Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 03:36
General
-
Target
dircrypt.deobf.exe
-
Size
321KB
-
MD5
d224637a6b6e3001753d9922e749d00d
-
SHA1
bacb2313289e00a1933b7984dd1cbef01c8019ee
-
SHA256
9c67320f0a29796abfb5b53ef2fa2fbcb56b33cff6cdb3f96a8d303685e17263
-
SHA512
08eb7f64f852bbb3403d26a6cbcaa28a5747070b499464bed45b3578fd8ebb31ee97fc15f99a14fab9c01585ba5abeded3bd95aa80c73ce76c5af19bf587c4b0
-
SSDEEP
6144:rHpp6ZEmJSr/49JSpIGOGsX5HWY7ydvxHlcaAy0iWYOcG4BDhnxD28ixv7uDphY+:zuYQJUaGsX7/Qwgylf
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies security service 2 TTPs 4 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables Task Manager via registry modification
-
Drops startup file 4 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dircrypt.deobf.exe"C:\Users\Admin\AppData\Local\Temp\dircrypt.deobf.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZEGqJDzz.exe"C:\Users\Admin\AppData\Local\Temp\ZEGqJDzz.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\Dirty\DirtyDecrypt.exe"C:\Users\Admin\AppData\Roaming\Dirty\DirtyDecrypt.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321KB
MD5d224637a6b6e3001753d9922e749d00d
SHA1bacb2313289e00a1933b7984dd1cbef01c8019ee
SHA2569c67320f0a29796abfb5b53ef2fa2fbcb56b33cff6cdb3f96a8d303685e17263
SHA51208eb7f64f852bbb3403d26a6cbcaa28a5747070b499464bed45b3578fd8ebb31ee97fc15f99a14fab9c01585ba5abeded3bd95aa80c73ce76c5af19bf587c4b0
-
Filesize
24KB
MD51d27a7210f54a047264f23c7506e9506
SHA14116e4e8f34e5e7f3fc6cf23cffd04fb027a1527
SHA256431111e367629bea37db016682c6354303360cd1419c033a22a26115121ccfe9
SHA512077054eb1afbe2fd375d409176b61bdc407c8ef10351b4d00ccdc5c02f87a2f99c319a81baa99d92cd8f0bfd32bdf95b54dc6ea4b288a8dc5d9bec9b08523700
-
Filesize
496KB
MD55cd869d25ed9b70cad0fcd729dbe93a8
SHA118927946eaf87e45ec906c7b0f739205fffa0074
SHA256555f93ff05472882f6f72d44bbbe46f36e323a2fb2d9b7abe6b06010385cfbe4
SHA512fe7827c6bbf76874041cd818645b8af930e23aea55d426f3c436fc521ae93ec6ad32cb99d5f25f5b042732a0280fc0c481e02c305e2a5bde94372fa248ac9b56
-
Filesize
22KB
MD578b526de070a85b6cf6410d013d2a1a6
SHA16403f4013d1c5e636452274fa02436fc64f83e7e
SHA2569a6a19655dc4ab926544e1f1da8750f4119ca615ac73e2c4da9ef4186e6a9e2a
SHA512e1418a6fe5acbcdda7fddf41835e6d9973ddfbf8c2b36204b53a8733ba1078b63aae28d314eb51b90e0a43896b803ca4920bc4ea6bf8bc18b0650e2cbf32226e
-
Filesize
1.8MB
MD555931f508169e2e57ea9e1fe0c0e87d1
SHA1612f3b45efe3162130307d7fe3dfafb8f3bcfd8e
SHA256ac71d5d33cf3cafc5ffc57265118fd5d3cbc5b895681245c16faf49f14ce9a56
SHA5121a94083a6fd1116a9b65b56fcfe3ae7b46f2f5caa8a35ee33630e46c6a0ec48c8add3ac6ffe2b4709cbba19c8287040d7fc63b7229fa558c715be58961e67b80
-
Filesize
1.3MB
MD5baf2faff2c457dff4872bb6bb421004a
SHA15aa26906097a18d62c69daba985cd0f72ffe3b31
SHA2568494ac3bbb2c179bc191e4e73145eb8b2b79e156e2e331546dae155a808827e3
