Overview

overview

10

Static

static

8

6c072b6405...43.exe

windows7-x64

10

6c072b6405...43.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-11-2022 17:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6c072b6405bcc7f998627eef9fd42bf2c4a97d97245eae9dd977aeb3f8f1dd43.exe

  • Size

    255KB

  • MD5

    cb1544825f6079d6905dca0feb41ed07

  • SHA1

    25f840f9e039d2d2818fc9832bc897b465c48537

  • SHA256

    6c072b6405bcc7f998627eef9fd42bf2c4a97d97245eae9dd977aeb3f8f1dd43

  • SHA512

    2ba6cd94647ca8ae06ae5ead4429ebbd23b989def0941bd70701f09ea560ba5cbd8cd8fcaca371c455602474a091732f64526b24f4791d1f7c88bc1116164fb7

  • SSDEEP

    3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJf:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIm

Score
10/10
evasionpersistencespywarestealertrojanupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6c072b6405bcc7f998627eef9fd42bf2c4a97d97245eae9dd977aeb3f8f1dd43.exe
    "C:\Users\Admin\AppData\Local\Temp\6c072b6405bcc7f998627eef9fd42bf2c4a97d97245eae9dd977aeb3f8f1dd43.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\SysWOW64\tvgepfqncozsbhb.exe
      tvgepfqncozsbhb.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1408
    • C:\Windows\SysWOW64\lznldxfrhr.exe
      lznldxfrhr.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Windows\SysWOW64\iwkeqevb.exe
        C:\Windows\system32\iwkeqevb.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:4880
    • C:\Windows\SysWOW64\zxxqjlaalvryk.exe
      zxxqjlaalvryk.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4116
    • C:\Windows\SysWOW64\iwkeqevb.exe
      iwkeqevb.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1164
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4864

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2
T1158

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2
T1158

Modify Registry

6
T1112

Disabling Security Tools

2
T1089

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
    Filesize

    255KB

    MD5

    5da83c7a1f4cf6f2bcf6e239a55a9370

    SHA1

    cc7d8fe7ed0950a99d29d729fad8e87dad11ba43

    SHA256

    3f4ac25592278c1915b01d985317b89d11fb93f76c47068d62b61e8ea57bb95f

    SHA512

    abbb2c8b25dc8c9ce2dc3f00092d4615173f5cfe0bfb719b3971883b5556f5205362304c700d40017ed33b78139521cde93fc66381b9ff6804a2961c1db71571

    Download Submit
  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
    Filesize

    255KB

    MD5

    4e081bc654da9b7d231eab31c7841d1b

    SHA1

    9ed6cb557231e2af3612150abcbeec42b2746977

    SHA256

    8d2531d794aeb2923058a4ad8afd5fb35ec5436c6b939c3370fb04e69779409b

    SHA512

    ed1ef52eb478b3424c370b28c568b1cb724b9b2ec7f0983943104492ca1efa279078d45a817c155dab07c93e168b8d9e909bca6926d428e3f7656d5d5134a989

    Download Submit
  • C:\Users\Admin\AppData\Roaming\MergeSend.doc.exe
    Filesize

    255KB

    MD5

    917c0ad2de0d2850121850c870ddc02c

    SHA1

    6edac597ed37254dc3bd21fde4185d48a74ecc5e

    SHA256

    11862712c795f2f3f01abd76ef8e5c7c3baca7702ab445bec200d4b04aafb573

    SHA512

    2a7296e17c1b77d97f15bf7f04f664ba592812aacf99a8ac4916ccfa935db50e20653852c37a294d2e33d33d09174fe5455febad836a3e6d6a673eafb8630529

    Download Submit
  • C:\Windows\SysWOW64\iwkeqevb.exe
    Filesize

    255KB

    MD5

    b435edbfeb3d36a0000b9645524d1c4a

    SHA1

    4201c71fa4d26e5e03382afb4d242cc9a93c7a45

    SHA256

    007e5dd222e276fd0425568d921b424772be90ee7324191fdf18aa3d6fd5d461

    SHA512

    bb0934834b7675158b8fac05892c88e4deac3cc7d406207fec62d837810277199fdf9977d969bf5b1aeea057e9a783636b9e73e9aed4ade32fcda2038c98fac6

    Download Submit
  • C:\Windows\SysWOW64\iwkeqevb.exe
    Filesize

    255KB

    MD5

    b435edbfeb3d36a0000b9645524d1c4a

    SHA1

    4201c71fa4d26e5e03382afb4d242cc9a93c7a45

    SHA256

    007e5dd222e276fd0425568d921b424772be90ee7324191fdf18aa3d6fd5d461

    SHA512

    bb0934834b7675158b8fac05892c88e4deac3cc7d406207fec62d837810277199fdf9977d969bf5b1aeea057e9a783636b9e73e9aed4ade32fcda2038c98fac6

    Download Submit
  • C:\Windows\SysWOW64\iwkeqevb.exe
    Filesize

    255KB

    MD5

    b435edbfeb3d36a0000b9645524d1c4a

    SHA1

    4201c71fa4d26e5e03382afb4d242cc9a93c7a45

    SHA256

    007e5dd222e276fd0425568d921b424772be90ee7324191fdf18aa3d6fd5d461

    SHA512

    bb0934834b7675158b8fac05892c88e4deac3cc7d406207fec62d837810277199fdf9977d969bf5b1aeea057e9a783636b9e73e9aed4ade32fcda2038c98fac6

    Download Submit
  • C:\Windows\SysWOW64\lznldxfrhr.exe
    Filesize

    255KB

    MD5

    b207e4b0e8c3ea88ea4c0e457fbb1933

    SHA1

    db20547356437de5cdd4260a12661a480c11eaa4

    SHA256

    61a89b185e21e90d6c9fbc1c04f63ce4c78c4a9abeacd9894cd2bb1461bad6d4

    SHA512

    b3c991914d81556a92fec326997561b5db86f42b3fe0bbf3549030adf4b9d800a7db77eee3768f537b06ba5e6fd8fa720577984b736fcf09456b704f707f093b

    Download Submit
  • C:\Windows\SysWOW64\lznldxfrhr.exe
    Filesize

    255KB

    MD5

    b207e4b0e8c3ea88ea4c0e457fbb1933

    SHA1

    db20547356437de5cdd4260a12661a480c11eaa4

    SHA256

    61a89b185e21e90d6c9fbc1c04f63ce4c78c4a9abeacd9894cd2bb1461bad6d4

    SHA512

    b3c991914d81556a92fec326997561b5db86f42b3fe0bbf3549030adf4b9d800a7db77eee3768f537b06ba5e6fd8fa720577984b736fcf09456b704f707f093b

    Download Submit
  • C:\Windows\SysWOW64\tvgepfqncozsbhb.exe
    Filesize

    255KB

    MD5

    245d39fcb6dec48d08743abc3a63cdff

    SHA1

    a01ab39603c91812b174a54b67110d5d612b0ecf

    SHA256

    b455388678e1827b2425045a343178997c8e47560fb6e8881aebd0104fbb2cdf

    SHA512

    c4f1add38e61fe0f4818263278f866b881896e8a35fda5e211a33df3ff23a67e29de3829a4214263141f8edff98c9757d3a15bac9c44268e8e6e7da91d311345

    Download Submit
  • C:\Windows\SysWOW64\tvgepfqncozsbhb.exe
    Filesize

    255KB

    MD5

    245d39fcb6dec48d08743abc3a63cdff

    SHA1

    a01ab39603c91812b174a54b67110d5d612b0ecf

    SHA256

    b455388678e1827b2425045a343178997c8e47560fb6e8881aebd0104fbb2cdf

    SHA512

    c4f1add38e61fe0f4818263278f866b881896e8a35fda5e211a33df3ff23a67e29de3829a4214263141f8edff98c9757d3a15bac9c44268e8e6e7da91d311345

    Download Submit
  • C:\Windows\SysWOW64\zxxqjlaalvryk.exe
    Filesize

    255KB

    MD5

    d83fb7948918ce2af7e1849390539d7b

    SHA1

    82673cf20ce2f3aa7f10eff82025b993f56d210f

    SHA256

    7dc9290c44fcdd518dc2695fbc5f80a0d31edf9b9064a5a1281e34e003a9568c

    SHA512

    9573e067d925a6f3886834178bfb517e8f6b1f2d80afe9fd718249b06a793cb2ab82e669814f0182a3d6cf7cede758f3de4f414921056d6a3c079586309c28b0

    Download Submit
  • C:\Windows\SysWOW64\zxxqjlaalvryk.exe
    Filesize

    255KB

    MD5

    d83fb7948918ce2af7e1849390539d7b

    SHA1

    82673cf20ce2f3aa7f10eff82025b993f56d210f

    SHA256

    7dc9290c44fcdd518dc2695fbc5f80a0d31edf9b9064a5a1281e34e003a9568c

    SHA512

    9573e067d925a6f3886834178bfb517e8f6b1f2d80afe9fd718249b06a793cb2ab82e669814f0182a3d6cf7cede758f3de4f414921056d6a3c079586309c28b0

    Download Submit
  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit
  • \??\c:\Users\Admin\Downloads\CompleteTrace.doc.exe
    Filesize

    255KB

    MD5

    c1d1b6de53497d932c833231409639e8

    SHA1

    dde23f115bbe4803188d49fb82366678ef786619

    SHA256

    ca0e8743e7b636740976c3974c9ab43e1fe17b0e229a8b7b735c5fd9fa805aea

    SHA512

    f45138255000207fbb2d013a22f826df436539f4e5f1e7940cfb73a6a50d071d4616c973ce11c50f5bddecdb1ef0ae8443781f1310b305ce30d3c9d8a9a39727

    Download Submit
  • memory/1084-150-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1084-132-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1164-140-0x0000000000000000-mapping.dmp
    Download
  • memory/1164-166-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1164-151-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1408-141-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1408-164-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/1408-136-0x0000000000000000-mapping.dmp
    Download
  • memory/4072-139-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4072-165-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4072-133-0x0000000000000000-mapping.dmp
    Download
  • memory/4116-152-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4116-167-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4116-142-0x0000000000000000-mapping.dmp
    Download
  • memory/4864-149-0x0000000000000000-mapping.dmp
    Download
  • memory/4864-156-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-162-0x00007FFBF3960000-0x00007FFBF3970000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-155-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-154-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-157-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-158-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-161-0x00007FFBF3960000-0x00007FFBF3970000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-173-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-170-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-171-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4864-172-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4880-168-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download
  • memory/4880-147-0x0000000000000000-mapping.dmp
    Download
  • memory/4880-153-0x0000000000400000-0x00000000004A0000-memory.dmp
    Filesize

    640KB

    Download