Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/01/2024, 05:07
General
-
Target
5a5c3e6ac52f92a05aaa046a32821de2.exe
-
Size
512KB
-
MD5
5a5c3e6ac52f92a05aaa046a32821de2
-
SHA1
8b17edb49a7c1c797f78769d8af58441d4ebf448
-
SHA256
60ab55a22988e6f5dc4163d8afe32e3e2865a24a2f3568f11a561883c2ebc8ca
-
SHA512
baf546b5de9e9c43f5cb53cf2a6a1d1c214fde0642cdd332b36ce6e5ebe566aaf9c2deb831612f8813bb87c22792e8a8b6642e420e90f38b7cba51fe60eb3e22
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5C
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 5 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon 2 TTPs 2 IoCs
-
AutoIT Executable 17 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 12 IoCs
-
Drops file in Program Files directory 15 IoCs
-
Drops file in Windows directory 19 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 20 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 18 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a5c3e6ac52f92a05aaa046a32821de2.exe"C:\Users\Admin\AppData\Local\Temp\5a5c3e6ac52f92a05aaa046a32821de2.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\lojcpnlscrcsmes.exelojcpnlscrcsmes.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\ltecitjljuryf.exeltecitjljuryf.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\sckmrnum.exesckmrnum.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\mcpedckgwi.exemcpedckgwi.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sckmrnum.exeC:\Windows\system32\sckmrnum.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD57edbd37946695cea1fe8930850432818
SHA1d43e1f37be23dca3b797d1ca955b06a4869d8812
SHA2563d99481fbd02063316b6001ded9ebfb2c25cd286492288863c8a6db6f6b61134
SHA512a52ec8821ddb51810bc69626eb9aa058f8254c8e813f08faf2196f898ef6da73eba7fe5505e58177e7ccbd0af17adc6899d2856ef187e61ce99d577a9b08bde4
-
Filesize
239B
MD51459a67e7603529e2bd4067a2a106783
SHA150364cbc787a8be7195e9f7847e1087a8426f3d7
SHA256c989778e2fd3711e7ec2d1578a84da327ba9ef65015084c9f4fcf3e4c9e1a9cc
SHA512b21324f7d9bbb59a64f178c735dd70496629ad0a08b2b5a6eee2346664104b03c13805102347cf5263f8b2e797f08fadaec01e231bc2db1f7716e1f7b257c373
-
Filesize
3KB
MD50852cbf43722528130d51751e9579b96
SHA146d41a3077941a1a0915cf7fcfe9eecf753eab79
SHA25679a6873fe991cf161ea168dfcfa46436c87fae7414b16740eeeae79cf5943ae3
SHA51282c974fec07dc5cc7fa8bbd9a8999c73934e8e7c34e086bed4d2373493f3d8e97d5c8007580629a27e8b9e1f106b577a87f70b24b4e5f5a86eca85ed485e126b
-
Filesize
3KB
MD50428591b9aad5206e1dc3b8975b6f891
SHA1cc9a5d2c9c24631f4b153d0c201e71568922095e
SHA2567dd591e140ac52b3c002505eb5bec47b86f3e20f755b7da055e5f0b5f077fc98
SHA512587f2f12cdbbd461b4aabbece0c70beb2d510c19800d863d0eb139ca7005f73abd03d5f323e4b476f4c0783ce89fd5cc20bd706b92426e94e6d9bcf6f97a29a0
-
Filesize
122KB
MD5d1e36364da95c84cfc6a35aef2772354
SHA1c28d1013f1e68d1e87b96494e99dc8633b3f1695
SHA256754c0b3e8fb820fc28e8b9feca7f7ed1d8fe2a7e0cf25a35aa440a4ff5adc8ae
SHA512aa50273f6ce785165847e591df2dddc604ab845bae2c07d2c1bd6bf4de1b335b5e930a7fcbca5d53aa2232790545ae9d128703816864c724e28313ec441fd54e
-
Filesize
456KB
MD54de0ea6f64aaf5cfd10dbb9ad2f880bb
SHA1537fef500abe1714ba4f53501e1b5b63eaf93ded
SHA256f541830328cc998cb50faa78f975ed737b91d2f8f59dfd6d9c3375ff120cbdbe
SHA512a463bda551d3e381043b4ee811ec6e37e0eee350f35abb86929729b03483a111657dd21be9e47bdec2f7445f3d91e35f909c7d2eb2a5cb007b8640618632333a
-
Filesize
446KB
MD55dc5b06e283d10779e4128e894a5553f
SHA1bf6851c5f522c377874c73eed33cffffeb4284c0
SHA2561e0ed9edead5035f76b66afbdc43966730d8657b692b223699fa9bd088f2c0d5
SHA512555892ab5f3ec205376ddbaac9614ef8021939e9707573db32f31fac0a34b19fb143dccafc525cbcee769f88852ef16d1cc2f480364d209ec4fae7322daa60af
-
Filesize
304KB
MD50304f6c9d2dd90d36fef39627ef2363b
