Overview

overview

10

Static

static

5

613eeafa89...b7.exe

windows7-x64

10

613eeafa89...b7.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 08:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    613eeafa89c7c45d0306dd1af73128b7.exe

  • Size

    512KB

  • MD5

    613eeafa89c7c45d0306dd1af73128b7

  • SHA1

    5b4e440d8caf4ce3ba26295701c7a6ac4b05a2c8

  • SHA256

    63f5eb9e729a77ef099e22f0af46a8f4208e3928d8f71d534956e5b2618fb2ab

  • SHA512

    f346b4c50600c7b5981ff2d231f3239ff559c1619f5aeb0260e4af3c9ba2b950a18ede651018896b0efc20926228ad412dc9259f8d132081f9da3378935ee837

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5I

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\613eeafa89c7c45d0306dd1af73128b7.exe
    "C:\Users\Admin\AppData\Local\Temp\613eeafa89c7c45d0306dd1af73128b7.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Windows\SysWOW64\efpiuowcgx.exe
      efpiuowcgx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\SysWOW64\qdowppjw.exe
        C:\Windows\system32\qdowppjw.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2628
    • C:\Windows\SysWOW64\xhexcneeyfwjrly.exe
      xhexcneeyfwjrly.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c guspfxawrtvks.exe
        3⤵
        • Loads dropped DLL
        PID:3056
        • C:\Windows\SysWOW64\guspfxawrtvks.exe
          guspfxawrtvks.exe
          4⤵
            PID:1124
      • C:\Windows\SysWOW64\qdowppjw.exe
        qdowppjw.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2820
      • C:\Windows\SysWOW64\guspfxawrtvks.exe
        guspfxawrtvks.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2900
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2208
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:548

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
              Filesize

              512KB

              MD5

              7964309f023f8eb1da4f34dca7eef429

              SHA1

              9d2ff9afcb1a3581b5cb524d1b47963529578a81

              SHA256

              1423bc8319fa574049688c8893c6add61dab113052c3b7e28a589ed52269c191

              SHA512

              55f98ced1959025e65cd471391ebdce021a2031e8d1f1fd89f3c1806c76b65f00821ed2c7b6829cbe93e4d2e8383ac803e296033e564bbc2826935d9b833fbd2

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
              Filesize

              20KB

              MD5

              b29b1878007501197d4aa28495c2c9e3

              SHA1

              f8fb077ce8bec0f2fd3e7a7d0f439fa202471dbc

              SHA256

              db474fcd5a91eb1757e2ec3ba2d5e90205149eb535072039721e16c69b32b7ec

              SHA512

              7650799823f0f705e4fb189f888669092cf573408aef06689fbd843a82313534e6eb00af6c9310ec9ca26ea96ebc47c3a34c75d9ec22f9b90ab90f4dae8faf24

              Download Submit

            • C:\Users\Admin\Desktop\WriteUnblock.doc.exe
              Filesize

              512KB

              MD5

              121e2dbbe0332e2d152eeac49822419f

              SHA1

              6dee2e41c5444c0af1447aa983a52bcdb5a9797a

              SHA256

              ca95a90b634d15e7f777681fb9568d99c8f7dda08a4bd5c3dc39a8e8033ee318

              SHA512

              08aaa9d8a1bd0424cfded2ced740b015a25b24895c428748629a131d37e6fd985e2353a1c7730a79a537f966a3d806ad87c903149c671166c7d7b607af3b086f

              Download Submit

            • C:\Windows\SysWOW64\xhexcneeyfwjrly.exe
              Filesize

              512KB

              MD5

              daa496a88cd0567f4db7a5f22baa93af

              SHA1

              dfddfbad2a3a29305595bed4be29ecd17378b5ff

              SHA256

              d89ad3339b0560849d93114b7acf4ac3d962c7b05278d6ea994b64d8467376bc

              SHA512

              dc12dae8d21182d848128cae7d4de2cb16e46ac4149425a6678c6b9b3a1969d6ff285023b51bbe9508acbb2a475c62390a67e8e8bf48085ee3098ff7e9f579d0

              Download Submit

            • C:\Windows\mydoc.rtf
              Filesize

              223B

              MD5

              06604e5941c126e2e7be02c5cd9f62ec

              SHA1

              4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

              SHA256

              85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

              SHA512

              803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

              Download Submit

            • \Windows\SysWOW64\efpiuowcgx.exe
              Filesize

              512KB

              MD5

              a883917a55c20dbf3a479cb76307f68c

              SHA1

              0a8984f6f805a79b6bbdb45b0c3cd9827d1db9d9

              SHA256

              b0b91e097ce45f7cd3435fb2257fcc768c582263881335f220951f71e831169d

              SHA512

              d2558140263e54574e627369d1d9ca00bf9901e538239d5958f1356c4e528c7c34d40e84ee133566173f01bf716d0be0989add07d6ae8950d8313ba3bd9b9b02

              Download Submit

            • \Windows\SysWOW64\guspfxawrtvks.exe
              Filesize

              512KB

              MD5

              8dab95e6699f0d397d11d8a5122150a0

              SHA1

              03ff743a46ce78eea5350f06fd33b4855a2ec5b1

              SHA256

              5a30e0f8857456231487423a3036fdf7424181eb4dd683f6a7ec4359b93d9edb

              SHA512

              20e12b91f7077f43f607ce339ca62d0bb59701f01815c56fccda065c6a40927e21fe121f5017225fcc8e5db571cb66ea49d66154d92c76ffe4d42029e3fac44f

              Download Submit

            • \Windows\SysWOW64\qdowppjw.exe
              Filesize

              512KB

              MD5

              d4d0de331db90d9d1d96eae443089b57

              SHA1

              0d33e71ce68c18058c957f701f8fc21f18ab5693

              SHA256

              49f8cf71514f1765dda2bac0a9b0a515036e575f80f4bc4f7143895edc878bdd

              SHA512

              073b86bd2a7333dc3d11c2c2eb4debf1a954c77bef8f3f112921985de022b96e0412568d5819b8cabaf39bf904af644b9b9fbd3334b706e6dbe12b629596787d

              Download Submit

            • memory/2208-48-0x000000007127D000-0x0000000071288000-memory.dmp

              Filesize

              44KB

              Download

            • memory/2208-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2208-46-0x000000002F9E1000-0x000000002F9E2000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2208-87-0x000000007127D000-0x0000000071288000-memory.dmp

              Filesize

              44KB

              Download

            • memory/2208-108-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

              Download

            • memory/2956-0-0x0000000000400000-0x0000000000496000-memory.dmp

              Filesize

              600KB

              Download