SHA512434367c313dd1e27384858cea0e39d6534f5a94e2b81406575c5b308f4d70e692221a43acb4e31166a4683f3bbffc4359bdebf6f818d686187d449e54a6ce559
-
Filesize
674KB
MD59da8b164f22bdb22f184142e1cfe1cb6
SHA1f480bb1eda037e838df784609fd0ac3bc77565a2
SHA2563f13673feca10f32155cce12590601de9b14bc7d4e2f911e8e5af994690acc6b
SHA5125b7f4607dc315d47d8cbb44d70082773071cbcb267ca51a40817be8607ccf1a415b37e3467eab7e23078d3612e3e33222b5e723da49df57e95f65aa47f5db0d1
-
Filesize
774KB
MD57f8895f63bbfd4693eb3a190e941e4c9
SHA1b5ca49754a588b86583e262a75ef7fa23108df29
SHA256f92dd76f5e53816cbf1070444520cb5198f5b47c600bd4a03d20ccf11bd3f2df
SHA51261c924f26c54898fbdb3ca9aa6c3ad0d6bae610386f3bbc2dee833554359d42c0452d6382618915eae65a69e138a7903082c960404438efabb8165374fdb0f0b
-
Filesize
1000KB
MD5bc2a99d4fed8fce68e5ee04c2ef762d8
SHA1da216639ef63fe5f02320024d1895f38b860e631
SHA256d333a98377a8eb3ed57cf88d616959a394d83ac53dd866ec8bd54ed10aa02ddb
SHA512a17c87e81acc75c5ebfc2feea61f8d6518adccef8db10cf9567bfd5fb63d153b5300f6edde601c1fcb8250ac1023a3231e567605e36f63173a077a3513a70f61
-
Filesize
30KB
MD57fb0e9946503165c130615db7a4f28fe
SHA1f87b0a82e019088a0f69662f16cdf0e77d9ba1e4
SHA256f3cac6ec3b761436663adaefad6b4b73c6a1a40b5a2d364973b25b43c27a2bef
SHA5129b33b0563972c92c3e6a6722dd71b55ffebe95130d1cebdf3df0a00a014e5b41dc657c71fc38d6142ae9b379ef8dc8634977bceb9a2f4e0fcb4e0c674bc400f2
-
Filesize
730KB
MD54d76b46a325f5b9b905f90e3a348a936
SHA148522542ec191d967d2d172fac14ebea4a53182d
SHA2560bd416bb32df60b7c2dc20863512c76cd9cd5c59a0f5d489807e3d819cadfa91
SHA512f2c206a6d9b6c116ed008e9b0f4ba5ee75fa7919701cec2720d36736c8206d58ca056cc0ffe7b6566dd0b56f28cba36bdb717036871a19607dd683731dc6d706
-
Filesize
586KB
MD55d812c5cd71a5138ccc14b90db5d19bb
SHA1fb53724c8c9e87300c60e64248ef77ee2d0348bb
SHA256d57bea2ff1395e34662bf68b951a7d8cd1abd742f24f17e2e5358040d3b66f56
SHA5128fb745044652ed242407c974bdca86646695fe44c88f533520c75ff8b81a08493dffbd4e02f13481f903f2961cc54641ba0abae23a75e0d411d70104f7432c62
-
Filesize
1.0MB
MD5a7b3504b51d9c9ad922cfb68fab066ec
SHA16f571660f7af85584201dfbc5b937d2e73d1d5ea
SHA2567cd40cf425416f45a9c764b71eb548b7e9e0470a1e18f220997e0a1bcd62251c
SHA5125d828c68ee4709ae70f9f3a7a2b7acfe2058a485dff88c8475bac4f14d091f32a5ec931714ce0e718bc83ff5c1ab86ea6134fd668a9e80f75eb3113cf8bc3e8c
-
Filesize
986KB
MD5e5941e096adc9dee7df216a2571da334
SHA1022917d9e0e2640c9b1105ffd16afb5435f41b50
SHA2560b6b2f585a1005570caa4ceccc71ce8940310cb77629a83ca8ed236a04c1aef4
SHA512033b2c21e7b63e352e48c35b4c46788e7cad0dd022be0fc792ee440df2ce0b7df0f3bb06bc54173e4981a801309c837c459853252cd96ab8fd0fb2ed88687446
-
Filesize
1.2MB
MD5f3aa0c84cb7d2aefc20c49f0d59184a0
SHA1d29dd7dd912c00e5f05a9cc4f04920814f3c4f96
SHA2568b1192569bef499da82ff8fd0deab26d7188d6c0c1c7a6859f2affbdca635cca
SHA51298e27369f4aa3430e1a69d841917ff42b7132ea0f583e16500bd86dfd76b3528d7d43ac31951bb4bdb35bdd6bbddeefe1f615819d058c50fe62d03c30107da46
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