SHA14b2822b954e84144661ba8fbe7081920a3e5461e
SHA2569a48b2ee40314d393a9540b8474dc78444741ad74a95dc33e82ba38a8915245d
SHA5122cd6e9579fbaf35b8f63075f30ec02f4f1b925cb4e6d2b8735a3d4bf5b6c399acf3b0a33b1279122625624715d9901194f60cc28516f6713499850cb34ffc883
-
Filesize
264KB
MD57b43013887f72dc61a37c00a688eb4dd
SHA16d183d2f26b4f486ea8b89049828131a679d8273
SHA256b886dcc248eb57b648b67f6b5bdf198eb18474332aad98086bef81080fcc5daa
SHA512a1da5506f0c8b3bd3ff52452c7835d0052c7668d5ff83f89df1dfd307d74b5633eb26b50846207d8756711b5a4143a31b5177c5137f0e1467dcb663f5467b994
-
Filesize
221KB
MD5885421bd16b8baa808cc47dd5ccd33c1
SHA10184ef62856ac12fc5d8ad7c815917a74a307115
SHA256c57d314f485a4ef4e4c4b035588cb2ac91c93d93ec25973cd4cbd13c60ecb71f
SHA512ba740050c788b285a41b171af1ae97276feb5a558a596171da0aa01494bc7c24165108718fa08170e24113e28cbb2e3bd6cffc694fa973c174d40252bad9c4a3
-
Filesize
326KB
MD5aba3b7b1bc1b6dd663cf9a17d34e030f
SHA18b18aed4c31304d32813255f8ba05f292ace5e9b
SHA25638657275fdd3cf4d429f0a2d2f297188651922a224a2cf4f31c99a4a7585b250
SHA5120679c7da37aaf0ba737b77a6051537ef3a54a9bcdef66126a91bb05c4e7ed76f8897dfc1c4d33299fa8bb72c712a7b6dc63a09a8d8e7d86d82a77188634bd419
-
Filesize
353KB
MD56a4a65cb2568d13218a5d17ea753fee4
SHA1e96f98a69801b30c643cecf26b1ba5c6ebd18873
SHA256aa5ed15c1c60e5d6bb849816e994ba325836cffbf5abd90873a170bee26f8d6e
SHA512c06ac087af1b339de6dcf886d1a3c48ab36c4ff6eaacb99b81e621bf3b2d4ebecccd5462c7afde344660ee3a7395a642a1b52c44d37eef525334d93221264c62
-
Filesize
235KB
MD578f158dfd5b9674e1cddf248caabc400
SHA12b6beecd040dc3cec05d348a60f794e2ac67b6e2
SHA2561e401d2f2570eeb5d2f0a54ca8f9ad397d5aedbe389c7cec6246e3512901a4db
SHA512a018ed3b4620e52bbacd867413169803f6039cbf0d6b4363723b8548ffb27de12db95f30eff745e3c704dfeae3da8f3a871946292d5ef2151225fccbffa77f2d
-
Filesize
374KB
MD5c73fcd48bd9a42c8a398dcbb50c8d940
SHA133767a9b6535d0705759f238dabef77c85f2f6b8
SHA256992651248c288888f1b8eb04d964a99456886445dc49ad9d38795aa8e9cfe214
SHA51200d0c48dfdbe9028a7de65c88ca70c4b78a7d80aa4a55659624ba478b0336da37a6b1cf6096a05726ed2a7dcf550a3da0d97aa00322b5eb350016c173ce035ef
-
Filesize
268KB
MD5f6f7c6da5437386e6e74d21a33bc6a0c
SHA1e85d3f5cdf83cc965bc578d646e847bba1735ac8
SHA256c9c464953bdbbf95a62767272b7ed411ae63f61e391883fe99fac10c7f515046
SHA51287617ebac72f0eac5c23b60a02d52c7a150b03b40b4068fdd9dc868a851c19a2fa0db25b820db7468d08270dc7faca54bd65a5a5c426e244538ac08b02030e9a
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
512KB
MD5264c354c1c1b5c473538755570638936
SHA113147ce1bd6b6d60a53c05bf32a370191b5acdcd
SHA256e5044f7fbaf2a193e7eff83fbf959d8ea4ec3d10e14e7ac95b2c6fd3067c20bb
SHA512711b70e964d42477890bbbcb77c6ee8ab3dca78d054caee5e74ef8f8b95b99b56f521d93204a9fe54d6b99a9951c4523a5ec2ffa3acb4cff8068dc965967b30e
-
Filesize
123KB
MD5f8700c3692ce2ee20897e8ac86962eaf
SHA1a718925d7c8dc2a95773c2df983dd5d1e844b3c3
SHA256076b4a7ed7fc2b8eb6a06939b0dfdcd82a14eae3d3d8df2bdf9523e7242b19cf
SHA5124e2b1b396044dd6f2d47b066ce2335b6b7acc31a5356990f87e435f1881ddf046d0825a997b02712dbfdf2ebc87a31ae241647688cfce11eb10a199d024840ff
-
Filesize
194KB
MD57dfcd32e47d24c5e0c6a2e9dd75d4aba
SHA1c72a84798d66f407012fe78a274b0388eee40535
SHA256c920256e5f587f4c0280e5368dc46ca20700d589d58a1ef44bbc83aa725c250c
SHA512bc91d6120d76a739012cb79f0fa9a0ab865aee6d215e7c824c18f49529ab3a703c234ce2b1cf0eb6d789011fdf93090b6387f10a39ffa7c82fd20d9e4bad3964
-
Filesize
512KB
MD533031e66ec6ec816875bad6eed855160
SHA1cb781f6979fdb6b10fb239e81599ecb5d57c1fea
SHA2562d2553072a2daa23ea970f49c251669297ee5a6a7cb27eedc54f1427492e8b1d
SHA512692786b41466450cd3b467901d0be055aaf9e31ca11e2f48a0ce89bdfc0cfd5f653d72c4c5b01da693722f70584c0f89fde533b0190073f92323acf489dd6e73
-
Filesize
600KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB