a94ff774cc6a77bd38b391e73eddbd31576f2f2cebcd46fa01d8a75b596142cb

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024010680d761f058f9c348b62c0bed3d0d7144lock.exe
Size 255KB
Sample240107-x12tjsdbh2
SHA256 a94ff774cc6a77bd38b391e73eddbd31576f2f2cebcd46fa01d8a75b596142cb
MD5 80d761f058f9c348b62c0bed3d0d7144
SHA1 97d064c0cc08cead365e3f31c13ea3c5f2870911
SHA512 270de0950ae9f231cda5b61f46215a9e4b78eaf0bef8d49d3bcdd5ccd1599abff835f5db00162da87897121c4d5e6773d6bf23003b89f8ef58ddd038718b1703
SSDEEP 6144:9mZ1LV5gs78D7o1dQPUJM5SJGg+5eYtk/:kZ1L8x6QPUJ4SJGg+59tk/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (75) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	OGEAkwEU.exe

Executes dropped EXE 3 IoCs

pid	Process
4232	iYcgYIEA.exe
2368	OGEAkwEU.exe
1376	cuninst.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iYcgYIEA.exe = "C:\\Users\\Admin\\pOUMsIcY\\iYcgYIEA.exe"	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OGEAkwEU.exe = "C:\\ProgramData\\dYkMkkok\\OGEAkwEU.exe"	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OGEAkwEU.exe = "C:\\ProgramData\\dYkMkkok\\OGEAkwEU.exe"	OGEAkwEU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iYcgYIEA.exe = "C:\\Users\\Admin\\pOUMsIcY\\iYcgYIEA.exe"	iYcgYIEA.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shell32.dll.exe	OGEAkwEU.exe
File opened for modification	C:\Windows\SysWOW64\shell32.dll.exe	OGEAkwEU.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1884	reg.exe
4020	reg.exe
368	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe
2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe
2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe
2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2368	OGEAkwEU.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe
2368	OGEAkwEU.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 4232	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	33
PID 2544 wrote to memory of 4232	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	33
PID 2544 wrote to memory of 4232	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	33
PID 2544 wrote to memory of 2368	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	32
PID 2544 wrote to memory of 2368	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	32
PID 2544 wrote to memory of 2368	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	32
PID 2544 wrote to memory of 3680	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	22
PID 2544 wrote to memory of 3680	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	22
PID 2544 wrote to memory of 3680	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	22
PID 2544 wrote to memory of 368	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	30
PID 2544 wrote to memory of 368	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	30
PID 2544 wrote to memory of 368	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	30
PID 3680 wrote to memory of 1376	3680	cmd.exe	29
PID 3680 wrote to memory of 1376	3680	cmd.exe	29
PID 2544 wrote to memory of 4020	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	28
PID 2544 wrote to memory of 4020	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	28
PID 2544 wrote to memory of 4020	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	28
PID 2544 wrote to memory of 1884	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	27
PID 2544 wrote to memory of 1884	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	27
PID 2544 wrote to memory of 1884	2544	2024010680d761f058f9c348b62c0bed3d0d7144lock.exe	27

C:\Users\Admin\AppData\Local\Temp\2024010680d761f058f9c348b62c0bed3d0d7144lock.exe
"C:\Users\Admin\AppData\Local\Temp\2024010680d761f058f9c348b62c0bed3d0d7144lock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cuninst.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Local\Temp\cuninst.exe
    C:\Users\Admin\AppData\Local\Temp\cuninst.exe
    3⤵
    - Executes dropped EXE
    PID:1376
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:1884
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:4020
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies registry key
  PID:368
- C:\ProgramData\dYkMkkok\OGEAkwEU.exe
  "C:\ProgramData\dYkMkkok\OGEAkwEU.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:2368
- C:\Users\Admin\pOUMsIcY\iYcgYIEA.exe
  "C:\Users\Admin\pOUMsIcY\iYcgYIEA.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 565KB
SHA256 5f6ecfd38a0e884e1183be315b7b0e18b3ee0e61ab4e4f4f098972629626e653
MD5 ad3f4670f2429339bc55cba3dfe73ede
SHA1 c0181a4d8dc16602b4418c246abb63ed311cb315
SHA512 76504ca42a5ac41091bdefb183978bbd33eb021c8f65e60d5bfba7ed46814b14881920ba038d5157a2d610e6ad5b007ad4ab808caa72b7e7182fd2d3dd908ff0
SSDEEP 12288:Imgx/EfPbzdLG17EuRftFNUvtxVQeC0NU9CH:IDM/dLG177fHNktxViC
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.png.exe

Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe
Size 95KB
SHA256 d9ba980551abcd914ef9fa01bfa5706a7b9ba75e8c5dec8038bccfb0c5e928d0
MD5 ad78f499ef050a3f5f811a46059e3266
SHA1 df3b65f5531fbb776b7a7f2ab142f34739b25c79
SHA512 67bf0f2a4c48f0cf81e8435240066fca52d5f8dc507a7634b7e97392ad19e7361d3243c08d9dadcd4eb440656c7b4ad899c86881fb683531dce940023243005e
SSDEEP 1536:FvKDcjlwXzpuc/SqtzhmYo6GYhkf5n2Mk1AT39XaC+h5CBq0ee4Sn9x9:pwfDhmYfGYifp2MkCTgQJL
MD5 SHA1 SHA512 SSDEEP

Submit Download

OGEAkwEU.exe

Path C:\ProgramData\dYkMkkok\OGEAkwEU.exe
Size 110KB
SHA256 1a9eff56f3621c44511bee8fdbf1a891122b19747043c09f8be192ebcd0ed363
MD5 d387439f1a99ef8be8cde3743060ef50
SHA1 88a3c81dfb90e603157641cab8f08d74fe0ccdaf
SHA512 df1900e9aba3a581b1e813e7c27ecccb22eeef78b984089a0df6745aa14d75bbb6cf48ae746438f2c94384e3e850f94cf8fa8f52e2054f1ccb575f437629050b
SSDEEP 3072:NTur8Nv5ahbamyFaaNqL8d5MDXcGYwG2w3RdgQ6vzQ/:NtNv5aJamTaIw4cGA2ib68
MD5 SHA1 SHA512 SSDEEP

Submit Download

cuninst.exe

Path C:\Users\Admin\AppData\Local\Temp\cuninst.exe
Size 140KB
SHA256 2ae11cc8a144df879a7be3fb6b1ce2cdce6c720a3e8c73b3a33fe120133b51b8
MD5 3bc2cb2446a5b8fffd7ab3a98b9f51f6
SHA1 4f898bd1af88359128837e58cfe2a52f192a5d1f
SHA512 482f58d2f62b6ebfc5822b5afd63b64a1fc99dd32cafdbd67ac0b206f055b3ca9415905494c375c4d7c5f22e86b53fb8d7a8943504b157df21c5a5b52e9b632b
SSDEEP 3072:1A79H3NLMGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2p:1E9XNgShcHUap
MD5 SHA1 SHA512 SSDEEP

Submit Download

iYcgYIEA.exe

Path C:\Users\Admin\pOUMsIcY\iYcgYIEA.exe
Size 112KB
SHA256 c4a9f5cc149e6e4616f931103178937490b57c16120975406e24dee9d2004ce9
MD5 5607da61095b143fcf2bba8c1453b16a
SHA1 5ca8d8267386393b6f3fc735f389eddfed826bd3
SHA512 77226dd00d3236458408705c0633e23ab2590778587efa04a056e0901b3b4b4eca92c3b1ee20d7d1e2c940cd8f4616f530fd82135a5ee1014e8c09e228454159
SSDEEP 3072:TUxLA83OJUJiHCbWV8wueeLGLI73ctWU9V6Owje8:YA83b8CimwveXwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

office2016setup.exe

Path C:\odt\office2016setup.exe
Size 352KB
SHA256 42977ea4722e89810c18d129054dd4b4cb189ca95596553391b221b654691706
MD5 fcddba79d2ca9721579c77a1f7a102d7
SHA1 56a5dca39f77d3aaaa3a22261a09e5b766e4392d
SHA512 6eb620f0efd4feef099be9984fe11d73e322a2d2e76fa398d9d68a8b71f6131e56dd018b0237abea27c06eb366a7ffd29bac0d78f0b5d3360dad502db025963e
SSDEEP 6144:Pk3dTki57Cv3gNHN7A1JwIb4h69A+Q+JdxvI144PhtUR7Ap5Eh2T8oezVOmghWH+:8tTki55tN2b446b+JCQ7APEh2dezVOBf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1376-23-0x00007FF8C5550000-0x00007FF8C6011000-memory.dmp

Download

memory/1376-21-0x0000000000DB0000-0x0000000000DD8000-memory.dmp

Download

memory/1376-1508-0x00007FF8C5550000-0x00007FF8C6011000-memory.dmp

Download

memory/2368-15-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2544-0-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/2544-19-0x0000000000400000-0x0000000000442000-memory.dmp

Download

memory/4232-6-0x0000000000400000-0x000000000041D000-memory.dmp

Download