Overview

overview

10

Static

static

5

60811591e1...17.exe

windows7-x64

10

60811591e1...17.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2023 08:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    60811591e15d76d3d895758c5062f617.exe

  • Size

    512KB

  • MD5

    60811591e15d76d3d895758c5062f617

  • SHA1

    6c238fed8fdafc5f07d66c6870c33cd0a929549f

  • SHA256

    7e21541558b3b2dfda2382f0ff111f7364361e3dac62e823440fd4198daff50c

  • SHA512

    70a6dbf1409c95c56617a0e352e52483ac485374bfae668ce3e8b278820647cb4b3a118720ffc272c1d73859df1dc203827e6846cf00f688d4323d7fe2b97f2a

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6f:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5u

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\60811591e15d76d3d895758c5062f617.exe
    "C:\Users\Admin\AppData\Local\Temp\60811591e15d76d3d895758c5062f617.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\SysWOW64\ccmnuhmu.exe
      ccmnuhmu.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2872
    • C:\Windows\SysWOW64\oqppscbavjnnh.exe
      oqppscbavjnnh.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2740
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:364
      • C:\Windows\SysWOW64\mgfjarrmsxafvpa.exe
        mgfjarrmsxafvpa.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2864
      • C:\Windows\SysWOW64\ogyidotamf.exe
        ogyidotamf.exe
        2⤵
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Enumerates connected drives
        • Modifies WinLogon
        • Drops file in System32 directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2792
    • C:\Windows\SysWOW64\ccmnuhmu.exe
      C:\Windows\system32\ccmnuhmu.exe
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1636
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:824
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2244
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:1804

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      a3c2ed2013af620e56abee3dc94ffc8c

      SHA1

      ccca12ce5c098f20eb12e4d7c38af2e4fdaeec91

      SHA256

      0f4c5021749d190361d1c512fc26ea15725af9eeabf633d9b1be8fcfc0e93a8b

      SHA512

      d696033ddfb7bce41396b024297312afae0c7723d01a7dc5ddfa73281e44498364a1049951b4cfde48dc7f3618711340f270f93c280d594d615c733ab4ba6b76

      Download Submit

    • C:\Windows\SysWOW64\ccmnuhmu.exe
      Filesize

      155KB

      MD5

      26b5a7e4cc3baa72e79e9b767faada8b

      SHA1

      a042e9ea7e08ea6b5c03dc3d31e89c0a00754795

      SHA256

      7e6657af4d3e312525d02ee62344d833fde562f60294377ded1df70a94bd9ee8

      SHA512

      1d85c3dd14a1384deefe58e0c61477d04985841ebb5d0ffdf3c433931baa5256e063ea4b9fc5f60d8b8f6fc617a9620518a65816eb02c84caa0b6272bb5bf4b1

      Download Submit

    • C:\Windows\SysWOW64\ccmnuhmu.exe
      Filesize

      92KB

      MD5

      6662b185f19fbf697c56a25c92de7961

      SHA1

      0df0c0df0de3724258df2549c583e3c934aca726

      SHA256

      c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

      SHA512

      c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

      Download Submit

    • C:\Windows\SysWOW64\mgfjarrmsxafvpa.exe
      Filesize

      93KB

      MD5

      257f28bd5bdc2b725434b7ab570814e7

      SHA1

      972446e0f8d210c5d6f42a57a921391a236d564d

      SHA256

      d80f45a5995ba038d69dbe87f7c12827ffa2b53e79beedb0bc6ee91c10a61688

      SHA512

      c27aa91c3c3605941a1a121021c840fc7886cf27d43e9d6b2c371888a276d9dfd39135600a4f933f62dfa3d46cb6e12de6e31b3f8b939676701ff37f8cc61575

      Download Submit

    • C:\Windows\SysWOW64\mgfjarrmsxafvpa.exe
      Filesize

      8KB

      MD5

      43f9963f8bbed07aae737ef9c9ada62f

      SHA1

      17b1f3e04a7a8c4234397ba4c683b2052ddbb4bd

      SHA256

      682a11f0b991e056678e01644e67e13827a200c17aca17174ced840558e950a3

      SHA512

      0c010aa1db86a8963062913ed1101e70d4b9dddec98db6d3941328320170bc0abc04280e335623923b7a44ce1fb7ffcf8b16d142f8992f2433433e1c9bfb7cff

      Download Submit

    • C:\Windows\SysWOW64\mgfjarrmsxafvpa.exe
      Filesize

      344KB

      MD5

      7eb3d81a166be608e03e69b090686df2

      SHA1

      36e2ae972d0206f7459d8affdad5087573729a35

      SHA256

      d79d3a13b2c852b293596598349a83467245f8bc929fb7363abdeb30a327fc17

      SHA512

      3ce2a70a8a4a74474163e81ef032265b43e65b51c0258002a08cabc929ac4bdcce468fb1c8d99859a9fcb4b9b338850ffdc79eb8ec1091db0a20fdb350ca1745

      Download Submit

    • \Windows\SysWOW64\ccmnuhmu.exe
      Filesize

      512KB

      MD5

      3ca9c6f6d3b51e480aec92990aea5320

      SHA1

      276d5c91c24bcecc2e4847e65bdc8fb300241765

      SHA256

      5ff3c4b1484c80940a7ee5774064e225e7d429511b0114161343ddce7ba8ff0b

      SHA512

      31866a1015c4619970b98332b1d56dc7bf4f601e3197e64fff36ea71107f63146976762148af880393eb0128cbdb7dbf178c7fd9161a37d24d9386962e8957a5

      Download Submit

    • \Windows\SysWOW64\mgfjarrmsxafvpa.exe
      Filesize

      103KB

      MD5

      cb73c7116e8d5c4bdd45f1f7a843f23a

      SHA1

      ed9a531635d5207f66ad128f2d9dec10a95f13c7

      SHA256

      4bc86d86369d5e10a14e1558a2f1f6fa661ab8b8c208dd5a09098b51b35af825

      SHA512

      8a2d08ef5892e3e3c47adeb478edada07765b3366816e315039b0d53c043a4e541f169df3e0a4cf2170979560069b01de9eaf4b54cde752029b2b41a2f621c18

      Download Submit

    • \Windows\SysWOW64\ogyidotamf.exe
      Filesize

      512KB

      MD5

      043538dbdedce508db25aeaf9f551c3f

      SHA1

      09f49be6de45c7dbf7aa77332f321d70889c08c9

      SHA256

      1b36e8431df78ba45f06d52c2ed475803286987b483661744f2e2185e88e6698

      SHA512

      120ef92aa9cbd1c1e90a26d73ca4a14449c65ea1dabe048ace875e70d4a98ed90b1d70765d05747015a5f38a9981dfa987d6b2f6cb46e03d4847b53d894941c5

      Download Submit

    • \Windows\SysWOW64\oqppscbavjnnh.exe
      Filesize

      23KB

      MD5

      feec2623cbf415328f2814dd8c4fbe16

      SHA1

      81036963c7f2c7218c7b26457b5bb5aba5589411

      SHA256

      329681dba2165d42e213bce023c181c9a9833ef2d4de6ed3f4eedd4f71184176

      SHA512

      828439d7dcf704a1b1a13b4725c0c5717d4ea16480032b05b8047e07dfa817b2caf82c3df83872f140a12e16e32a8f19443d33cbeca51bfafe09fc40c86b45b5

      Download Submit

    • memory/824-76-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1724-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/1804-79-0x0000000003EF0000-0x0000000003EF1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1804-80-0x0000000003EF0000-0x0000000003EF1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1804-86-0x00000000026F0000-0x0000000002700000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2244-77-0x0000000003F00000-0x0000000003F01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2628-45-0x000000002FF51000-0x000000002FF52000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2628-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2628-47-0x000000007175D000-0x0000000071768000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2628-78-0x000000007175D000-0x0000000071768000-memory.dmp

      Filesize

      44KB

      Download