Overview

overview

10

Static

static

5

39409cd656...36.exe

windows7-x64

10

39409cd656...36.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 19:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    39409cd656c0bc7567e2c8352dcc2236.exe

  • Size

    512KB

  • MD5

    39409cd656c0bc7567e2c8352dcc2236

  • SHA1

    0b4ded3b48affa28dfc075d3a56c6a8ed1ac9479

  • SHA256

    9f93f8f5e71266c7001be5bfa04830fc68f8a697b014d04058d1cf5417c5fbd7

  • SHA512

    d34208d2994a2a7314b2b0c16af693504658f3588bddbba4a31f5aaa75db37814b48584112d2a70e07a871852f7dbb1b90409eea6e5038781fdbc1aecbe3cd2c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj60:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5V

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 22 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39409cd656c0bc7567e2c8352dcc2236.exe
    "C:\Users\Admin\AppData\Local\Temp\39409cd656c0bc7567e2c8352dcc2236.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\SysWOW64\nptegcoiec.exe
      nptegcoiec.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\SysWOW64\awfenawv.exe
        C:\Windows\system32\awfenawv.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2820
    • C:\Windows\SysWOW64\bbwdandcvdeyhfh.exe
      bbwdandcvdeyhfh.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2676
    • C:\Windows\SysWOW64\gzvwvpzomvbeq.exe
      gzvwvpzomvbeq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2580
    • C:\Windows\SysWOW64\awfenawv.exe
      awfenawv.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2780
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:848

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            398959fb8a21fdf8d6cdc4dc4c5f4cb8

            SHA1

            5ef71f38b248a0bd632769a90af0e511a1734bdb

            SHA256

            acebe78d6addf411d7b7ed4fb84203246e1150e90236545877f7ad8defbf4908

            SHA512

            ffc26b138ec38ca6c2126ae3f1d9c2ad93a0ccad5e9fe1630f6c03c04c58f14e210658f4df2890995f3e86074c599b32bcd7dec3e0b6e2754ae74e89f133a728

            Download Submit

          • C:\Program Files\PopResume.doc.exe
            Filesize

            512KB

            MD5

            8437bf9c277b15bec390abf7d465184b

            SHA1

            63a90522241a33a4b5803f43d2006b6716cb1764

            SHA256

            1b064cab404e18f7e4c01e0e97151a0e24ead884f9788cdc49208961513c4fe6

            SHA512

            e6c2bb3f744c4e48ad9678a56e87fc6c9c14595d07082b2d389021fe820c65e90f1b993d8f0e2cadada5d7a77c9b18ade28977fba693a157eb0966accf6cd2b6

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            8288a4477553152a8f8a05a2666776da

            SHA1

            4ea509870d59bce10aceb5a76be7ab24a042ac7d

            SHA256

            951beed5bd4e7285070ae8d13078b0f1bcd87f76a781fbe148e5a787d67f28ec

            SHA512

            cba108f86a6b5565ed929edc508cd2606fce2ed593988d8c953a5befaa232607b7a2b4e378732ecfc75277ce1eec8e1332bba6dd3e61a46a25945da8ffb489ed

            Download Submit

          • C:\Users\Admin\Music\ConvertToOut.doc.exe
            Filesize

            512KB

            MD5

            afb78626d1ec900020ee319c795c2f50

            SHA1

            a570c5e5c00d635b3d59aba9d64abc22556165f2

            SHA256

            4f6a9ed5e896d4064cffc9136205bc52248eda83b93c8eb5cfa51ace259935fb

            SHA512

            8314e3f564082468569fbea4baa5d1524e2fdf10001707ab6b28a3c1d0d47b5968d245cfa5e2301a88a24b65028b30de839fc9c530c50d4206d94daaa3511231

            Download Submit

          • C:\Windows\SysWOW64\bbwdandcvdeyhfh.exe
            Filesize

            512KB

            MD5

            0f2980cab89b0ae09797c387fd583da0

            SHA1

            1117806393cb7814fac7abbdd1bc0d86ca6d514a

            SHA256

            6dffb826e6f3ab69571895dbacf834a158d2089c7b86edc5da3e58a577f487a4

            SHA512

            fc581dd4d1e671450f0e9aa9de4b5b9efe9ca92e593421410cec60bde0e41896ff5a967d56b8dc7e7bc2d880e43d46e55bf11c9608c70a0b10eb2ea295db03b8

            Download Submit

          • C:\Windows\SysWOW64\gzvwvpzomvbeq.exe
            Filesize

            512KB

            MD5

            5421cb1cbba708b4ea0c07a64e19ffed

            SHA1

            9667419b526c83905b2456a5cc3b17cb320ba48c

            SHA256

            d3ff18b4c4808393aaed293e30733cb03eab694e34439d82e77b5cc9e9c16cad

            SHA512

            f89a18405de14bb7d0da267798935e952f29d6161e007c7f298976e9099ab72217eeca283032818d8cf764efe4bc1c9e86c722b1c192e5050fff5e1f8e1d075d

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\awfenawv.exe
            Filesize

            512KB

            MD5

            7c0cfb70066e1b873ca74acdaf99760f

            SHA1

            d15b3c3bbd304ce7e324771e3a056fdac1a82350

            SHA256

            17eca678693e182f268fb261fcd65859e7c564ed2b0847532740acf1e63c6456

            SHA512

            544b89fcef5d3c214de6160e7e27e80c2d5d6e19a00dfe54ffb624afa9ff81cea11db25b5958d0d35d4e3031bea2e82f821e6756cab8799ce80cc70eaf332923

            Download Submit

          • \Windows\SysWOW64\gzvwvpzomvbeq.exe
            Filesize

            512KB

            MD5

            b1fb52887791a0a2ae039bcf7c30a9ea

            SHA1

            6fb8ed2e5a9782f48ded39b6d05f2a937ff3e4c6

            SHA256

            211a8996757e59bc0ade3be60552da2668ecf8873d79abfba9bd8945002b9d55

            SHA512

            1a3a0c4896e3343a2fb1cac877c3e0753c005511c6c51bcc9dd0fbd83028ad3a61693ce6fb97bc3c3d08a780d78f7598db82269f7f101474adfbee7f2eec01db

            Download Submit

          • \Windows\SysWOW64\nptegcoiec.exe
            Filesize

            512KB

            MD5

            f9e5e60af311f4f82bddc031710ed42d

            SHA1

            ccc6c4eae5f5f1f8b956d550531681f6d03eb439

            SHA256

            d09e6c9d9bfae659e1f48a713591b79048ee30be912624a4003b5f5bb11852f9

            SHA512

            a84b773d7ee8646d88f93bc97d3b6fbf11860e804f9d7d4190f4ea737aecf857594094055bb610806d0d9578ba888404671ec45bb357b713f95cce9757815e2f

            Download Submit

          • memory/2684-47-0x000000007174D000-0x0000000071758000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2684-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2684-45-0x000000002F141000-0x000000002F142000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2684-90-0x000000007174D000-0x0000000071758000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2684-111-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3036-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download