Overview

overview

10

Static

static

5

02f18e506d...a1.exe

windows7-x64

10

02f18e506d...a1.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 03:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    02f18e506d9e63ffbb3ef187f661e6a1.exe

  • Size

    512KB

  • MD5

    02f18e506d9e63ffbb3ef187f661e6a1

  • SHA1

    5ef2e7bb28554d980c70249014d535f773e79372

  • SHA256

    db337e37a82ecebe90652441a031d92ad980911d3190f7d397e8b5cd2168f351

  • SHA512

    6dde8eb7297c770eb77c094329563761a5deeac75f97fc7fd657add7e065017f7e2ab3de7a10bade4558730b1c3dd822b1dceec30d9f4c6f4a80d75624229501

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6X:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\02f18e506d9e63ffbb3ef187f661e6a1.exe
    "C:\Users\Admin\AppData\Local\Temp\02f18e506d9e63ffbb3ef187f661e6a1.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\SysWOW64\xohsoffdud.exe
      xohsoffdud.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\SysWOW64\vzwnuxvp.exe
        C:\Windows\system32\vzwnuxvp.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2740
    • C:\Windows\SysWOW64\dghfcncwaqwwbbf.exe
      dghfcncwaqwwbbf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2780
    • C:\Windows\SysWOW64\vzwnuxvp.exe
      vzwnuxvp.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2328
    • C:\Windows\SysWOW64\hjklelfboopcs.exe
      hjklelfboopcs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2692
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2568
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2152
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2244

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      ac6f483e2f9201a34a06a1a51bc1ce5c

      SHA1

      4d55a3eaf6b912bb0aacdcb4a6c9a3525737b185

      SHA256

      39d293a08ea4cca92cd215ec22df01e0b1ceb9551906ea12550aa8a74085c805

      SHA512

      a477eff0d2174543f9b5497ad14f7efb11742eee5cc083a17ee5dfe6998af8a13502a7ffe2996d94e4962b1d8bef7ae44f019ac80a1694d646c5ae5bba65d048

      Download Submit

    • C:\Program Files\HideApprove.doc.exe
      Filesize

      512KB

      MD5

      905e3d46a7d5542abf8466d9dfe5bbc6

      SHA1

      77a2118a8579cebcd81fcd37e5242849e1ef1b1f

      SHA256

      5f5d674e13431466d1377719104e306c0e7beefecb556f3047d1554af6983b75

      SHA512

      96d59d11181b8046074b9c84a2951ecd1aaf30f2180e3b84e98edb18391b615feb909d479cdb23e3c122491bb1d1f11c73c3c2484ca839386cb98e8a65bbd30a

      Download Submit

    • C:\Windows\SysWOW64\dghfcncwaqwwbbf.exe
      Filesize

      512KB

      MD5

      2a7ff3d9a5ddf5a8162c16ff9b8985bb

      SHA1

      6e1b2232d646d6c695b42bbe30e564adb177227b

      SHA256

      ee15c55721cbf0971c765bff18cfc6eba2d8ce64a6c68c7fdfb7e7642d6a3853

      SHA512

      daf34c006b09f171d1946df1d3bc7a2b6148d3b54b8fd24cd3b79be4791cb3efe4e6126bf6d9e230c17831137c39740bd575e16a57e124496bbe467966ff5892

      Download Submit

    • C:\Windows\SysWOW64\hjklelfboopcs.exe
      Filesize

      512KB

      MD5

      27f69dc3510a3bcdf517527b056ea100

      SHA1

      1e074bf2dfe19b58696d79c6435c49ad216f2a38

      SHA256

      ec8286087240f828d28e9b012bbe2aa2555cccffed906d57913c8077a3437b05

      SHA512

      feb5785512295ab5ede33f2ed4e98018a937808e5e3003fea96a4a38c8532d22cfc555dbe27e9740951846ce061f6a48edd85f81acad4838d67c7f32c0b7e690

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      1de866cbdec0acc68419f047c3ac2e1e

      SHA1

      c451b3669302201cefc32e872398e30fe92fd22e

      SHA256

      d6e34d0c000ecbc16021487902f7e55725b4db24252018695d2caa7d6cd4d0ed

      SHA512

      3979d867fae32abbd35a1bc024c138f00896fd03046e09f673bd72c91e94f11a266e78ff0d7cf2085f54f3092989ba591ad1f174f0c1aaa23aa516d231b9c611

      Download Submit

    • \Windows\SysWOW64\vzwnuxvp.exe
      Filesize

      512KB

      MD5

      a1a858f960eb26c058c9270e8d114a3b

      SHA1

      9565c701ec68a24433d0ecb0b7e36cd7a7a665e2

      SHA256

      bf40e5cf3c3e0a219e30e6b40e315c8170d96a8c0090de694eabc18fca3cc9a3

      SHA512

      aa7daf6f7a8f594a84990e09de79fa7648c03361f100278d898bc874a3b2f19a17e843aa17badde3ff33a9ca6def1eff3fc8ac21bff086e8cb26adf70e0647cb

      Download Submit

    • \Windows\SysWOW64\xohsoffdud.exe
      Filesize

      512KB

      MD5

      03a412840fe53ee697d8a921b96f8595

      SHA1

      6f0167f83d8121a5387b9de739614766feab1a8f

      SHA256

      5224bad51cf8bf0444573bc0ac4c6dd9b618c735c9d68f9a78ffe6c5ddc8e95a

      SHA512

      071f805a4e1438a04a0f5f083ed4edba79b809451289e08539b02c482596dd7372ab38d90eb3a8d3d76923e721211dad97270da33e7a41dcd2706e86defce5f8

      Download Submit

    • memory/1992-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2244-83-0x0000000004140000-0x0000000004141000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2244-87-0x0000000004140000-0x0000000004141000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2244-92-0x00000000025A0000-0x00000000025B0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2568-53-0x0000000070AED000-0x0000000070AF8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2568-52-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2568-45-0x000000002F7C1000-0x000000002F7C2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2568-85-0x0000000070AED000-0x0000000070AF8000-memory.dmp

      Filesize

      44KB

      Download