Overview

overview

10

Static

static

3

4a46c777c0...22.exe

windows7-x64

10

4a46c777c0...22.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    164s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2023 01:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a46c777c0dfd6372bc09233218a3b22.exe

  • Size

    89KB

  • MD5

    4a46c777c0dfd6372bc09233218a3b22

  • SHA1

    52b58ef06735f14e7b62971027beb1d06c2b2746

  • SHA256

    a8e04212167bb10e1f7a7d26e2a7455e9d0128d378514e4ba928bb9cf43431ab

  • SHA512

    c66b85e8d0f5d0ea9ffb043e0c153773c62281f2f38bab333beea3dd749bced62c66f4fc0fbb1dedfe357e78b0e8be5a5d355289d1d0d564ed825c8d7e4fa71d

  • SSDEEP

    1536:7keK40T/mx7y9v7Z/Z2V/GSAFRfBh7VoK8:AD40Dmx7y9DZ/Z2hGVaK8

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
    evasion
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 17 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a46c777c0dfd6372bc09233218a3b22.exe
    "C:\Users\Admin\AppData\Local\Temp\4a46c777c0dfd6372bc09233218a3b22.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\recycled\SVCHOST.EXE
      C:\recycled\SVCHOST.EXE :agent
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2712
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2784
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2752
        • C:\recycled\SVCHOST.EXE
          C:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2620
        • C:\recycled\SPOOLSV.EXE
          C:\recycled\SPOOLSV.EXE :agent
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Enumerates connected drives
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2800
        • F:\recycled\SVCHOST.EXE
          F:\recycled\SVCHOST.EXE :agent
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2184
      • C:\Windows\SysWOW64\userinit.exe
        C:\Windows\system32\userinit.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2264
        • C:\Windows\SysWOW64\Explorer.exe
          Explorer.exe "C:\recycled\SVCHOST.exe"
          4⤵
            PID:2812
        • C:\recycled\SPOOLSV.EXE
          C:\recycled\SPOOLSV.EXE :agent
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2772
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2964
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1724
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4a46c777c0dfd6372bc09233218a3b22.doc"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1076
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:856
      • C:\recycled\SPOOLSV.EXE
        C:\recycled\SPOOLSV.EXE :agent
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:568
      • F:\recycled\SVCHOST.EXE
        F:\recycled\SVCHOST.EXE :agent
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1116
      • C:\recycled\SVCHOST.EXE
        C:\recycled\SVCHOST.EXE :agent
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1188
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
          PID:2976

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Recycled\desktop.ini
          Filesize

          65B

          MD5

          ad0b0b4416f06af436328a3c12dc491b

          SHA1

          743c7ad130780de78ccbf75aa6f84298720ad3fa

          SHA256

          23521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416

          SHA512

          884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt
          Filesize

          1KB

          MD5

          0269b6347e473980c5378044ac67aa1f

          SHA1

          c3334de50e320ad8bce8398acff95c363d039245

          SHA256

          68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

          SHA512

          e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

          Download Submit

        • C:\begolu.txt
          Filesize

          2B

          MD5

          2b9d4fa85c8e82132bde46b143040142

          SHA1

          a02431cf7c501a5b368c91e41283419d8fa9fb03

          SHA256

          4658d6abbbaf7748c172ed5a3e003cdb8997648f88724834e41f75e54520e142

          SHA512

          c37f27b442d578e94db6e5d879d026b0b3457f42b99ec56a9cb6fca3161540a32e207b942ef2ddb7be01fa9245ba4d8c859978a0f9a498c1ad8aa46d0890e6be

          Download Submit

        • C:\recycled\SPOOLSV.EXE
          Filesize

          89KB

          MD5

          41e07ded683387933cfc7107f86a8894

          SHA1

          15450f193f254e3a0263d874f5a45ce8c2524c53

          SHA256

          10b52544e488c275193484f61f698e57ea6b9b100a461d652140e8647c255d07

          SHA512

          beb252a6a35cbf1186662a491a995e7535662d94b08c3b071a121073706a02879f20987a49b73e157ce9d77defbdaef0b10e7c637f10475cd7351a415ede9a8e

          Download Submit

        • F:\Recycled\SVCHOST.EXE
          Filesize

          89KB

          MD5

          f452fa00cb5cf2049611d17fb0878675

          SHA1

          a564779a043018b9cdea37775cf076ce1c99e59b

          SHA256

          399da2f217f450a7224fc076bacd8e9817b6f041edd4c27e4886e128a4877ba2

          SHA512

          5d290503cecbfbb187a96f161059cd9791d8af8b53171ed1afe90ba198154fec18a209f25f16eeff0fc28e561323013fb57637b2f591d0df4d993b261ffff116

          Download Submit

        • \Recycled\SVCHOST.EXE
          Filesize

          89KB

          MD5

          21a5b3593e7148eda2c5bb3d9dedea57

          SHA1

          36ff49077fba92eaa548382d7b8371958f5732e4

          SHA256

          34d4c7efec9dd822446852b4381203ea7ec1ee03c0753ad4494a70814888229c

          SHA512

          81dfd2bb54f46d9665810dc70a1835e70e1c6eb4a17024ec536a4a668cb0cd276e8d417554e83443f095aa1609c823944cd3ea1bbc4b06a58cf073794e2cb1b5

          Download Submit

        • memory/568-83-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/1076-104-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

          Download

        • memory/1076-118-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1076-105-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1076-103-0x000000002F051000-0x000000002F052000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1116-79-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/1724-95-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2184-56-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2368-0-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2368-102-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2368-101-0x0000000004340000-0x0000000004350000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2368-22-0x00000000027F0000-0x000000000280A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2620-53-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2712-31-0x0000000001D60000-0x0000000001D7A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2712-25-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2752-59-0x0000000001E20000-0x0000000001E3A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2752-41-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2752-46-0x0000000001E20000-0x0000000001E3A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2752-48-0x0000000001E20000-0x0000000001E3A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2752-62-0x0000000001E20000-0x0000000001E3A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2772-89-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2784-37-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2784-32-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2800-75-0x00000000004E0000-0x00000000004FA000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2800-70-0x00000000004E0000-0x00000000004FA000-memory.dmp

          Filesize

          104KB

          Download

        • memory/2800-64-0x0000000000400000-0x000000000041A000-memory.dmp

          Filesize

          104KB

          Download