Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
27-11-2022 16:17
General
-
Target
d71d7205f0ae0ba4b8812ddee8c882e1e0d43ca33e580d22a0c5d193751403df.exe
-
Size
255KB
-
MD5
024bbce4de7354cf6af71939cc5e3c13
-
SHA1
bc42a69243b37222f7c97695d0901d1c31ee3d31
-
SHA256
d71d7205f0ae0ba4b8812ddee8c882e1e0d43ca33e580d22a0c5d193751403df
-
SHA512
0331eda5e8f8bc42ffea38183c436c0adb64fbbce3f7e4c598b6f12b87ebe37dcecfc4ed36be56c70682b9968a7c000e9fe44bcfb251006ae55b950de2effc96
-
SSDEEP
6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv62:Plf5j6zCNa0xeE3mX
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Executes dropped EXE 6 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 34 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 11 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 47 IoCs
-
Suspicious use of SendNotifyMessage 33 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d71d7205f0ae0ba4b8812ddee8c882e1e0d43ca33e580d22a0c5d193751403df.exe"C:\Users\Admin\AppData\Local\Temp\d71d7205f0ae0ba4b8812ddee8c882e1e0d43ca33e580d22a0c5d193751403df.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\jaoihxhzcn.exejaoihxhzcn.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\hxucbgkr.exeC:\Windows\system32\hxucbgkr.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\otryuuxbwqrwqde.exeotryuuxbwqrwqde.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c zukyinviyjorh.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zukyinviyjorh.exezukyinviyjorh.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Windows\SysWOW64\hxucbgkr.exehxucbgkr.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\zukyinviyjorh.exezukyinviyjorh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5381⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5b3d095ce13d417fe81eed2ef3e19e5fc
SHA123c0384fa188742a2fd206613dcca06af248c8e1
SHA25692ebfdb8a45d971e0887b5a6206a70cbfc7fd905be3af203591ab1ed97c707a3
SHA5129fd06a930e8d4e995c6eaf16fdba7fa472eb3188ad5ad52303d45beaf394c19105f201df4405c52a10a8eb308c6122b6d1103a1ecaf956d8869bfd56bc770388
-
Filesize
255KB
MD5bb1ef56428d559393ea220d6f5cc8134
SHA1f9ffb99f83f5a407d5731280298d546e6bc0c256
SHA256bbc5739917dac58b4952ffb07afa65d06fab060595dbf40e79f32a5977df1f5c
SHA5125b0bac658efd45627f264cb40ebb3665d4b9d74b084358028afc37bda100c9f92c8e07e6911a93f5e812cfea1872dac12cc42e0c689b657e023482c45ee7574a
-
Filesize
255KB
MD535bd82775af9c29cf4f5357896fe791e
SHA13ed87b01b2fbf430ceaf38b2550cac04bd23366c
SHA2567acb2efbe404ad17dba51823407152971498beae2e347adac0668f73e39e1911
SHA5122b92f27e728d92d8a49ed9b9863400c3e2961a6fef94f9138867f371108634caaca259ed531a45e0265a1b8923ed8137e02ebb0184c936c12ad462355533a2ae
-
Filesize
255KB
MD535bd82775af9c29cf4f5357896fe791e
SHA13ed87b01b2fbf430ceaf38b2550cac04bd23366c
SHA2567acb2efbe404ad17dba51823407152971498beae2e347adac0668f73e39e1911
SHA5122b92f27e728d92d8a49ed9b9863400c3e2961a6fef94f9138867f371108634caaca259ed531a45e0265a1b8923ed8137e02ebb0184c936c12ad462355533a2ae
-
Filesize
255KB
MD535bd82775af9c29cf4f5357896fe791e
SHA13ed87b01b2fbf430ceaf38b2550cac04bd23366c
SHA2567acb2efbe404ad17dba51823407152971498beae2e347adac0668f73e39e1911
SHA5122b92f27e728d92d8a49ed9b9863400c3e2961a6fef94f9138867f371108634caaca259ed531a45e0265a1b8923ed8137e02ebb0184c936c12ad462355533a2ae
-
Filesize
255KB
MD52ea68ee90b1adbdfed395e2b6811f21e
SHA1de0a7b1a7ab9d2e2db971249c57efc205d52792d
SHA2561e30b1d7d91af5fd7f748fa56f00fbc08ed12f6ed7544c6175719c8bccc5ae7b
SHA512e7f72f163d8ddc70ba07d9fa25cc680167c8e27758e67bcda90fa6b53078ede014afef1cebc2fa30cd162ac5bbb8fa9e3af63e9202a0fd4f8991f32608d6cd48
-
Filesize
255KB
MD52ea68ee90b1adbdfed395e2b6811f21e
SHA1de0a7b1a7ab9d2e2db971249c57efc205d52792d
SHA2561e30b1d7d91af5fd7f748fa56f00fbc08ed12f6ed7544c6175719c8bccc5ae7b
