Analysis
-
max time kernel
606s -
max time network
1635s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 10:49
General
-
Target
PYXXW.exe
-
Size
2.2MB
-
MD5
0c31c740de5447523acc97e4e5154169
-
SHA1
4e43466e669b8666ab87fc7e4ac2cc28512d8068
-
SHA256
4cd2770019a6b3805f634040b15036302e59f8ab2002998c0a77515986d895a7
-
SHA512
39616f98b1b1e1f24180fc0bfef247c249c51c6e823be1a9ce6f59e55e2997e850db192f3befb774421a530131e2b9436859372eca382e0dc7529a4fbeea1a6b
-
SSDEEP
24576:nawwKusHwEwSDMnWWTeXrzZw/BSCpC8Uy/BHNs6rkHOQQ8e4Vl03RMDF9E5WwYEI:3wREDDMtWw/Ex6sPO6V6GF9wYERyH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Drops file in Program Files directory 53 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PYXXW.exe"C:\Users\Admin\AppData\Local\Temp\PYXXW.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9L72U.tmp\PYXXW.tmp"C:\Users\Admin\AppData\Local\Temp\is-9L72U.tmp\PYXXW.tmp" /SL5="$70166,1362357,857600,C:\Users\Admin\AppData\Local\Temp\PYXXW.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AutoClicker\AutoClicker.exe"C:\Program Files\AutoClicker\AutoClicker.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files\AutoClicker\AutoClickerUpdate.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AutoClicker\AutoClicker.exeAutoClicker.exe /update4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
217KB
MD51fc1854f81e865ebd44de80a721101cd
SHA1465777fecb869232fc0892cfcfff50a2028b0acd
SHA256b7277c0a2760d30b1fe464de44fbe0dcf162f1e5d25595588a583a7577ade250
SHA51272ac55477eca1118a3d00c0de23b842408bd3c1da1d6a4ab4ab717f364c0a2b18e40b896731cc72d9825c8cb59dc2795acaaab33b46bc8400282595995760a8d
-
Filesize
565B
MD5ccf2419187b9583166f17a82971d6ec5
SHA13bebb957e0544d7e745823cb4d2b3b9fffad8440
SHA256a52a88fea8cbfc4465bfa4d520879c29c5f2366502db608f490b42a45658ee52
SHA512843ef6024919683fbc71bdfc6910863eeb0d4fc0afe2c103a7f525e60ef2c7503b096074ff3ea4e0e32ad44def3d438e129f4958bb1ed147c759cd12a1ace1eb
-
Filesize
89B
MD586125fafcf3a7c569c9629e77d4f1caa
SHA16aa1981e114f00d13d2109ecd45145de65dd895e
SHA256c559fd909c052bb65c009129ca29ae6cc2023f8446e59ed4bea92e2a35865446
SHA51226d64b9602038495aaee61c22bd81ca1d3bdc1f23a38d6c50ea42018ef3decadfccfb0b882931fa0658a7feb5137cdf4cd6bd62cab19a525e2389753aaceeae6
-
Filesize
4KB
MD55363e77e69e003bcd8cde06f34c3c884
SHA18b364c849a4ea39d402f5b3bcded0166f6b275eb
SHA2562d221f00ad119037fa63cd4e347c6cb9a2d48dc99614677e926cc4b5a1fc6c95
SHA51266be91c3afac037571c7b3a02dbe1d6b29280f45967b10581846750fdc13245bbb08b281014701107bc9e2e0171c855fa21b74379f8e4ff12b7d66cca77a0230
-
Filesize
13KB
MD59086691d3237737d380505930380e319
SHA1705d51d6a5059b42fa859ca996db63f5205a403b
SHA2560d3e3c266198d8f68460ec522d2d3915f487afde3dbbf72a052157b2e13374da
SHA5124ea13554cbb0813df7c398bad1f1a3a8c31dc57cb9ec801ffa386775f1158acd1f62b03721f03e98bee7f5ea5e36a7808db678181abdfb8be83ed4f125fa355c
-
Filesize
35KB
MD5f526bdf426addec5f78065eb870d9058
SHA171062e45cc998965e3d0a5b34661e44f30f96938
SHA256c5be08ce2fb67a7937669cb878134b2832c725ef8f07de7577c150efaad5d1a2
SHA512e00ab343ccb7e5d7d2cf6228c028e89d956b2ee4c3b230d2846a9e73e3b9ca57085bb11746e7ffab50f99a19207e3dfdb96915eca67c1d3585d338724f7988a4
-
Filesize
32KB
MD5c25357a7950dcfc7f85ee9d593cb1a24
SHA16a533712852465ab3c11b5c76004312d6482f07f
SHA2565b70dc2eeceb1963f9c3690c1cc8ffa793b280e903fa9a31780e6a7bb0bdfcf9
SHA51230ca628b17b2a51bd9974fe1380caf728e7826c2bb552e4bc5ac15be8f819e908fc1744932db23734fec64e0f2c758372d8c49d019407efdfb076133c6df70c6
-
Filesize
123KB
MD50aa45a8a1cd24cd2b589e4aad925f35d
SHA10dc29954c4c2ffea4c33af0e56ce84158849b81e
SHA2567a26a473af5eb7a00196e275c86d773f36e1d4caef566f97f1df7e07e20b1670
SHA5127a865b16633c09bdecda34fdf15c62db4f04f2fb8db0abf57563aea51de67daf9eca0c08f053f551937a0c3c7987a53de2454ecb13139a193291633df7262981
-
Filesize
20KB
MD5ecdfe8ede869d2ccc6bf99981ea96400
SHA12f410a0396bc148ed533ad49b6415fb58dd4d641
SHA256accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
SHA5125fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
-
Filesize
137KB
MD56fb95a357a3f7e88ade5c1629e2801f8
SHA119bf79600b716523b5317b9a7b68760ae5d55741
SHA2568e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7
SHA512293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0
-
Filesize
113KB
MD5aaa2cbf14e06e9d3586d8a4ed455db33
SHA13d216458740ad5cb05bc5f7c3491cde44a1e5df0
SHA2561d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
SHA5120b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8
-
Filesize
16KB
MD59a341540899dcc5630886f2d921be78f
SHA1bab44612721c3dc91ac3d9dfca7c961a3a511508
SHA2563cadcb6b8a7335141c7c357a1d77af1ff49b59b872df494f5025580191d1c0d5
SHA512066984c83de975df03eee1c2b5150c6b9b2e852d9caf90cfd956e9f0f7bd5a956b96ea961b26f7cd14c089bc8a27f868b225167020c5eb6318f66e58113efa37
-
Filesize
66KB
MD5e8cdacfd2ef2f4b3d1a8e6d59b6e3027
SHA19a85d938d8430a73255a65ea002a7709c81a4cf3
SHA256edf13ebf2d45152e26a16b947cd953aeb7a42602fa48e53fd7673934e5acea30
SHA512ee1005270305b614236d68e427263b4b4528ad3842057670fad061867286815577ec7d3ed8176e6683d723f9f592abcbf28d24935ce8a34571ab7f1720e2ffc5
-
Filesize
347KB
MD538470ca21414a8827c24d8fe0438e84b
SHA11c394a150c5693c69f85403f201caa501594b7ab
SHA2562c7435257690ac95dc03b45a236005124097f08519adf3134b1d1ece4190e64c
SHA512079f7320cc2f3b97a5733725d3b13dff17b595465159daabca5a166d39777100e5a2d9af2a75989dfabdb2f29eac0710e16c3bb2660621344b7a63c5dbb87ef8
-
Filesize
3.2MB
MD5bcf1478e2217221b21eec151c1799dc0
SHA1d4e92222158d356a59741c14f0d245f98e5b64de
SHA256acd8804789b64e208243881da188f779d90b93675c46917bc51fb2f8cdad725b
SHA512e06ccb12bb8711be990162e57ffba0c42fe7fb30e9478d672e1d4a717de201fd30777ebfc2802425f5390e8dc5036af69f6ab2fc9012184bebd5d47250451380
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
32KB
-
Filesize
80KB
-
Filesize
224KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
10.8MB
-
Filesize
152KB
-
Filesize
1.8MB
-
Filesize
120KB
-
Filesize
360KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
152KB
-
Filesize
5.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
892KB
-
Filesize
892KB
-
Filesize
672KB