Overview

overview

10

Static

static

5

2979fb1ea3...f5.exe

windows7-x64

10

2979fb1ea3...f5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    196s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 15:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2979fb1ea36b4828faf9b0bc325be0f5.exe

  • Size

    512KB

  • MD5

    2979fb1ea36b4828faf9b0bc325be0f5

  • SHA1

    4ab0a49668ae43b5ac1c4f46dfcdeeeac65e1c91

  • SHA256

    4ee6bd8bda75a3e0a097cd71919f5186cac99ab88b4d0b90021d69e88b6c5dc9

  • SHA512

    1a00d9318c3cff3952064002ddd05c7b2cb59afe2da7e6fed1dc195583dc7b7f94a6c1da7d4e2b004168895e42aeb2436fb95950410a0dd64127e1b8e2e3eea8

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6D:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5m

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2979fb1ea36b4828faf9b0bc325be0f5.exe
    "C:\Users\Admin\AppData\Local\Temp\2979fb1ea36b4828faf9b0bc325be0f5.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\SysWOW64\tzauhhvdlj.exe
      tzauhhvdlj.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\SysWOW64\mqpelzlk.exe
        C:\Windows\system32\mqpelzlk.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1068
    • C:\Windows\SysWOW64\jquadgvsteasmbk.exe
      jquadgvsteasmbk.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1916
    • C:\Windows\SysWOW64\mqpelzlk.exe
      mqpelzlk.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2848
    • C:\Windows\SysWOW64\truxyphzaodak.exe
      truxyphzaodak.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2732
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1540

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\GrantFind.doc.exe
      Filesize

      512KB

      MD5

      b7e02a81fd97f457480d6ba5da78de3d

      SHA1

      bbca6813fece9dbc55727db92f7acb20aec409fa

      SHA256

      cce4d36688395738072d1a9e945498cb2ccdfd92e8d2799469d4747f4ae7d059

      SHA512

      4774ebb38723e059adfeef07d60c7121b5551fe8601adcb9f27bf8389bf24cbf0a874731d429e411f852413a5842331cae008b9e226b9e730190ba911284a5dc

      Download Submit

    • C:\Users\Admin\Desktop\CompareUnregister.doc.exe
      Filesize

      196KB

      MD5

      4d3fab60fd4dd7a86b30b1dd761cc4cb

      SHA1

      b88af7e7916657d392da9d5e0aee6a0adfd78998

      SHA256

      d072e43c8df5b0186f6c278a44a88a377270b1fd64cef40a044663771568e8db

      SHA512

      fb602ceedb225683f45d288828c3827fe087585e51265fe3f38de4ec3345e0d5cb69b9a753a8efe43c629d944e7737e46c2285d86e164c8f62a640be3f87e732

      Download Submit

    • C:\Users\Admin\Downloads\CheckpointMount.doc.exe
      Filesize

      289KB

      MD5

      0adc716f647e36469341e588368bf2e3

      SHA1

      aa43b514b1a02f8338786525e6cac9f344064be7

      SHA256

      00db330c75824fc91de06f816ff100de3fe964ef784e7bc46ac802add877c9d9

      SHA512

      7a70af14b2236432cf803af7a5f9862ef6fc5f45766186295b04b4fd47df0b8b4a29e3a97cb756d1c50d4190241cf52960608973cecab8443c82babc116e48cf

      Download Submit

    • C:\Users\Admin\Downloads\CheckpointMount.doc.exe
      Filesize

      337KB

      MD5

      516fe575eacd8bafd8202fcb99b93264

      SHA1

      936a88326f143851bed5a370e727d72a17a86557

      SHA256

      1f6ae1c0040ca7f4c7b14ef6b6ba95f9adf0cf919f0a72719f8a2075210245a5

      SHA512

      a453cc590b158c4aca0abd3ca748932356328f61cbc18127232b75374329169636e82e1d6ac835647857a06909158432202a425eaac221fdd5f8876998065492

      Download Submit

    • C:\Windows\SysWOW64\mqpelzlk.exe
      Filesize

      512KB

      MD5

      115df16505bb897305fb6c4cb2980df7

      SHA1

      44769fff55d1898e25943748b65f9d717210dc23

      SHA256

      928c973b7a3713c80429ffaa6a5639054351f17324fce0d2d5b0ac0635c9b18e

      SHA512

      27dacaf861c2b45e32a10c73c90614d3ea055367da8211071553f5218ae4e5d9207fd7214c46eb25fd354c70ca1ace92f7888f4caa4a7a5900178965d48a0836

      Download Submit

    • C:\Windows\SysWOW64\truxyphzaodak.exe
      Filesize

      512KB

      MD5

      98c19fe7472fba59a1e90be51dd96528

      SHA1

      1d7eb555c4a4a9e57309160d9087e410bf805a02

      SHA256

      a79825b256111fbd3dbd765646e439f761d1d70c92b30728542475b28c3420f1

      SHA512

      10b67a30d38a91b12ab2d111522f6565262b8edd642d59be08bcda6eb79a737aa26f5f689202b7a4a0c26a21ecf9ec99eb247007152f4511804d4471e1f66f04

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \??\c:\Users\Admin\Downloads\CheckpointMount.doc.exe
      Filesize

      288KB

      MD5

      dc483f37293e58e674745508ea1f9867

      SHA1

      601ca550eaf20f6f55575c7aa56e8ae1e670ad69

      SHA256

      662e22283673f6737ad65c70ca0666d7abf2a4dec8f1bfbf2f09322f7a0147f0

      SHA512

      dd573ab0da4b1bb733d6121cedfc4506526136d1bfbbf0b20679bcfa8674c18f74b03f28ede7c1fcc9e12e0e09214330576d7ad61b716c14a532bcddb0bb7e1b

      Download Submit

    • \Windows\SysWOW64\jquadgvsteasmbk.exe
      Filesize

      512KB

      MD5

      20aaea41485e98f82719084aba86b104

      SHA1

      a4ad227540dc57305eff7b34915c191317392591

      SHA256

      33173b1bfa8accbad204a177fe096590525860d83e445cadaf0bb0e9773fb0e1

      SHA512

      6b87ef015097cad3238b60fe9522fb1a93b36920251f02e42c2378f88f873d419e7e9276cfda4d0c987b194ba1eef8ad9c8498dce01fc751de0207e83e4f969b

      Download Submit

    • \Windows\SysWOW64\tzauhhvdlj.exe
      Filesize

      512KB

      MD5

      eb6afd9bdce353cc0183db2da1bd517d

      SHA1

      0a5c257b9ad299665f1551fe06c9802d7af53372

      SHA256

      200d9127c1f6b47ba0b7757f35702b37eef2325324c63d11342f6b0ab3d54a36

      SHA512

      8408eff23e0c875ce174afae93fe6e49f4b37cec6ba97b510c130178230cc73b31068d1ccf76a27e0b34761981ad729b90881ae4562b14390c8b73ba164145ee

      Download Submit

    • memory/1736-52-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1736-53-0x000000007129D000-0x00000000712A8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1736-67-0x000000007129D000-0x00000000712A8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1736-45-0x000000002F541000-0x000000002F542000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2528-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download