Overview

overview

10

Static

static

5

30eedb894d...bd.exe

windows7-x64

10

30eedb894d...bd.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    160s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 17:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    30eedb894d8537236aca33026c944bbd.exe

  • Size

    512KB

  • MD5

    30eedb894d8537236aca33026c944bbd

  • SHA1

    79cb0ad9d2521b035cca0e2ad7e332d3b0deb5aa

  • SHA256

    9c0218938c061cea5787de6f47c970ee9782888f60f3cfebf8d3cd898a4d9a35

  • SHA512

    500d4f95d22121c1aa31730a15e71b1cb43a1de98e390b9a9884a1c2f980076eef4361f1d02afc442ce58120f883ef41e2bdbd89f76e3ade20567a83b157859b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 62 IoCs
  • Suspicious use of SendNotifyMessage 41 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\30eedb894d8537236aca33026c944bbd.exe
    "C:\Users\Admin\AppData\Local\Temp\30eedb894d8537236aca33026c944bbd.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\SysWOW64\qgiymujzzd.exe
      qgiymujzzd.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\mykrhhnr.exe
        C:\Windows\system32\mykrhhnr.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2372
    • C:\Windows\SysWOW64\yjdcaocauawpoex.exe
      yjdcaocauawpoex.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c buwrryulnxojh.exe
        3⤵
          PID:2224
      • C:\Windows\SysWOW64\buwrryulnxojh.exe
        buwrryulnxojh.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2604
      • C:\Windows\SysWOW64\mykrhhnr.exe
        mykrhhnr.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2228
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:1444
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2868

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\buwrryulnxojh.exe
        Filesize

        512KB

        MD5

        0d3538733f2762af8249a599eb908373

        SHA1

        ce2ecd927ebcca81260ccb569bcf98e8c312b3a6

        SHA256

        7420ab0e5a29592a6001081cc57f1974de0c21f15cef7b31a4716c76bc470325

        SHA512

        e57a3983209de1e5489c46db8ffae7dbe3223eefdad510cea38599ab668987819268a0031ffd6c1d86b55aeacde94cc4a6bd1404b13131cc00ac36367782dbfa

        Download Submit

      • C:\Windows\SysWOW64\mykrhhnr.exe
        Filesize

        512KB

        MD5

        f8e72541674479c85273c73bdca0d03e

        SHA1

        722c85f05768f4fd06e18ebfa7cb9c8c946eb645

        SHA256

        c331085022788f8a86611ffdc2a91c14a302b219e8592a2751e615270385d283

        SHA512

        30723b9c6f0b2669f1e3e5bddc4d3b96439118ce4bea33f3b1bc82e88b36005f1070e9baefac22f518d3e94b57c4fd0654ce0665e29e30c2aedb85b58254fccc

        Download Submit

      • C:\Windows\SysWOW64\qgiymujzzd.exe
        Filesize

        510KB

        MD5

        ed3a50a0cd028f1eca6d0964815f2d3c

        SHA1

        88153c5ba0413a707b3212370bc190c6eb9e8a43

        SHA256

        c8d0eae5d7f118a1cd4959cf9f73ba85d5c057d32aae9532ff6fc124b1cfff25

        SHA512

        ec1990cd53e87977cbdb3018e302b6f2df7ffb19fc758d424a21f74bb785d021ecc096b38433c6a870545573ab221c38cca474db4d2ca5073844ee9d37e6732c

        Download Submit

      • C:\Windows\SysWOW64\yjdcaocauawpoex.exe
        Filesize

        512KB

        MD5

        d8c4dbce873dccd398671bfd86929a5e

        SHA1

        7774a55c58eff98e12e784891afb075bdf76655c

        SHA256

        e4e7279e1ee29862cbf5d2ce56463c83e1958301bda8e8dcdcdfe897d9bde31e

        SHA512

        9095f3bdd668826ce554395a25395bcc0dd0d48fea01b5caacbfc03e1cb103c5ea74fd5cdc5fd2f6508f9a05a48cd9162bfcb122acd26dc751647cd69872edd6

        Download Submit

      • C:\Windows\mydoc.rtf
        Filesize

        223B

        MD5

        06604e5941c126e2e7be02c5cd9f62ec

        SHA1

        4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

        SHA256

        85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

        SHA512

        803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        Download Submit

      • \Windows\SysWOW64\qgiymujzzd.exe
        Filesize

        512KB

        MD5

        2193e775480f2a978dc691142088b6a6

        SHA1

        4c32246e36333c3ea5ad25e1beb2138fb1764fda

        SHA256

        bbf145c2ddf0c41ae7997c715513416f665cb570602ee67c03793bb81b28e6bc

        SHA512

        cc95ddd736a04b8a9fb10d72c43a344f8e830198cc695c35c1150f18f43fcf3661a5f9d34573d9a9f9686d9519f907657564760b42f77bdbc4bc353813d4f04f

        Download Submit

      • memory/2552-44-0x000000002F071000-0x000000002F072000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2552-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2552-47-0x0000000070D8D000-0x0000000070D98000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2552-84-0x0000000070D8D000-0x0000000070D98000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2816-0-0x0000000000400000-0x0000000000496000-memory.dmp

        Filesize

        600KB

        Download

      • memory/2868-79-0x0000000004270000-0x0000000004271000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2868-87-0x0000000004270000-0x0000000004271000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2868-92-0x00000000026D0000-0x00000000026E0000-memory.dmp

        Filesize

        64KB

        Download