Analysis
-
max time kernel
600s -
max time network
581s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
22-11-2024 03:25
General
-
Target
dircrypt.deobf.exe
-
Size
321KB
-
MD5
d224637a6b6e3001753d9922e749d00d
-
SHA1
bacb2313289e00a1933b7984dd1cbef01c8019ee
-
SHA256
9c67320f0a29796abfb5b53ef2fa2fbcb56b33cff6cdb3f96a8d303685e17263
-
SHA512
08eb7f64f852bbb3403d26a6cbcaa28a5747070b499464bed45b3578fd8ebb31ee97fc15f99a14fab9c01585ba5abeded3bd95aa80c73ce76c5af19bf587c4b0
-
SSDEEP
6144:rHpp6ZEmJSr/49JSpIGOGsX5HWY7ydvxHlcaAy0iWYOcG4BDhnxD28ixv7uDphY+:zuYQJUaGsX7/Qwgylf
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies security service 2 TTPs 4 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Disables Task Manager via registry modification
-
Drops startup file 4 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Windows security modification 2 TTPs 6 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dircrypt.deobf.exe"C:\Users\Admin\AppData\Local\Temp\dircrypt.deobf.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hvuZmoyf.exe"C:\Users\Admin\AppData\Local\Temp\hvuZmoyf.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\Dirty\DirtyDecrypt.exe"C:\Users\Admin\AppData\Roaming\Dirty\DirtyDecrypt.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321KB
MD5d224637a6b6e3001753d9922e749d00d
SHA1bacb2313289e00a1933b7984dd1cbef01c8019ee
SHA2569c67320f0a29796abfb5b53ef2fa2fbcb56b33cff6cdb3f96a8d303685e17263
SHA51208eb7f64f852bbb3403d26a6cbcaa28a5747070b499464bed45b3578fd8ebb31ee97fc15f99a14fab9c01585ba5abeded3bd95aa80c73ce76c5af19bf587c4b0
-
Filesize
24KB
MD51d27a7210f54a047264f23c7506e9506
SHA14116e4e8f34e5e7f3fc6cf23cffd04fb027a1527
SHA256431111e367629bea37db016682c6354303360cd1419c033a22a26115121ccfe9
SHA512077054eb1afbe2fd375d409176b61bdc407c8ef10351b4d00ccdc5c02f87a2f99c319a81baa99d92cd8f0bfd32bdf95b54dc6ea4b288a8dc5d9bec9b08523700
-
Filesize
21KB
MD59f5c80903acba638dd3378dfbf1dd4d8
SHA128497eb0083eab2fd2333d1ec416991d94b60647
SHA2568e336acd36fa58c52bb0e31d74c05798ec5ebe32a03517109888cf4f36608386
SHA5123d56d5505843e7209c349426d0ec4a20474ce7baa296981e51a2d25201a291fa71043140187ce237614ae0f26384630ca899199eab1c88931e08f34fb4c1ce9b
-
Filesize
335KB
MD5cb54fdcec39b06b8a0d8ad9a7d15277f
SHA1c132d948b9eb84218146030a242be84dacaf0164
SHA25686237bb49cf8e599d0ed25888f52824c0252769e11b6ab1469ca6514bba16b48
SHA51258830d9751172e47700adc47dd35cfcbc322439c6a1b89510468eabdfcd1413b6d59eedfb7d896336f40dc3c2f862ea1cccc66095f931c41fb6633fa14b2dfe9
-
Filesize
34KB
MD54446612912a5ec8d5d8cd95f9509ce70
SHA1366a195c1a924229370a4bd8560a6e39f3cc8aa4
SHA2564fc6806875418bead9760fb9c509454187fc27010e992401cb517302cda3503e
