Analysis

  • max time kernel
    153s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 06:12

General

  • Target

    2a14da1cc4b47e0ccfb5bcedf38d4a6bc941fa3e81c59b5058ba7a0048f3c698.exe

  • Size

    255KB

  • MD5

    2f9697108175f2c6563dcedea7bf616f

  • SHA1

    a0fd9fe22ccf08ff659821df2870ef8525b6e294

  • SHA256

    2a14da1cc4b47e0ccfb5bcedf38d4a6bc941fa3e81c59b5058ba7a0048f3c698

  • SHA512

    218374059aa96121c7df0ebcd04ed97e7946564359b6ef9e9c693d7261c987fcff89ad3507786e0f872a86f9384f6ddcb836315be189f9ad6c888f3c646021d9

  • SSDEEP

    6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI6+:Plf5j6zCNa0xeE3mx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 5 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 11 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a14da1cc4b47e0ccfb5bcedf38d4a6bc941fa3e81c59b5058ba7a0048f3c698.exe
    "C:\Users\Admin\AppData\Local\Temp\2a14da1cc4b47e0ccfb5bcedf38d4a6bc941fa3e81c59b5058ba7a0048f3c698.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\SysWOW64\kosdswkjhi.exe
      kosdswkjhi.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:948
      • C:\Windows\SysWOW64\msmbhbol.exe
        C:\Windows\system32\msmbhbol.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1824
    • C:\Windows\SysWOW64\rtudmtyvlornljn.exe
      rtudmtyvlornljn.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:604
    • C:\Windows\SysWOW64\msmbhbol.exe
      msmbhbol.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1068
    • C:\Windows\SysWOW64\ezijqtrbmddst.exe
      ezijqtrbmddst.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1164
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1416
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:996

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

      Filesize

      255KB

      MD5

      c7484a280c65e67cc0b5e148f54c9075

      SHA1

      2799e213543b3c218c40806fdaf3238b3fe73a6f

      SHA256

      b240904495665b5e075a4265ad0aa1788fb7a64083ee950d4888224299d2ad3f

      SHA512

      c9eba38b423f5bc235f40accf1656568eb69842dfa1cb5cd889bed93afa4d68a98ad8763c591ef4620f09e7c37357166b3b29ca41ddec2634cce429f3b8e85f7

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

      Filesize

      255KB

      MD5

      760e3a08f21c32330bcc1c7133ece484

      SHA1

      d009f5e81219285ff2440ddb59cc83525a9f8fd0

      SHA256

      5d75e546d6e04768b726791e81927b3cb025153f886492c557aa3ad81a0864b5

      SHA512

      72eb4438879fd08f4cbda3227073ad916f10adbc42a66be902da1c616590c41c47b233cc8c1ad39f0cb43d40867fdc5f9fa00157449da75b4898a41f1e339f6b

    • C:\Users\Admin\Documents\ConfirmInitialize.doc.exe

      Filesize

      255KB

      MD5

      a8247f4a3b428ca27b91cebda3ffec87

      SHA1

      8f8bab1270f2b60b58c6c7f1ea3a8cf446c8598b

      SHA256

      3adb4065889e608eec69f03bdb826fb70ab87a30559535ad273f526007f82e4c

      SHA512

      8dc3b4748a135377cf36c55c7441379addf410dd1d9af67007c20a0f02460e1d6cdc849d40c4628348fe3b733fea00e69f90fcd077e9068919f2c0005d5ebc38

    • C:\Users\Admin\Downloads\RenameSplit.doc.exe

      Filesize

      255KB

      MD5

      b52731bef96f58fe326886d3df70a70b

      SHA1

      730e01003be57a5d3fe5aa2497d6b70342cd2c33

      SHA256

      1cf636e8b93c0a6265850ae3ffea249e2822d9af0c47c609e45c2df88bad38b1

      SHA512

      bad1b72c60ae07d265dfd92933ecceceedf01b3bd51eae42c63c7a3ec025fbea6fd734f2154a60ee209f7157161bd3fad59062e05a356411267c3d7f775355ac

    • C:\Windows\SysWOW64\ezijqtrbmddst.exe

      Filesize

      255KB

      MD5

      d3a0286c86c72900d6ae2b46f696d3f6

      SHA1

      12179cef2cd152856e2918812b1eac2faa88ae1d

      SHA256

      fbfa2e25ea74bb8ec281e062eed659bc30f3613f4df4ad711981ff0a413fb1ac

      SHA512

      837ec56a64e3a1e4ceef7df85e46f64c337c9486d1c5e2464568eb420fe1dac9cebef9eae2175de825183f06ac3045edbdd8bd853cae3959b7a12543640f7bec

