8d6005fa03ae52da634cb3f136d3966444e7.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\gmsuldyilb.exegmsuldyilb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\grxxfzgi.exeC:\Windows\system32\grxxfzgi.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\wugyjhqnzdipbgr.exewugyjhqnzdipbgr.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\gpielkvdctxnd.exegpielkvdctxnd.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\grxxfzgi.exegrxxfzgi.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5f0213631afbf5a6c7e9464c512cfafec
SHA1dc11dc86bff8dfd046e62df70f04479248d5978e
SHA2569ca14794340827b07e74af78fddb4df712e446583f59b23d3f3e970623b7248e
SHA5128f219912af1928722df8928adc5b880c927fd2c4a4e34975c54b11f0913896a2f06c1d775ec155e44f6d080be55225cfa2180b3b4042c82b30b24145555c183d
-
Filesize
255KB
MD5f0213631afbf5a6c7e9464c512cfafec
SHA1dc11dc86bff8dfd046e62df70f04479248d5978e
SHA2569ca14794340827b07e74af78fddb4df712e446583f59b23d3f3e970623b7248e
SHA5128f219912af1928722df8928adc5b880c927fd2c4a4e34975c54b11f0913896a2f06c1d775ec155e44f6d080be55225cfa2180b3b4042c82b30b24145555c183d
-
Filesize
255KB
MD5c9a39d2b07852e6a2127967c04f79ba7
SHA1e2374835f18454fa49138d4fab3e6f068d202fb3
SHA2562ff3397ccf095d6af563c67d03669d5df8d36cb5a0a408bcb40d2df89ca9d322
SHA5122c93d8a24fe678c7a1d247efb2da8756ff9521fd4c1ca879d911d4668b6cc1af7898651e76e72a2d5e8acb0ee25d9fc03dc648bbfdfaa4275fa3053325cc9a67
-
Filesize
255KB
MD558855fe672743b1a7c8d51f175af5476
SHA1b7693a96d220c47c157d3eed97aaddc5896a8642
SHA256f10a09ebc1d337b7af91e473207a9ff6dfe2645dc93142913e1bcc03de9c9039
SHA512007dcf37c8e6e6bbe56deca12af2e5833b197a536e61b5def6a0def8f445f83f7bd30b8b723454b9c065ba9822f48050c2fb04b0c16f29953985fb4e6460d98b
-
Filesize
255KB
MD558855fe672743b1a7c8d51f175af5476
SHA1b7693a96d220c47c157d3eed97aaddc5896a8642
SHA256f10a09ebc1d337b7af91e473207a9ff6dfe2645dc93142913e1bcc03de9c9039
SHA512007dcf37c8e6e6bbe56deca12af2e5833b197a536e61b5def6a0def8f445f83f7bd30b8b723454b9c065ba9822f48050c2fb04b0c16f29953985fb4e6460d98b
-
Filesize
255KB
MD57ad38ee2518be63586c7751c22e5afb1
SHA1d47517aef0939ace3421a218833a783e1139a1fc
SHA256952c9fc50a1f6e834e9bee7374bd4ec041b0f85bab53e7909a579e3832feb518
SHA51290bb3f90dce10c9439a0d88e25607b9892133d58aac60722783e7ecebd5054e083797ebf0e7bdcf64f40412c8c2c1c2f2ff556299499632a229d6a4c3cf459fb
-
Filesize
255KB
MD57ad38ee2518be63586c7751c22e5afb1
SHA1d47517aef0939ace3421a218833a783e1139a1fc
SHA256952c9fc50a1f6e834e9bee7374bd4ec041b0f85bab53e7909a579e3832feb518
SHA51290bb3f90dce10c9439a0d88e25607b9892133d58aac60722783e7ecebd5054e083797ebf0e7bdcf64f40412c8c2c1c2f2ff556299499632a229d6a4c3cf459fb
-
Filesize
255KB
MD59f6a8f87aea34639ab59d1cf34f186b9
SHA1b1c518eb6adc865175acee17a5ba6c4f6442a85f
SHA2568d16fc0c7125bf0315b0b72647e5f33e11b7da620be0fab9a1345e3ed7ed130a
SHA512418edf9545fa0fb18f196119510117da42a055255f38309be01e5ab8e763b99270b714458bded4d6bd702185fe18cc76780b5de1374e7f8dcde297318e423edf
-
Filesize
255KB
MD59f6a8f87aea34639ab59d1cf34f186b9
SHA1b1c518eb6adc865175acee17a5ba6c4f6442a85f
SHA2568d16fc0c7125bf0315b0b72647e5f33e11b7da620be0fab9a1345e3ed7ed130a
SHA512418edf9545fa0fb18f196119510117da42a055255f38309be01e5ab8e763b99270b714458bded4d6bd702185fe18cc76780b5de1374e7f8dcde297318e423edf
-
Filesize
255KB
MD59f6a8f87aea34639ab59d1cf34f186b9
SHA1b1c518eb6adc865175acee17a5ba6c4f6442a85f
SHA2568d16fc0c7125bf0315b0b72647e5f33e11b7da620be0fab9a1345e3ed7ed130a
SHA512418edf9545fa0fb18f196119510117da42a055255f38309be01e5ab8e763b99270b714458bded4d6bd702185fe18cc76780b5de1374e7f8dcde297318e423edf
-
Filesize
255KB
MD5eb13095bd02cc99a6f6f0594a482dd10
SHA1eb8671714a48b5b94ea0782c49f701787b469620
SHA25610dfd81730e4408c79fc37d99b58bac96d211ae4b280273e478e600183f1582f
SHA51293f75cb87cbbd1f679b392c23dd15fd3e05d8898e3f44e3d68c6bd6671a858459a552e3406903522acf6d6194dc2e13fa4795139db2706ca4f516ea07f06f015
-
Filesize
255KB
MD5eb13095bd02cc99a6f6f0594a482dd10
SHA1eb8671714a48b5b94ea0782c49f701787b469620
SHA25610dfd81730e4408c79fc37d99b58bac96d211ae4b280273e478e600183f1582f
SHA51293f75cb87cbbd1f679b392c23dd15fd3e05d8898e3f44e3d68c6bd6671a858459a552e3406903522acf6d6194dc2e13fa4795139db2706ca4f516ea07f06f015
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5c9a39d2b07852e6a2127967c04f79ba7
SHA1e2374835f18454fa49138d4fab3e6f068d202fb3
SHA2562ff3397ccf095d6af563c67d03669d5df8d36cb5a0a408bcb40d2df89ca9d322
SHA5122c93d8a24fe678c7a1d247efb2da8756ff9521fd4c1ca879d911d4668b6cc1af7898651e76e72a2d5e8acb0ee25d9fc03dc648bbfdfaa4275fa3053325cc9a67
-
Filesize
255KB
MD5461b2f4f69daf3221c6f896d2a6261ac
SHA18aeb522aadc6f73c3a20c406c0a08bda9482da6c
SHA2561ba3ae10db7e75795d19edb8380fd5105b553b393ea448043dadede22b5209a8
SHA51241e645bd22efdef25e224f848a7fdd4a030223c3000acaf913bf6c67f8a66c5043926191d30fe0662f73ec537149583fe2a90ae93f23616055373cff62006e5a
-
Filesize
255KB
MD52d5a374dec864ece4db7fa0f0410f264
SHA180edf885660b97a156f953890e0b0701d3376295
SHA2560a5e1db68a1ea99bc8ba4c36cc80cffde622d275a2736b5aca6b10e8caae8782
SHA512518a5aea7dd54fe44759f33e6359561ee153489312b6e7e406b66ad47d34db176ca5ca774e51ffe121e669964ae952b60e346f71cee4784e5601fefe41a10c46
-
Filesize
255KB
MD52d5a374dec864ece4db7fa0f0410f264
SHA180edf885660b97a156f953890e0b0701d3376295
SHA2560a5e1db68a1ea99bc8ba4c36cc80cffde622d275a2736b5aca6b10e8caae8782
SHA512518a5aea7dd54fe44759f33e6359561ee153489312b6e7e406b66ad47d34db176ca5ca774e51ffe121e669964ae952b60e346f71cee4784e5601fefe41a10c46
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB