Overview

overview

10

Static

static

5

0510d7a1f4...10.exe

windows7-x64

10

0510d7a1f4...10.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    50s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0510d7a1f4cf13b6bafd2c21d293d310.exe

  • Size

    512KB

  • MD5

    0510d7a1f4cf13b6bafd2c21d293d310

  • SHA1

    f11c620dfa56d642a3e1e854928d08e3bc7815e4

  • SHA256

    61d28c90ea37bfdea739103565da5216e1e7dcb3a7dba0a9f74835e7ee3d1434

  • SHA512

    04087fd7f61fd0ba143ad39022f68422141eecca8878fb94b65cab16312ce790c9b35f0282405af0eda51fce5cd866927271e4737fe264cb891d94ea655a8944

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj68:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5z

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0510d7a1f4cf13b6bafd2c21d293d310.exe
    "C:\Users\Admin\AppData\Local\Temp\0510d7a1f4cf13b6bafd2c21d293d310.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Windows\SysWOW64\bzyeaqrnol.exe
      bzyeaqrnol.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2732
      • C:\Windows\SysWOW64\nzqzlhdg.exe
        C:\Windows\system32\nzqzlhdg.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2632
    • C:\Windows\SysWOW64\zyekigimqjsuzhm.exe
      zyekigimqjsuzhm.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c vpzxdhruvgqpf.exe
        3⤵
          PID:2720
      • C:\Windows\SysWOW64\nzqzlhdg.exe
        nzqzlhdg.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2744
      • C:\Windows\SysWOW64\vpzxdhruvgqpf.exe
        vpzxdhruvgqpf.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2604
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:472

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
              Filesize

              512KB

              MD5

              79f9bf8e3c7d6f7409143e0b53c7ce97

              SHA1

              776341acfd33b5c6ea91590b02114c5fa09f4cb3

              SHA256

              48d54f17abfed0f872673778b009f48a3dd2e4db18311fbe0a1d15990c96ee3d

              SHA512

              df21614dca48c2c96d6abb58ec541877c4eb1c0f31bab80835505314f793976a0d8abcfe967ea65f219d24fe43690fdf1bd56b62edbef55d18c690bcb96558b0

              Download Submit

            • C:\Windows\SysWOW64\vpzxdhruvgqpf.exe
              Filesize

              3KB

              MD5

              6a8c4b146ecf4cdeb261984ff257a701

              SHA1

              0bf68d438aa1143541ce5e776c8baff369c5452f

              SHA256

              8ae4fd77d89cae193fc05431cefa0fdc10e513753b258f608beb9598cd302240

              SHA512

              077eea4f0dddd6d441a0b2169756ca6c6798d2acf856e4f56655cccdc39ebdabccf7d84f8fce4860c68d4c62859991f5ba570ac81ae4c47efa084c5f65c62682

              Download Submit

            • C:\Windows\SysWOW64\vpzxdhruvgqpf.exe
              Filesize

              512KB

              MD5

              e08f82e4c409b872d3f915874cd313ca

              SHA1

              142f727e7eff51acc158d01ef8b624249a0ddc72

              SHA256

              98e2b7076518f31ffb5f06a27729376f29a1a972737232d752bde75f2ebb1f52

              SHA512

              15a8376c81cdcf18b07eea5d0be66e8d35e0b67b52221a371424ef85e0b75c40fdca2c915a5713743474cb2d61965ebbcc4d8e211413ddac84230241ee339255

              Download Submit

            • C:\Windows\SysWOW64\zyekigimqjsuzhm.exe
              Filesize

              413KB

              MD5

              8ac5a552ba8054a0f4ed411cf3bfea49

              SHA1

              9d02c584e846c24a3158045deae230672b906604

              SHA256

              39558be85f74eba3639b847c652ff8505e2cfdbce81b44c06ce984d1248f2a46

              SHA512

              4c345170f6253ffe1c3b4aebb64dbaba7b2389069955aee5efda1cc5d00363b4342d3c4d98d64e5874e06a7e706a2d6093aeeccac3e72b8f0332655ca58cd623

              Download Submit

            • C:\Windows\SysWOW64\zyekigimqjsuzhm.exe
              Filesize

              512KB

              MD5

              b6df39fa0e283789dffbed7ed36b3de7

              SHA1

              8070af8970c7e5f6e14c7f5c384a0a71ee5a22d5

              SHA256

              40558a92f58911718e65019c7fd7d9cb6bffdd5845719029213ca12bf3775e02

              SHA512

              ec6d843cc0b58fb8a81b0f2c8897acfe7b6207031947a30ef4af44a4445163fb6d8b46548ff634a89f221aa8df7580288ba2796abf7cc5f0b48320bd1f3637d6

              Download Submit

            • C:\Windows\mydoc.rtf
              Filesize

              223B

              MD5

              06604e5941c126e2e7be02c5cd9f62ec

              SHA1

              4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

              SHA256

              85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

              SHA512

              803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

              Download Submit

            • \Windows\SysWOW64\bzyeaqrnol.exe
              Filesize

              512KB

              MD5

              0820f61a53b2788fdaeb26f6c4f04f6b

              SHA1

              d231178ebe1f5d1e89014835d8367240e85d2eb1

              SHA256

              28a97b51df22ceb66fcb64901ffef4048df500dd08941c8b707dc920fe3bd41c

              SHA512

              2cd6e65b022eb7a4b12c3927fdc45da316861c15ae1c9582e2fb7464f9d55e28d5aa4431cd77a1acd904e4a8349716af63c22523b22366c857b77731aa265dab

              Download Submit

            • \Windows\SysWOW64\nzqzlhdg.exe
              Filesize

              512KB

              MD5

              eebda0898f27cde351eccea9d884ad7d

              SHA1

              2691384e6e656e162580d0a54be1d09ee22abf91

              SHA256

              1760af3def1bf24bff216c08973ae9ac54f37f2feeeb5f7c5faf62161a92bbeb

              SHA512

              8da0e425d8ce10f476b87e949543fd3bd2efb370ce75a6d690adb8e8e43bc99a642b065e13cc25913bad88608e9628eea9b5471764e254903dd446d1cfe83dfa

              Download Submit

            • memory/1984-0-0x0000000000400000-0x0000000000496000-memory.dmp

              Filesize

              600KB

              Download

            • memory/2640-45-0x000000002F271000-0x000000002F272000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2640-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2640-47-0x000000007136D000-0x0000000071378000-memory.dmp

              Filesize

              44KB

              Download

            • memory/2640-61-0x000000007136D000-0x0000000071378000-memory.dmp

              Filesize

              44KB

              Download

            • memory/2640-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2640-102-0x000000007136D000-0x0000000071378000-memory.dmp

              Filesize

              44KB

              Download