Overview

overview

10

Static

static

8

6696746e12...80.exe

windows7-x64

10

6696746e12...80.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    192s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 22:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6696746e12bbfb3c99c8fa82cbacef621a64dd7f8575ef64a9ed2d18c7b16280.exe

  • Size

    255KB

  • MD5

    dbc4b7e63d1dd76f2a4a43a2a4523969

  • SHA1

    b9235597a54d8ddfb736fe20419eab5e30aee11c

  • SHA256

    6696746e12bbfb3c99c8fa82cbacef621a64dd7f8575ef64a9ed2d18c7b16280

  • SHA512

    6aec3d29aa34f44b8bea5616bd1e9d4a15ad61dcef4d8111a8f49421c283f0e04f83497a98174467a6fc5831c0e0d183ce09c03c9a62ca8fa2bea8860fc8029d

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJR:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIa

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6696746e12bbfb3c99c8fa82cbacef621a64dd7f8575ef64a9ed2d18c7b16280.exe
    "C:\Users\Admin\AppData\Local\Temp\6696746e12bbfb3c99c8fa82cbacef621a64dd7f8575ef64a9ed2d18c7b16280.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\SysWOW64\likipptyny.exe
      likipptyny.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Windows\SysWOW64\slzjzrmm.exe
        C:\Windows\system32\slzjzrmm.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4124
    • C:\Windows\SysWOW64\kqzxerhkafachau.exe
      kqzxerhkafachau.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4172
    • C:\Windows\SysWOW64\slzjzrmm.exe
      slzjzrmm.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1152
    • C:\Windows\SysWOW64\ofiimhyojbldo.exe
      ofiimhyojbldo.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1020
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2484

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    255KB

    MD5

    fb6439bb779bde4be7fbbef314514ee1

    SHA1

    db598163d4d24926ab79d7206312d97e1de51e42

    SHA256

    e994d143e391cd6912546cd2af978f54cd103b545cc6166130fb79027d2398a4

    SHA512

    f4f9cb9db64e69e3caaaca5b3f6f337ec6df2a82afe9aebff4a727bf879df78b89d9ccecee3cab030976bbafd309e2d13716a4119cdbb1eb086e9971ad0f5933

    Download Submit
  • C:\Users\Admin\AppData\Roaming\ReceiveEnter.doc.exe
    Filesize

    255KB

    MD5

    054755ff5d5c059e955a339cb55aad7c

    SHA1

    9efb639a79418d18d81d283da648650f2a00ef8c

    SHA256

    100b60313cbca893307ca69435cfc029a218589456c1d8200fdad665d01b2af4

    SHA512

    84f09f258c9c7e9453938e6522a99b9c9d41a8709c7d4d7c0b71c6c0c83ce65ac992f7b0636669c2ae50495c86848fa3fce562db40b21b26f004297cc5c8a824

    Download Submit
  • C:\Windows\SysWOW64\kqzxerhkafachau.exe
    Filesize

    255KB

    MD5

    db0f9c7e452fdf60a3f8ac715c8314c5

    SHA1

    46321e8341833862024ae847fda28fc1274555fa

    SHA256

    c541b3fcaca9cd682679f481857548347d174524cf2322171069dc266d74ef55

    SHA512

    4320f4956a46c6124f12d4ee64ce8b1e7604cb18ea405f106be011819eb68a644a3826de5a6c7d2ae9b5904da99bdd5a939fd538f7472323cfa5faa7b3092ff7

    Download Submit
  • C:\Windows\SysWOW64\kqzxerhkafachau.exe
    Filesize

    255KB

    MD5

    db0f9c7e452fdf60a3f8ac715c8314c5

    SHA1

    46321e8341833862024ae847fda28fc1274555fa

    SHA256

    c541b3fcaca9cd682679f481857548347d174524cf2322171069dc266d74ef55

    SHA512

    4320f4956a46c6124f12d4ee64ce8b1e7604cb18ea405f106be011819eb68a644a3826de5a6c7d2ae9b5904da99bdd5a939fd538f7472323cfa5faa7b3092ff7

    Download Submit
  • C:\Windows\SysWOW64\likipptyny.exe
    Filesize

    255KB

    MD5

    420c5b7aac9fdb13ca5dc78945fc7813

    SHA1

    1886e3cb1ba5e5318ce9e6377e1b46f165c5b4c7

    SHA256

    55597eaa98a26baf3691737bad0847e95d8a24d8d156580e0650e7a664250d20

    SHA512

    0614331b3e19b25a0d93ee6302c207a20012991239acddfc007fdcee4e145758c8889a2990212c488137cef41d5dcec765bb71aeb5d2b80227495533aa9dcf5a

    Download Submit
  • C:\Windows\SysWOW64\likipptyny.exe
    Filesize

    255KB

    MD5

    420c5b7aac9fdb13ca5dc78945fc7813

    SHA1

    1886e3cb1ba5e5318ce9e6377e1b46f165c5b4c7

    SHA256

    55597eaa98a26baf3691737bad0847e95d8a24d8d156580e0650e7a664250d20

    SHA512

    0614331b3e19b25a0d93ee6302c207a20012991239acddfc007fdcee4e145758c8889a2990212c488137cef41d5dcec765bb71aeb5d2b80227495533aa9dcf5a

    Download Submit
  • C:\Windows\SysWOW64\ofiimhyojbldo.exe
    Filesize

    255KB

    MD5

    559c5518511f9935ded85c65f79aebac

    SHA1

    2d3c4a7a7b2339a49fba3b26d413d4c9c04bc94c

    SHA256

    c1cd6910e92e66712ade4a472c8f1e776d0185f48afa6977e23ef64082f8dbaa

    SHA512

    a03f30f780a0a94c0ffed6d1c8b72791c38402dc84ed413c61050f27f09a495ddcb96e649262ecf185eae176ad386f205b16d348befb871bd73ffd6894af85cf

    Download Submit
  • C:\Windows\SysWOW64\ofiimhyojbldo.exe
    Filesize

    255KB

    MD5

    559c5518511f9935ded85c65f79aebac

    SHA1

    2d3c4a7a7b2339a49fba3b26d413d4c9c04bc94c

    SHA256

    c1cd6910e92e66712ade4a472c8f1e776d0185f48afa6977e23ef64082f8dbaa

    SHA512

    a03f30f780a0a94c0ffed6d1c8b72791c38402dc84ed413c61050f27f09a495ddcb96e649262ecf185eae176ad386f205b16d348befb871bd73ffd6894af85cf

    Download Submit
  • C:\Windows\SysWOW64\slzjzrmm.exe
    Filesize

    255KB

    MD5

    b6ab10fea4805dcc136b6f6a726323d1

    SHA1

    bcd685aaa4f4a34addfe3bbe99ed23f3f9c2b665

    SHA256

    c50687464c31ddb4f2ea78b55f5d36d8da9b084edddd3847d38c17af926c85f1

    SHA512

    224f05cbe70c1ed90fb2e733d7dd2a6fea1409d1f590448abec058f7d1412ef0cc625607fcecaec14030565e5384ec382e08c15ca0255babeceded0aae1cba81

    Download Submit
  • C:\Windows\SysWOW64\slzjzrmm.exe
    Filesize

    255KB

    MD5

    b6ab10fea4805dcc136b6f6a726323d1

    SHA1

    bcd685aaa4f4a34addfe3bbe99ed23f3f9c2b665

    SHA256

    c50687464c31ddb4f2ea78b55f5d36d8da9b084edddd3847d38c17af926c85f1

    SHA512

    224f05cbe70c1ed90fb2e733d7dd2a6fea1409d1f590448abec058f7d1412ef0cc625607fcecaec14030565e5384ec382e08c15ca0255babeceded0aae1cba81

    Download Submit
  • C:\Windows\SysWOW64\slzjzrmm.exe
    Filesize

    255KB

    MD5

    b6ab10fea4805dcc136b6f6a726323d1

    SHA1

    bcd685aaa4f4a34addfe3bbe99ed23f3f9c2b665

    SHA256

    c50687464c31ddb4f2ea78b55f5d36d8da9b084edddd3847d38c17af926c85f1

    SHA512

    224f05cbe70c1ed90fb2e733d7dd2a6fea1409d1f590448abec058f7d1412ef0cc625607fcecaec14030565e5384ec382e08c15ca0255babeceded0aae1cba81

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    255KB

    MD5

    2ce742ee26d45974ca2fda4c5d933a9f

    SHA1

    9de55c996cc96c9bae271fdc04e985436bf33f09

    SHA256

    24c9c4cccc22fd7c22a8aa2def9c7157a3fb6e42830c9bd22277e95179d74325

    SHA512

    53f1012c04dc401c9b90ba8fb25c353b8f104762aaca5dcc1d33b58306e271fab509abda24b942e1eea673baf2ec991946c594da2d17b507ff3bb12f731c9933

    Download Submit
  • memory/1020-142-0x0000000000000000-mapping.dmp
    Download
  • memory/1020-148-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1020-165-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1048-162-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1048-133-0x0000000000000000-mapping.dmp
    Download
  • memory/1048-145-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1084-152-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1084-132-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1152-147-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1152-139-0x0000000000000000-mapping.dmp
    Download
  • memory/1152-164-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/2484-161-0x00007FFBEDA70000-0x00007FFBEDA80000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-151-0x0000000000000000-mapping.dmp
    Download
  • memory/2484-158-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-159-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-160-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-156-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-174-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-173-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-172-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-157-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-171-0x00007FFBEFBD0000-0x00007FFBEFBE0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2484-167-0x00007FFBEDA70000-0x00007FFBEDA80000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4124-149-0x0000000000000000-mapping.dmp
    Download
  • memory/4124-166-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4124-153-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4172-136-0x0000000000000000-mapping.dmp
    Download
  • memory/4172-163-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4172-146-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download