    • C:\Windows\SysWOW64\ezijqtrbmddst.exe

      Filesize

      255KB

      MD5

      d3a0286c86c72900d6ae2b46f696d3f6

      SHA1

      12179cef2cd152856e2918812b1eac2faa88ae1d

      SHA256

      fbfa2e25ea74bb8ec281e062eed659bc30f3613f4df4ad711981ff0a413fb1ac

      SHA512

      837ec56a64e3a1e4ceef7df85e46f64c337c9486d1c5e2464568eb420fe1dac9cebef9eae2175de825183f06ac3045edbdd8bd853cae3959b7a12543640f7bec

    • C:\Windows\SysWOW64\kosdswkjhi.exe

      Filesize

      255KB

      MD5

      b258ad4a915faea2a1c42f3da5570967

      SHA1

      3f885d01868d9af02e4dbd9a84c9f2145a09bdf8

      SHA256

      aa017e889d4f5ce4d5e7692be8ce80cce57cbf0e79509b9a7b1ac1282b7a0edb

      SHA512

      3aee2c488ce05e8d7c5efdfb4457c168829d1ed37a501d46beb61c645158aaa8485ebc04ecda3e0926c9ee777b23b77818977919749a0a6c683e68ab24603f27

    • C:\Windows\SysWOW64\kosdswkjhi.exe

      Filesize

      255KB

      MD5

      b258ad4a915faea2a1c42f3da5570967

      SHA1

      3f885d01868d9af02e4dbd9a84c9f2145a09bdf8

      SHA256

      aa017e889d4f5ce4d5e7692be8ce80cce57cbf0e79509b9a7b1ac1282b7a0edb

      SHA512

      3aee2c488ce05e8d7c5efdfb4457c168829d1ed37a501d46beb61c645158aaa8485ebc04ecda3e0926c9ee777b23b77818977919749a0a6c683e68ab24603f27

    • C:\Windows\SysWOW64\msmbhbol.exe

      Filesize

      255KB

      MD5

      da665cf2f8e3048515bb3dc0dc357f2b

      SHA1

      93b1d59a0a43112a5c4eef48bba3f4e72e7fb151

      SHA256

      16e4ac6020375640d1430390c6cac2d957418904f9df779cb6edbe57530c5dd9

      SHA512

      e2b6ae8770da94748def81dd187a443aa3983e9e5a6d5d1fece2e06e739a7fb5ad1fc5061f6277a655115a67f4352191a3046dda61cd49ef217928759bb0a755

    • C:\Windows\SysWOW64\msmbhbol.exe

      Filesize

      255KB

      MD5

      da665cf2f8e3048515bb3dc0dc357f2b

      SHA1

      93b1d59a0a43112a5c4eef48bba3f4e72e7fb151

      SHA256

      16e4ac6020375640d1430390c6cac2d957418904f9df779cb6edbe57530c5dd9

      SHA512

      e2b6ae8770da94748def81dd187a443aa3983e9e5a6d5d1fece2e06e739a7fb5ad1fc5061f6277a655115a67f4352191a3046dda61cd49ef217928759bb0a755

    • C:\Windows\SysWOW64\msmbhbol.exe

      Filesize

      255KB

      MD5

      da665cf2f8e3048515bb3dc0dc357f2b

      SHA1

      93b1d59a0a43112a5c4eef48bba3f4e72e7fb151

      SHA256

      16e4ac6020375640d1430390c6cac2d957418904f9df779cb6edbe57530c5dd9

      SHA512

      e2b6ae8770da94748def81dd187a443aa3983e9e5a6d5d1fece2e06e739a7fb5ad1fc5061f6277a655115a67f4352191a3046dda61cd49ef217928759bb0a755

    • C:\Windows\SysWOW64\rtudmtyvlornljn.exe

      Filesize

      255KB

      MD5

      1f6110cc58cfdc171594cceb66be79b4

      SHA1

      7f92dada18330ab7868da12b0ba4a59c7b15e34f

      SHA256

      bfb879cb430948410cf452738f2cee770bd67364ab60c0a730617d3554e95e79

      SHA512

      3a2e6b825064802919fd4dadeb391d861814fa88ee79ab2436f096245394f621fbd893b2565e45c660270d7a7fbe0572d253b4b1464736309a7d15093f108427

    • C:\Windows\SysWOW64\rtudmtyvlornljn.exe

      Filesize

      255KB

      MD5

      1f6110cc58cfdc171594cceb66be79b4

      SHA1

      7f92dada18330ab7868da12b0ba4a59c7b15e34f

      SHA256

      bfb879cb430948410cf452738f2cee770bd67364ab60c0a730617d3554e95e79

      SHA512

      3a2e6b825064802919fd4dadeb391d861814fa88ee79ab2436f096245394f621fbd893b2565e45c660270d7a7fbe0572d253b4b1464736309a7d15093f108427

