Analysis
-
max time kernel
160s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27-11-2022 16:39
General
-
Target
438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe
-
Size
255KB
-
MD5
58ed188bab1917c868bcbe550899e403
-
SHA1
3e3ff4a1643fed988f68046e3e6294b52c52737a
-
SHA256
438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2
-
SHA512
7aa3159cf3429f6446b62fc07ea281c0f9697e17aab2a3b56e341a88072daaca855b09c8280503a651c452fdf64dc74cf392e7602e2d1bebb6b93866e0505748
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ6:1xlZam+akqx6YQJXcNlEHUIQeE3mmBID
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 5 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 13 IoCs
-
Drops file in Program Files directory 14 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe"C:\Users\Admin\AppData\Local\Temp\438e0c1d70994ba71cf01215068bbc4aa3a8b904230b1a013f9a676606616cd2.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ulqiymmano.exeulqiymmano.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vlxqqmkf.exeC:\Windows\system32\vlxqqmkf.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\lhhkmweraeanpnm.exelhhkmweraeanpnm.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\gnxndylghggqn.exegnxndylghggqn.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\vlxqqmkf.exevlxqqmkf.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5b49357846413e22c221e100875e6e9b6
SHA164189652d6874556262c17f4df979eba411d07cd
SHA256c7337e21f3ac63dcfd0e04b1fda126d75cc1b9b48f889fb681e4041869d608e3
SHA51278414e3f2ea6421503e63518da4c3022373e82ffec0c975cf65ccca34e451af672c276863f76f775ebfcc83b8ebed3227f6f532a92b80ff2e7be9e5a318298b1
-
Filesize
255KB
MD5a6c469bedea34b8147c77759f0b98563
SHA1346600fd62fd25da623caca7788b3f232d8952c4
SHA256a8bb3e29925327f388a9ff0dcca2ca2d546652bf7b752a949534ecd3c9a4f4bb
SHA5129752ad2bd13c7c241e8b0d86d6275f7ec7d67fc1f9df482704f6e7f1cf39cce6a52444d3df3fbb338d9846ea1911690c4604755a02b34e8e456bcb48f19f2a19
-
Filesize
255KB
MD5ba3ef8ab23db32503e46f20310934038
SHA1cc2f0285afcee222e7464a4d93f8c55731b2e228
SHA25688e39c5169e2d7910a87f238c6668c7cd8e16b23e0c2c4065ab78814411b6c62
SHA5129f6392f8cf583f095d9d2a1a4d1d119c5c59cfc3018bc6b1e0665d04b9ec452f76f0ddbb78f2a3a9b80dd651cb56058fd5c12fb6379334e61b2716ec1f4b43e9
-
Filesize
255KB
MD5279225dd65105643dff3d70d24f0ef41
SHA1d57cef538db6cb2fd8b2b51ea9206d12a8e3b3e1
SHA256a84e37c2feca2662ead4e7101b09e4ebe81bea29127a1ad7eb430f842309eb71
SHA512e87d31c0141c25c43c04e2c181df20d00cbeafa2d7af5c56e53b8614dbc3d8360911d47fc0ceac2625dbf1c4a4f93306bb5bf026a56bfb21ec79805f8c92ce0d
-
Filesize
255KB
MD5279225dd65105643dff3d70d24f0ef41
SHA1d57cef538db6cb2fd8b2b51ea9206d12a8e3b3e1
SHA256a84e37c2feca2662ead4e7101b09e4ebe81bea29127a1ad7eb430f842309eb71
SHA512e87d31c0141c25c43c04e2c181df20d00cbeafa2d7af5c56e53b8614dbc3d8360911d47fc0ceac2625dbf1c4a4f93306bb5bf026a56bfb21ec79805f8c92ce0d
-
Filesize
255KB
MD510bccb671dfb8fb665625ee360d23450
SHA1f17d89311cec7c7c41e785bba5e09811b35300c8
SHA256447bfd9e42b751657d7f223c733cb646ec393cadebdc278e0b06855ce90f209c
SHA5121cdcd89b39489ebcc9a3d6538523f2c276984fc4aa5baef74364522f86fb2f7f5ed313377d0c07125c141032f6a61c907eee4fead7045b5082e2829d5350d1a7
-
Filesize
255KB
MD510bccb671dfb8fb665625ee360d23450
SHA1f17d89311cec7c7c41e785bba5e09811b35300c8
SHA256447bfd9e42b751657d7f223c733cb646ec393cadebdc278e0b06855ce90f209c
SHA5121cdcd89b39489ebcc9a3d6538523f2c276984fc4aa5baef74364522f86fb2f7f5ed313377d0c07125c141032f6a61c907eee4fead7045b5082e2829d5350d1a7
-
Filesize
255KB
MD52dfd2e3b9afa21d8f9a3590650044aed
SHA124f2c6be609738f228162db158cb374858d61cfb
SHA256bae70b84c8a5e560554f590ff1a500ec61daf9b7553138c696cf24622d078dc5
SHA512c517ff37167d766b199432bd7ad3d3001b6ddbf09eb5744a38c19f94a056c6bb2f963f5b60e55bed29d10b5e43ecb5ccac0fc47deef8ed670239121a4c7b0795
-
Filesize
255KB
MD52dfd2e3b9afa21d8f9a3590650044aed
SHA124f2c6be609738f228162db158cb374858d61cfb
SHA256bae70b84c8a5e560554f590ff1a500ec61daf9b7553138c696cf24622d078dc5
SHA512c517ff37167d766b199432bd7ad3d3001b6ddbf09eb5744a38c19f94a056c6bb2f963f5b60e55bed29d10b5e43ecb5ccac0fc47deef8ed670239121a4c7b0795
-
Filesize
255KB
MD546bc1f7de0934edda2d0390e366d1379
SHA13394febf8b3e821668308ef6fc26aea8abe47710
SHA256520a547bf262556ef4e0602f462c5db6f46f1c4cd2b3a0db702a7aae0239d940
SHA512d89fbe283931dabfd3614b59f8991c74745988849ba168dc4b56867b78f76b13ae4eac0f5ec3cabd756385c11a6d8f96fa0dc0ff45b4d4a49fd85a4c08071b48
-
Filesize
255KB
MD546bc1f7de0934edda2d0390e366d1379
SHA13394febf8b3e821668308ef6fc26aea8abe47710
SHA256520a547bf262556ef4e0602f462c5db6f46f1c4cd2b3a0db702a7aae0239d940
SHA512d89fbe283931dabfd3614b59f8991c74745988849ba168dc4b56867b78f76b13ae4eac0f5ec3cabd756385c11a6d8f96fa0dc0ff45b4d4a49fd85a4c08071b48
-
Filesize
255KB
MD546bc1f7de0934edda2d0390e366d1379
SHA13394febf8b3e821668308ef6fc26aea8abe47710
SHA256520a547bf262556ef4e0602f462c5db6f46f1c4cd2b3a0db702a7aae0239d940
SHA512d89fbe283931dabfd3614b59f8991c74745988849ba168dc4b56867b78f76b13ae4eac0f5ec3cabd756385c11a6d8f96fa0dc0ff45b4d4a49fd85a4c08071b48
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5cce6f4d4409121b72d9595b74c528680
SHA1974bcee30b5bb0d2565c3fbef98cb080f45d594b
SHA256ca9fe174808896349863d9e33dd8afe841cb1e5cb1733cc39d06dbe83ce55a1d
SHA512c493ae31c62768c7b5d6f6449f300fe2cf0e521e5a6d73eba0300b0f96b6295b89a99c9048f8efcfcb83d1769ca0d59be5b0a6a297907074bccf31131e395b0a
-
Filesize
255KB
MD55d2cd9cc67fb5c9b8477a58a8baf9f5c
SHA10375ea9671156c4a18c624fc297d3a611553cd37
SHA256fb153852cf58d32dba953fed087933fd343241d152ad9b5795219e6a982cb826
SHA512b9aff2fe6322afa09d3478626f3ab07b0c5b33d98b2d7e15d1222083cd26fa73cce03bae03df8d63f328e4dc17db68d68d91c6aa12ef25f808ea60724595ddcd
-
Filesize
255KB
MD55d2cd9cc67fb5c9b8477a58a8baf9f5c
SHA10375ea9671156c4a18c624fc297d3a611553cd37
SHA256fb153852cf58d32dba953fed087933fd343241d152ad9b5795219e6a982cb826
SHA512b9aff2fe6322afa09d3478626f3ab07b0c5b33d98b2d7e15d1222083cd26fa73cce03bae03df8d63f328e4dc17db68d68d91c6aa12ef25f808ea60724595ddcd
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-