SHA512c3c9a12f7cf45e0e4d31176bf4d2114a7bda022f73a714f06fdc1935aa913e37dcf2d7b920bbbaacf79bcab2f6e3b72f455b123380b1f26612796f630963b723
-
Filesize
771KB
MD5c0fb2b2ac91ee80444a2e217a06223e2
SHA16d175d49a3189d166e8872879460c700673093c2
SHA256d609444710b4d168fe9d73c553b5b3bc6d7365d955626e4974b611b042c8c186
SHA5121a8cf8b33edddcdecfd245b4a8b0976bd8919dab71b436c3c0fe7f1434a3d237d056c4877cfb171bdb6283c78305b97ea6a95615b946ddda2ab866718293f40c
-
Filesize
681KB
MD56d6378d05a3007f8832799060d9fea65
SHA11c43561323710792bf743093e8e7fbaecc78d6a9
SHA256da15ef2a93668ea7018378be023e5935d8532238af6213ef7afb46d863d1bac2
SHA51298fcb18c8df98760478acb35b8ae5e637eb87522224d78e2c6a9d258b587f3c2335dda0a273424f573227ed4df252bd79156cca11cb663ded1cb7fce3c9cb1a7
-
Filesize
585KB
MD595d34c5a89e4c47af4091c10204ef64e
SHA1808bbe8f54d5d1074a7c7cbe9c238178238aa43f
SHA25653b53dfa2935552953d3dd3f3faedec83b21072c431486e2656b5df999a1e697
SHA512df008ed997949756dc0bda7ade5015b0352ed7a0a17eb1599c7ca9b6ffd5f2a512c592fecae1bc8f0f92737fb55251f7133f16d681b3989d7221c4408c9bb66f
-
Filesize
482KB
MD5cfba4c7fb5729350d59b76e28a94392f
SHA167f66f41d581e5f69cc87c88ec24707625afc180
SHA256fbb11cd10f2dfade3409743102b87cf8c5d58a94f6060781ab3bddebc2ec040e
SHA51215ed14139385bddfbe7a76db78ac60f2c30610f0fcc8a208bf1e6fb4c492588762ef95cb738cb70dfc31a97b222c358c2b2d7092725da7366a728adf363b3661
-
Filesize
401KB
MD56ce6ae1f0d89cce9550fef820039f565
SHA1d1cf05034bafdd9de877218240fcabed1c33ca0e
SHA256f10a43c8fa4acbd67533d9aa43d39a79b541ee09d1e093b640499213bf137a7f
SHA51277fe4910ff5fdbb76733b2f6b007f3600fe3dff9b7c6a715d986f3e6d25c90ca0921cf1892c9f98c93c062a52b46c2a3849879adf91b76c137b10c0200b856a8
-
Filesize
1.5MB
MD5285ec44441eb5fc7786bb15aee6d225b
SHA1d14c09ce5374212ced30a15abfe87d52f1814200
SHA2560e4f15361f21eaf86a9fec68ca0235c85e2084cd368c12d219591df35f1bb711
SHA51207df721b34b21789aa3a4bbb4b357bf93ada104a937e04bf1c4f44a781de3e3662d7fdbbb02a4c4bf5a9642d7b4f264952f95af67aa5779187efcc82ea2e795f
-
Filesize
433KB
MD55267c8ab6be78c8b0c850382fbf80b66
SHA123fb9aa85c177e8bd204619f9e743cd3c6bd8777
SHA2565b6a8591689486e39e2b27e6ac0270290655b09d2b2368750c6173079fe823e8
SHA51222c3cbf3fc53688a47fb54040a50b9fa6e9b851e2b3100a440898bbcbe13a1555a614082436c36dc32e29a46822dc263f50f5f6f38b48dfef037d91c7b5f4830
-
Filesize
417KB
MD53759f2af5beab4c66a061a6a46e5b2dc
SHA10eabae664d3a38ac57693dabafc75f80b144bd51
SHA256f5b0e654f76eaf7c376e11309ea94807d4b35339995b70a564dbf3e092152132
SHA512206ce46f187be0df586c1ba48fe0c9c35cb271110767627710e6b99b87999425ebb95ee095d2b820647f46c8a4cab274f7d21c2c8ea65a214bd21a51e931a436
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
