Overview

overview

10

Static

static

5

17ddb4edf5...04.exe

windows7-x64

10

17ddb4edf5...04.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24-12-2023 23:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17ddb4edf577c9143cab458936f7fa04.exe

  • Size

    512KB

  • MD5

    17ddb4edf577c9143cab458936f7fa04

  • SHA1

    3fcb06b9c98fe4d8aa4778c33a76353bcbf2af15

  • SHA256

    0f65f212348cc045f8cdd39ac4a2a63f626841eb02e7c50bd73b62567befcc3d

  • SHA512

    bfa99ecad681a5360ec3f2083b9640329a7d7f849173fa4d6c12f2526f9da29dc1dd9ce672f8e3c3cdd4b096559c9eb5f17187a9a2e8ed587c313437ce063a34

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm59

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17ddb4edf577c9143cab458936f7fa04.exe
    "C:\Users\Admin\AppData\Local\Temp\17ddb4edf577c9143cab458936f7fa04.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\SysWOW64\wtyyqxsjev.exe
      wtyyqxsjev.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\mjtwymxr.exe
        C:\Windows\system32\mjtwymxr.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2944
    • C:\Windows\SysWOW64\xjqgamnvpxbukhy.exe
      xjqgamnvpxbukhy.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3020
    • C:\Windows\SysWOW64\mjtwymxr.exe
      mjtwymxr.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2716
    • C:\Windows\SysWOW64\jbvzbelaaalxe.exe
      jbvzbelaaalxe.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2808
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      f160735721f2e243f33c5f9f6fbdfd48

      SHA1

      1d1e21a1e25fbddcb6fe92f1b6c0eb6f6cb6ed5c

      SHA256

      bf013f7f0860fa836ff027afee4457944af31bd039e3646e44b53fb55da5aea6

      SHA512

      70bfbaed7e86208251ffd3d552b288b4c211290be288fa62baac24f5732a2ef973faa16620f632eb34f73bbee4f10e7571a07274b0b75ed490a9fcd0dbeebe54

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      3a87d3e90ed79fa1f0c23f40f258866e

      SHA1

      5224d422ced6fa04a928d7b04f97cbdcba67f6a0

      SHA256

      ee93d94700d926d80ee8c4e3593082d23a7947091e5c70a6e131186f893cca81

      SHA512

      a9dbaa934103942670a345882f7fb837192621e6769bd25924d95e173227cbbf99f2f0c5e3e0ecdfd1418e9d7e8c0d56b18a13c1bc8fc57f4239b8596f4bd8ad

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      29df83496d78af93a9b9098095573345

      SHA1

      96ffdea3b58cdc6626923079ca9694ce121ec813

      SHA256

      8aae0a4496f3d57c1cd41de14735584560d14352546aff7560ca843a3ac7eda6

      SHA512

      ddf3452e39c198130b19faa9e7aaad41444937b6dba287ec41b2cca630563a201744f261631e172f47812b53010fa741f8a3efa25403424163029e776d0da823

      Download Submit

    • C:\Windows\SysWOW64\jbvzbelaaalxe.exe
      Filesize

      512KB

      MD5

      1b34aca2fad745062c7111f3ea6d8137

      SHA1

      6dba785a412890a5cd4b8d0c1846410fe3170772

      SHA256

      10305108e38fec20d55e7916e07db7a1bd7bcb763a776ef230c8202101eadbce

      SHA512

      08ef53ab7d52eb68d5a3256b750a4ea4a37c11fbb07109831e41ef0bd454b9ea75936064d8a5474dc4c150fad1563d59375e79c0295a09f460f9b85c53269c2e

      Download Submit

    • C:\Windows\SysWOW64\mjtwymxr.exe
      Filesize

      512KB

      MD5

      427afd2b39902f8a6eaf14c15f52a751

      SHA1

      162023b5de3996c446677e0b8bf8ff9bd32f412d

      SHA256

      d21818f823bff3991524d29d448f946e94271f35313f083cdc25db2be099267d

      SHA512

      d9526966ce66ac914d3c43eaef3ce1a69c8dca551e84901235ba27cf46b75a5f8b8109e33ad14f008336562db261cba6007520f203f22c68766b3c00b755e621

      Download Submit

    • C:\Windows\SysWOW64\xjqgamnvpxbukhy.exe
      Filesize

      512KB

      MD5

      15e93c2312ded587870cea7411d17b4c

      SHA1

      38979cfc6d51482d1e4547f2edf1d473142e240e

      SHA256

      297e476a015c547c5db6f58a3b356b2552d5e9d67a074ad61b9f10dfc70434b8

      SHA512

      429c36cf6bcc1bd7c0b101b09821ff0fe66b50ca880b338b1882be30f2df7a7231d44f6373cffd1263c99b62ff054643b84163d38794865fed095be319687206

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\wtyyqxsjev.exe
      Filesize

      512KB

      MD5

      5d5183d1a48ed3bf262514c8f6e419c5

      SHA1

      c65d5fed969bbac028e64112f7e80a6946ad7f80

      SHA256

      307cdf1c3de38c66ce3a90665313869b45a4e3933c208a5197fe42c8b56c9f5b

      SHA512

      82c01cfdffbdbf3684ee9dfa9099f827992b92ec16772f84d527ddc67af01a3de3216808ab1d27b2a1ecd8b641a76e43fd7c18c67de0bd7a6828555be0a2eb13

      Download Submit

    • memory/1860-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2156-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2156-47-0x0000000070F7D000-0x0000000070F88000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2156-45-0x000000002F061000-0x000000002F062000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2156-79-0x0000000070F7D000-0x0000000070F88000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2156-100-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download