Overview

overview

10

Static

static

5

439808b3bf...90.exe

windows7-x64

10

439808b3bf...90.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 23:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    439808b3bfd56a270b6744063badf090.exe

  • Size

    512KB

  • MD5

    439808b3bfd56a270b6744063badf090

  • SHA1

    24c2201f7589f6bdde410aacde3ab5f9b4f2ffe4

  • SHA256

    2e1510d673833018d11c82a31f01dc18c408ea701be8c097d2fa9a97287d83fb

  • SHA512

    76bdca7cf45657fd03058fecf89b4a7d080d9fd65c9b952fd2cc3b00c1b179ee13f17a6cb901daf2d58999b8c3dc0daaef148f7c19292580662e7b8631f1a61c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6g:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5Z

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\439808b3bfd56a270b6744063badf090.exe
    "C:\Users\Admin\AppData\Local\Temp\439808b3bfd56a270b6744063badf090.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\SysWOW64\mzqglkdnjs.exe
      mzqglkdnjs.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\paayclmr.exe
        C:\Windows\system32\paayclmr.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:784
    • C:\Windows\SysWOW64\ebrpbsednolzifu.exe
      ebrpbsednolzifu.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2700
    • C:\Windows\SysWOW64\paayclmr.exe
      paayclmr.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2712
    • C:\Windows\SysWOW64\tayfelszsgygf.exe
      tayfelszsgygf.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1112
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2648
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1948

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      437KB

      MD5

      14ea4ac44b5b284ac09c7b257f448a53

      SHA1

      0a1ad2ac16c05798a784873cb88f4d804f46385d

      SHA256

      0f8cb33f93bdb5788ec5eddbc391f593c2ba8ec2beb8059d82779948992f6803

      SHA512

      297377a2d831793856912d72f8ad99a0bfda47ee7e1538a88a1920ef93300be3fa34785468bdc1d97f79fad64e9cea67484626fc39f48db385459ff6485e8f62

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      433KB

      MD5

      423c1dc36310fb4dd642a3986e8db863

      SHA1

      bb077dc761d6f3d079069423865f02049896fbcb

      SHA256

      6819f2886de3f9ed66702defb02e9150f970be70c60efed8faf6128d9d05c1b3

      SHA512

      69d253c728edbdb91f3da8f6bc826a73007353aa958f1d69ad4d0aa25ccc36136fa28c3ce02057c87e40be069917225c66f1f891d7639cb3882d3085043cfba9

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      355KB

      MD5

      1cffe42db6f1ea59c8d8e15c09d9cc15

      SHA1

      c2c35c19ee6f5978f75507a08734e22a4161fcad

      SHA256

      882c8b2da8f123beaf5811428d262595dd74dc7b334e009c580fc27572d4be2a

      SHA512

      a7d11980667b94ea6644b5688be3b1d9ccf64826bb88833c066da1a927df59bba43dac64b7ed8e49d02b7617e2808d4684800ea45298d1a873cccd0f32274b43

      Download Submit

    • C:\Windows\SysWOW64\ebrpbsednolzifu.exe
      Filesize

      512KB

      MD5

      fde0e06f3d700c865cc945f851fa3556

      SHA1

      c6eb81e498bb9096efcee47681052798bf2fe9b5

      SHA256

      ef9ef23ecc7335817fba273d043fdecc517c215f5490cf0a2429458c2a94d078

      SHA512

      7dace5b2490bf1641c5975ae57036ad4fd595117d917192d624dd92da7446478569727fddadd239011e9a0b6dda215547643257be4ec586655f85829e5175e60

      Download Submit

    • C:\Windows\SysWOW64\mzqglkdnjs.exe
      Filesize

      21KB

      MD5

      ac5545e508be2b57274e428efef7de2d

      SHA1

      fbc06f1274722a715754d3c59ef2ee701b86b3e2

      SHA256

      e417916028ae1a6ad61adec0fbc7717af9cffcf4511dcecfe7f445504f430908

      SHA512

      730aa1c2a0f8baa81227e7997739c3cdb99680518bd5a7a925e13cdc0a097be713cdbcf81332ce28b0d466944460afd8e2aa6ae1a049837a9dbd4cfee7817e54

      Download Submit

    • C:\Windows\SysWOW64\tayfelszsgygf.exe
      Filesize

      512KB

      MD5

      fdfe3f55a8bafdc243f40b6ca62ff668

      SHA1

      a967901f7d0590abffb668a27fb6beaeb6df2d1a

      SHA256

      5c12e4251494f77bd7d3513e01a2dc70b88e82793cfae12a452c9c3d552b58a6

      SHA512

      6a57e293a70b2dbe924ff24de847af698eb04ebfc8aa51ace5a3cae69999c652cb0a2ce42497f4f0a0f2ef88e7608b7633b457c6709592695f64b9705d122e67

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\mzqglkdnjs.exe
      Filesize

      512KB

      MD5

      f122f9b86c1c7d3473062b0645db174f

      SHA1

      e3d47c3fc83268e6763b741d573b316aa2c8bb88

      SHA256

      67c6317e4a8cac9df7555c622c9d1aededba5e4c465259f8e51b2ad4612b28ed

      SHA512

      c819f7f69707532e827fe48c1bef61ec370606725258ec561f224ef93726391d82bf61918e155aabcd2933d2517f072ec231562d32676c45b295d0dc2c273a54

      Download Submit

    • \Windows\SysWOW64\paayclmr.exe
      Filesize

      512KB

      MD5

      45a0745c317b7fcff75ebc16ec12b24f

      SHA1

      ff7ad37d23868b655c430a423606c4f47eda0ff4

      SHA256

      3ddfaa3862260d32a651682b682f6851b343f3028171b0d36949024ee430436e

      SHA512

      dea4e1409f0bdf6bf81b60993072492aa21ae75d526a6f44f63d23842b5041abf950c01d5afaaf5e0de40e0bef2f745b31288ec349b2d6e51e39414e79a0ff40

      Download Submit

    • memory/1916-47-0x0000000070C8D000-0x0000000070C98000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1916-66-0x0000000070C8D000-0x0000000070C98000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1916-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1916-45-0x000000002F3B1000-0x000000002F3B2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1948-65-0x0000000003BF0000-0x0000000003BF1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1948-93-0x00000000025C0000-0x00000000025D0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3036-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download