SHA512e7f72f163d8ddc70ba07d9fa25cc680167c8e27758e67bcda90fa6b53078ede014afef1cebc2fa30cd162ac5bbb8fa9e3af63e9202a0fd4f8991f32608d6cd48
-
Filesize
255KB
MD5031ce56b170e66d8cf75b444d936b8ea
SHA1df888ba08147c50f7e68c3db35794cda2eaae7b5
SHA256ca70a523f4bb5e0fc35559dd7503c58521b80d4c32353f94ab18fba10cb578a3
SHA5128d72234ffee9f23ca4f1a4c81dcb3811129592f1b5c156472977354cd6f59b1afc0779d1222c05e503b8e91a910aa25fdf65740c6307594e86628383368e98bf
-
Filesize
255KB
MD5031ce56b170e66d8cf75b444d936b8ea
SHA1df888ba08147c50f7e68c3db35794cda2eaae7b5
SHA256ca70a523f4bb5e0fc35559dd7503c58521b80d4c32353f94ab18fba10cb578a3
SHA5128d72234ffee9f23ca4f1a4c81dcb3811129592f1b5c156472977354cd6f59b1afc0779d1222c05e503b8e91a910aa25fdf65740c6307594e86628383368e98bf
-
Filesize
255KB
MD55568e43a94cc4b04b4f3b8f42b6858e9
SHA17030295817058eb00b4de59e39b20b74c2eea243
SHA256da7c2a0c868f2fd31274ff38170ee920466f84b349f9dfc4c4aa07ef064690a8
SHA51281ee818dfd72c5713b726cf3c8147f5fd389b2fa23cfb412c37e1786bda9c2a7f3ddc21cc768df6b81659be3588d120ae20b02078f2c333569de252524bf9137
-
Filesize
255KB
MD55568e43a94cc4b04b4f3b8f42b6858e9
SHA17030295817058eb00b4de59e39b20b74c2eea243
SHA256da7c2a0c868f2fd31274ff38170ee920466f84b349f9dfc4c4aa07ef064690a8
SHA51281ee818dfd72c5713b726cf3c8147f5fd389b2fa23cfb412c37e1786bda9c2a7f3ddc21cc768df6b81659be3588d120ae20b02078f2c333569de252524bf9137
-
Filesize
255KB
MD55568e43a94cc4b04b4f3b8f42b6858e9
SHA17030295817058eb00b4de59e39b20b74c2eea243
SHA256da7c2a0c868f2fd31274ff38170ee920466f84b349f9dfc4c4aa07ef064690a8
SHA51281ee818dfd72c5713b726cf3c8147f5fd389b2fa23cfb412c37e1786bda9c2a7f3ddc21cc768df6b81659be3588d120ae20b02078f2c333569de252524bf9137
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD535bd82775af9c29cf4f5357896fe791e
SHA13ed87b01b2fbf430ceaf38b2550cac04bd23366c
SHA2567acb2efbe404ad17dba51823407152971498beae2e347adac0668f73e39e1911
SHA5122b92f27e728d92d8a49ed9b9863400c3e2961a6fef94f9138867f371108634caaca259ed531a45e0265a1b8923ed8137e02ebb0184c936c12ad462355533a2ae
-
Filesize
255KB
MD535bd82775af9c29cf4f5357896fe791e
SHA13ed87b01b2fbf430ceaf38b2550cac04bd23366c
SHA2567acb2efbe404ad17dba51823407152971498beae2e347adac0668f73e39e1911
SHA5122b92f27e728d92d8a49ed9b9863400c3e2961a6fef94f9138867f371108634caaca259ed531a45e0265a1b8923ed8137e02ebb0184c936c12ad462355533a2ae
-
Filesize
255KB
MD52ea68ee90b1adbdfed395e2b6811f21e
SHA1de0a7b1a7ab9d2e2db971249c57efc205d52792d
SHA2561e30b1d7d91af5fd7f748fa56f00fbc08ed12f6ed7544c6175719c8bccc5ae7b
SHA512e7f72f163d8ddc70ba07d9fa25cc680167c8e27758e67bcda90fa6b53078ede014afef1cebc2fa30cd162ac5bbb8fa9e3af63e9202a0fd4f8991f32608d6cd48
-
Filesize
255KB
MD5031ce56b170e66d8cf75b444d936b8ea
SHA1df888ba08147c50f7e68c3db35794cda2eaae7b5
SHA256ca70a523f4bb5e0fc35559dd7503c58521b80d4c32353f94ab18fba10cb578a3
SHA5128d72234ffee9f23ca4f1a4c81dcb3811129592f1b5c156472977354cd6f59b1afc0779d1222c05e503b8e91a910aa25fdf65740c6307594e86628383368e98bf
-
Filesize
255KB
MD55568e43a94cc4b04b4f3b8f42b6858e9
SHA17030295817058eb00b4de59e39b20b74c2eea243
SHA256da7c2a0c868f2fd31274ff38170ee920466f84b349f9dfc4c4aa07ef064690a8
SHA51281ee818dfd72c5713b726cf3c8147f5fd389b2fa23cfb412c37e1786bda9c2a7f3ddc21cc768df6b81659be3588d120ae20b02078f2c333569de252524bf9137
-
Filesize
255KB
MD55568e43a94cc4b04b4f3b8f42b6858e9
SHA17030295817058eb00b4de59e39b20b74c2eea243
SHA256da7c2a0c868f2fd31274ff38170ee920466f84b349f9dfc4c4aa07ef064690a8
SHA51281ee818dfd72c5713b726cf3c8147f5fd389b2fa23cfb412c37e1786bda9c2a7f3ddc21cc768df6b81659be3588d120ae20b02078f2c333569de252524bf9137
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
8KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
-
Filesize
640KB
-
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
12KB
-
-
Filesize
44KB
-
Filesize
8KB
-
Filesize
640KB
-
-
Filesize
640KB
-
Filesize
8KB
-
Filesize
64KB