Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 17:08

General

  • Target

    077c08440d185e41f6c1c9d0abcfb34e.exe

  • Size

    512KB

  • MD5

    077c08440d185e41f6c1c9d0abcfb34e

  • SHA1

    7df1a0dfb46447fe888a2743cb7c25815abb68c7

  • SHA256

    73fc40bed08500c75b018746c1a7307a0c03121ef8eaf65ad713b6b2281f03e1

  • SHA512

    0a75a98acbb4ebe5201ad614384b598ae025baf249fcddc5db92799c69d2eb65df0b51cb8dc1d794bea447402228e9d67dcb4a9942f819cf9f10656f1dce43c2

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6s:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5l

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 18 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\077c08440d185e41f6c1c9d0abcfb34e.exe
    "C:\Users\Admin\AppData\Local\Temp\077c08440d185e41f6c1c9d0abcfb34e.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Windows\SysWOW64\bmiaxkbvpu.exe
      bmiaxkbvpu.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3876
      • C:\Windows\SysWOW64\igtznmgi.exe
        C:\Windows\system32\igtznmgi.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1492
    • C:\Windows\SysWOW64\igtznmgi.exe
      igtznmgi.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4236
    • C:\Windows\SysWOW64\irlibrupkltoc.exe
      irlibrupkltoc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1176
    • C:\Windows\SysWOW64\ryubzjmvgmqexbd.exe
      ryubzjmvgmqexbd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3808
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:352

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

          Filesize

          77KB

          MD5

          d950c999cec7245a92fee00f12165822

          SHA1

          b8e6ddf3d63fd987f537e866b8d847bae893b235

          SHA256

          c4b514047785439c01d7903cffd581016b89943ae6796cb9ba4e7a7f55e71237

          SHA512

          a7f554faf828b4807117e846458f98d06416e811685dec654cdc6178a0096eeac40364060e4b845875f3161b8072b5e7d2909ffdbcb842da59693e4baa1d21ea

        • C:\Program Files\WatchDisable.doc.exe

          Filesize

          15KB

          MD5

          c838ec47be2f5492708e6d31c7f15b62

          SHA1

          69e7e96409290b4358d1b7218b47e13ca2e288d0

          SHA256

          631176e48788454341d6b284f83b1586b72dbfb37f6a45c08eddfe202e05f9ce

          SHA512

          b9f8c8fdde86422a86d8f56939855d13e644e313d4ae3051649ba4313b06824f4ac3f70c5d1e899f0eb3c3733d15e17d65aa612db5e98321ab17cc415e54abed

        • C:\Program Files\WatchDisable.doc.exe

          Filesize

          14KB

          MD5

          50b815ea825ded6c0f813ceaba7beea4

          SHA1

          8dad0ca5371c7279fd0a9dcd6d20468f6ddfe543

          SHA256

          a4bd7252e940a597caae499f2135f947c4df28f62706eb4c4b3122703ddcb26e

          SHA512

          821a9ddc7a7603ec7e7cad0c1b90e5af9ce101d744feeabf4d3ff7c9e49ebd376ce0916f7de26d0214f57f1e8ea6caa4a3d17658e96a5b3617e8d388d21d6bb7

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

          Filesize

          247B

          MD5

          1b529425a37b1334b8b33ebd890269a4

          SHA1

          84768e6475b45e3431d5dd62968dde9b92bcb799

          SHA256

          774609fb895e024729e533b8420e732453a0f7ad9cc4599a871157b4f2ca0440

          SHA512

          8d82cb100fb6e979061a2a86aedf2f77de9bb5abf4431ed7add5c75d04988a3cd747119ade26856e8c2fdf7fe75e6aedf0025f2015e525b6835c80cfa2eff295

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          4403556788947df6942a1e498f157d97

          SHA1

          17a0fcf8625819df16b2debf87ab10219d6a078e

          SHA256

          7023508c6cf9c7f040e4fa5e0171e5eea1740237278917d683adecd4a86e1cb3

          SHA512

          499947dca754e88ade91fe00d173dd3d294f4eef3318db49228648c8604180c50811f64d99e7b55e291257013a56106fa8d70f64c9e908f8025bfdb806a36ed8

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          45883cf8e63fa654dc982916f4711cee

          SHA1

          bc9e37fcc06e98e2de0dfa88ae924cb6a3cde790

          SHA256

          b4fc2e21dc42d281e93801403c1e408c4b7d9291dc68c32741b9f49df62f9e02

          SHA512

          385692006f67bd142f2d58cbea2e6a1edec6d8c249de466ae3bfb7d733c58dbc369872b37f0a2fb086b35240c60adff0feb91f21dbc26080d96aceeb708725a4

        • C:\Users\Admin\Documents\PublishLock.doc.exe

          Filesize

          152KB

          MD5

          c02a0c310c1213fa845b3314f14a946c

          SHA1

          ed40bc7bd11f181a5742f8ee205252fe02989a7f

          SHA256

          3f3eb2b19497bb6cbba9bcfa5b624713551cc12ccb6beba5a10bc4fec9f01c84

          SHA512

          cc4c86669f111a86e2449271caa527e7f10fc3baacf675d987c3f19a2d3a8f6b2653ef2eccf2fff63be3d217092da4a6d7d0c2ecdd60b1f69f17b10a8ec93165

        • C:\Users\Admin\Documents\PublishLock.doc.exe

          Filesize

          189KB

          MD5

          f4f580c3e9b57e498b3d7414121af10c

          SHA1

          3967e58043b1155430726bcd7b57d00e8fac09f7

          SHA256

          002e5c8b7fa475b312b7151e6427beeaf6ec395e332adde311e025307018d457

          SHA512

          79b70f918f3289468579573eb277fb0129188e81686c900b60ad4548176e0f290cd5daf49b18e0a0db908f6d0bded122815a993e08c9ce7f8fb8787002482356

        • C:\Windows\SysWOW64\bmiaxkbvpu.exe

          Filesize

          378KB

          MD5

          be5e7b55b31f83fba5b46684b1c37745

          SHA1

          cb64da5a4da56b3116740a9ed1c58c6c266155ad

          SHA256

          7f9481f3a56e6b824b4b1889796005b777d49f216322de753cb0fbd8f041248d

          SHA512

          9fa2331a696a4545e68fbef56fdc7bcafa1d9a637667936bd12b5ad87fc5614128881e3c84c799505b69ee37afeb05fc8e32d2985a2ac6e9e59aa364bd7edb10

        • C:\Windows\SysWOW64\bmiaxkbvpu.exe

          Filesize

          374KB

          MD5

          48ddaba6597d9ca2d915884d2c477c83

          SHA1

          8c625a8a70a5996cd0e08a86eedbf38e0a681591

          SHA256

          a73766952ca2b712d1cbdf245a22b41f034329919a74bbafa5ab6a636617e3ae

          SHA512

          7e9eb162a780041451be6f8616af111618f748cffe838c3ea7d3668e89a135098a90d44570f5e40b2bc68b0d5f9eab176b4a702a0bed4d5302111d66d906b45b

        • C:\Windows\SysWOW64\igtznmgi.exe

          Filesize

          385KB

          MD5

          2d71deff4ec17cd705b8e3e1f6954fec

          SHA1

          fa04171143eccd57fe7a51596e5ef7900c0b3647

          SHA256

          1ad68fb94400fa42aaea2db51971a1066c9f5a9f9dfd1e7ab0d7fe2122d5067b

          SHA512

          693e989d1be41702c26666065fe8280d2a9884b41d4c196c3bb1ed1a9c0ceb821a306b9ddfff12d63f232207c1b1ec33b0b31b54d79b030aeb495277dd823af4

        • C:\Windows\SysWOW64\igtznmgi.exe

          Filesize

          341KB

          MD5

          89c7356a144a648a08b4101c1e3cee24

          SHA1

          0d9924907c169cd9e68ba292aa8869c0a9c054af

          SHA256

          1f2d6002e6a618ae7ef535c0e45bdc7548754d47e39a13359ff41f0843ad3436

          SHA512

          68aa18be29736ce615971c0c3265263bc1dd6026a250b720144c5df5bcf62bd1dae37a314902bf08a7a1b2a07c3f3bbec5bb97fac607c73069259232f00485a4

        • C:\Windows\SysWOW64\igtznmgi.exe

          Filesize

          279KB

          MD5

          8df9a3bff4590024e460319444010e73

          SHA1

          0f1bbbf95db6e36d75b8cdec0df792538e5f7857

          SHA256

          58bb14778ccf6a39ea0daf2d4c2c11b760439710498dcb3f06c5c160996bf04c

          SHA512

          79b7c250b9e8bcf7768979014cd109a582c4e84c6ad9f95d6b401bf9084f91ecce334fdba68475f024d328180ba1faa62645832a30ca5c0f6e2d32a4f2870b62

        • C:\Windows\SysWOW64\irlibrupkltoc.exe

          Filesize

          472KB

          MD5

          4ce92dab7634bc473ba5fcc10c99d777

          SHA1

          5a74ddf751cdd3540e454baa47c651e84eb83a8f

          SHA256

          dd706e6114ad8d6e01054646fedaafeb93e97737e970e218b3fbc10aa1e4915a

          SHA512

          b3b05c73119811c65c6dcd6b2b6f075353a1c4d757c0d0bbc78d3a040d62c7a7abd7ae3d7162e873f7ac8b35d0ccaab6e11f070a45684a66cfa690f181cae6a7