    • C:\Windows\mydoc.rtf

      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    • \Windows\SysWOW64\ezijqtrbmddst.exe

      Filesize

      255KB

      MD5

      d3a0286c86c72900d6ae2b46f696d3f6

      SHA1

      12179cef2cd152856e2918812b1eac2faa88ae1d

      SHA256

      fbfa2e25ea74bb8ec281e062eed659bc30f3613f4df4ad711981ff0a413fb1ac

      SHA512

      837ec56a64e3a1e4ceef7df85e46f64c337c9486d1c5e2464568eb420fe1dac9cebef9eae2175de825183f06ac3045edbdd8bd853cae3959b7a12543640f7bec

    • \Windows\SysWOW64\kosdswkjhi.exe

      Filesize

      255KB

      MD5

      b258ad4a915faea2a1c42f3da5570967

      SHA1

      3f885d01868d9af02e4dbd9a84c9f2145a09bdf8

      SHA256

      aa017e889d4f5ce4d5e7692be8ce80cce57cbf0e79509b9a7b1ac1282b7a0edb

      SHA512

      3aee2c488ce05e8d7c5efdfb4457c168829d1ed37a501d46beb61c645158aaa8485ebc04ecda3e0926c9ee777b23b77818977919749a0a6c683e68ab24603f27

    • \Windows\SysWOW64\msmbhbol.exe

      Filesize

      255KB

      MD5

      da665cf2f8e3048515bb3dc0dc357f2b

      SHA1

      93b1d59a0a43112a5c4eef48bba3f4e72e7fb151

      SHA256

      16e4ac6020375640d1430390c6cac2d957418904f9df779cb6edbe57530c5dd9

      SHA512

      e2b6ae8770da94748def81dd187a443aa3983e9e5a6d5d1fece2e06e739a7fb5ad1fc5061f6277a655115a67f4352191a3046dda61cd49ef217928759bb0a755

    • \Windows\SysWOW64\msmbhbol.exe

      Filesize

      255KB

      MD5

      da665cf2f8e3048515bb3dc0dc357f2b

      SHA1

      93b1d59a0a43112a5c4eef48bba3f4e72e7fb151

      SHA256

      16e4ac6020375640d1430390c6cac2d957418904f9df779cb6edbe57530c5dd9

      SHA512

      e2b6ae8770da94748def81dd187a443aa3983e9e5a6d5d1fece2e06e739a7fb5ad1fc5061f6277a655115a67f4352191a3046dda61cd49ef217928759bb0a755

    • \Windows\SysWOW64\rtudmtyvlornljn.exe

      Filesize

      255KB

      MD5

      1f6110cc58cfdc171594cceb66be79b4

      SHA1

      7f92dada18330ab7868da12b0ba4a59c7b15e34f

      SHA256

      bfb879cb430948410cf452738f2cee770bd67364ab60c0a730617d3554e95e79

      SHA512

      3a2e6b825064802919fd4dadeb391d861814fa88ee79ab2436f096245394f621fbd893b2565e45c660270d7a7fbe0572d253b4b1464736309a7d15093f108427

    • memory/604-83-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/604-90-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/948-89-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/948-81-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/996-102-0x000007FEFB851000-0x000007FEFB853000-memory.dmp

      Filesize

      8KB

    • memory/1068-84-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1068-91-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1164-85-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1164-92-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1416-100-0x0000000070DAD000-0x0000000070DB8000-memory.dmp

      Filesize

      44KB

    • memory/1416-94-0x0000000072341000-0x0000000072344000-memory.dmp

      Filesize

      12KB

    • memory/1416-95-0x000000006FDC1000-0x000000006FDC3000-memory.dmp

      Filesize

      8KB

    • memory/1416-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1416-99-0x0000000070DAD000-0x0000000070DB8000-memory.dmp

      Filesize

      44KB

    • memory/1416-103-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1416-104-0x0000000070DAD000-0x0000000070DB8000-memory.dmp

      Filesize

      44KB

    • memory/1628-55-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1628-88-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1628-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

      Filesize

      8KB

    • memory/1628-82-0x0000000002FD0000-0x0000000003070000-memory.dmp

      Filesize

      640KB

    • memory/1628-80-0x0000000002FD0000-0x0000000003070000-memory.dmp

      Filesize

      640KB

    • memory/1824-86-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB

    • memory/1824-93-0x0000000000400000-0x00000000004A0000-memory.dmp

      Filesize

      640KB