        • C:\Windows\SysWOW64\irlibrupkltoc.exe

          Filesize

          280KB

          MD5

          436d50f5069c264e15b82e899614be27

          SHA1

          4cabfea2b81ee2060a54e4c24cc5ee154b8d81a5

          SHA256

          b6834009428a35a95659e487eb5d655e2422348ff2e705a9d208fcfa36d3fda0

          SHA512

          dcd7c92be8d908ba008bf27421c30d82042c9c372f53b01de3d8eba79b56889da41e76f863fc9c668349390733b5412e5265f1afe8c65037df389a35936be38d

        • C:\Windows\SysWOW64\ryubzjmvgmqexbd.exe

          Filesize

          385KB

          MD5

          b2c0dacf197cedf71c702edfad4e9098

          SHA1

          103400350a20104dbc549fca5e869755ced0ddd7

          SHA256

          a5aaa77c9b3b2b58d89a45228070d4014cdd4b8d9fc54748edb73737c5b29559

          SHA512

          3fcb9967380e6a18b13522aafe8ced6a1c38ffde8e5e4c4098b6854cc82ee998994369990cb0b19536543a4d43e6b82807d72d6e8e06f81ceb332e769d7ae287

        • C:\Windows\SysWOW64\ryubzjmvgmqexbd.exe

          Filesize

          414KB

          MD5

          2d6f82ebcb21ea5fbabb62559b73cdcb

          SHA1

          54d98dfc3579fa38fe4b630e99639d97154efab3

          SHA256

          6cff26b04a80d18c0e17cc9be0452e9a0f001629f6f634df793a085af88a2f3b

          SHA512

          5326943a8464d0dcfed63749033f579f8c10a0f457e82958c05a190d9af4f468916b3ffaa276becd404020cdf4c8cd52a4c8d4f7696637df6e57d71bcaa3b1ef

        • C:\Windows\SysWOW64\ryubzjmvgmqexbd.exe

          Filesize

          512KB

          MD5

          92ce6749cb3f9a1920eceb8f78127eee

          SHA1

          cf2c77d95380b31bec23129e34a0da68fabd80ea

          SHA256

          102ea49f9d958fc3a54e19cb4808b5b64ff284774a124ef0c9b7b75ae41ce462

          SHA512

          1f76f6f74de079e21130df90d2d9636fe42297fad7d5dabf426fedf800c9563a6435a6d9a11342da3df7b8552cf1eed1d1aa2c06a135310858ab66fc6a235e3e

        • C:\Windows\mydoc.rtf

          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

          Filesize

          37KB

          MD5

          33212000e3788f38392adb080d56a10e

          SHA1

          d3ce2df4cbc424ba4214cc1988c9a1577d34dfb4

          SHA256

          4be0d85aa4ac4eabbf0571f722fdf3d034008a7a07ba6c7b062f01e85a237ce7

          SHA512

          b7664cfed9137cd9c858529210d16a2add1865eb6d8d857e0391ca44f31da6f86e7cb95f5c138f6ceb4122b90955c9c22854dccaf2ad13ea67be06d628e1afe0

        • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

          Filesize

          205KB

          MD5

          751a4ba20a5c93cb15b65744a5efe521

          SHA1

          0d58ef664bbfada98cbfc8e80480b9d6cd34d83a

          SHA256

          c1b1dcfca7ba6fdc435ac429daf55959bf03ceaea8de73a10b767bc41dc5d908

          SHA512

          6779994f453efe6736932505bfe60985cd038185bbbb668a50e9d244f7d7b8dd1ef5ef348b21c988fdcaa15057b505696ce5c8a1a173c22ab0298ddd7d5d6276

        • memory/352-49-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-51-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-55-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-56-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-57-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-54-0x00007FFB6E4A0000-0x00007FFB6E4B0000-memory.dmp

          Filesize

          64KB

        • memory/352-53-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-58-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-39-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/352-38-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/352-37-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/352-36-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/352-35-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/352-41-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-43-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-52-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-45-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-40-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-47-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-46-0x00007FFB6E4A0000-0x00007FFB6E4B0000-memory.dmp

          Filesize

          64KB

        • memory/352-50-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-153-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/352-48-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-44-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-42-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-131-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-151-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/352-152-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/352-154-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-156-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-158-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-157-0x00007FFBB0A30000-0x00007FFBB0C25000-memory.dmp

          Filesize

          2.0MB

        • memory/352-155-0x00007FFB70AB0000-0x00007FFB70AC0000-memory.dmp

          Filesize

          64KB

        • memory/4992-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB