Overview

overview

10

Static

static

5

702a27e40a...92.exe

windows7-x64

10

702a27e40a...92.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2023 12:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    702a27e40a259877b90c92cb15742892.exe

  • Size

    512KB

  • MD5

    702a27e40a259877b90c92cb15742892

  • SHA1

    474de8b01e95cdbb55e9aec9b2c0a8d6d3b228ff

  • SHA256

    ed54234f73fa20b99ec8da643be99d3350fed29e11532fb5cfcedfddec471804

  • SHA512

    c69b4cb8b9c135e930bd73678a09221ec162c2a00ae4e26f05cfbc4b89e5c733b333a4e5a7fa220cc3483ee04666d47ccb0d3fab3faa8210734fa8f2133f704f

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj61:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm52

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\702a27e40a259877b90c92cb15742892.exe
    "C:\Users\Admin\AppData\Local\Temp\702a27e40a259877b90c92cb15742892.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\SysWOW64\zfjwxmitel.exe
      zfjwxmitel.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\iazhyadc.exe
        C:\Windows\system32\iazhyadc.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2684
    • C:\Windows\SysWOW64\zasbpvuebnshnvf.exe
      zasbpvuebnshnvf.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2852
    • C:\Windows\SysWOW64\iazhyadc.exe
      iazhyadc.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2980
    • C:\Windows\SysWOW64\plbuebvzjictt.exe
      plbuebvzjictt.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2780
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2324
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2956

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      d7ff44a6d2c3a163dfed27ac70f24cd1

      SHA1

      58682261989aee02a25c7ca4bf67f4c925a353a4

      SHA256

      971051649a0da2d84ab5a0224108ad40a34652b4b518b645a924e8c351e4a97a

      SHA512

      456c23c6bfe90d800b3f8d0d03df12be43a265100e2d5b9030bc047ca65f48632f4651b3f262653e3e293925bd4d699474f88b91253ed086979a5dfd5c83ab77

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      66579163c385efca71284ee444505692

      SHA1

      6eba6440685e35a46ba1f44b5c642c602239b65e

      SHA256

      6207eba8a7cde05797ad88c718eeae68e7833729580464787da99f1fb1329e89

      SHA512

      1c868140b3db6ab81c1e4defeac91e1fad9727fd26828304b544ec43e15d72b7ccfe6deb523ad65a114cddf41bc945f5cfb8015ae6d491f0e53717e7e58702ea

      Download Submit

    • C:\Windows\SysWOW64\plbuebvzjictt.exe
      Filesize

      512KB

      MD5

      a15b069b926ac3d06cccd8d5e6f7fbff

      SHA1

      e2ccd8b7f36fd52d74414c6b8e4af37713a777c4

      SHA256

      09ca8bbf1b8d23124947b2f9503e9322aa8c5bc9f567eeabad638c263cd48aad

      SHA512

      4368e3ec35d173d92a6abb7e85099042599ce7951d419430e39a45b22210b9b003aaee64be59dfb83339a097ee15e281e187aae57de5079a7aa0ff44cfabc842

      Download Submit

    • C:\Windows\SysWOW64\zasbpvuebnshnvf.exe
      Filesize

      512KB

      MD5

      409c8d942ac140a721e0924b13bb1e80

      SHA1

      8d06c032593193052ed9c86d10453c77e2f4ef9d

      SHA256

      4afa6d9b7bdaa9c942f915a3e89c13acd6522442894415b1b4b82471c9856f6c

      SHA512

      efe18660a99376ae05f3cd7a0d254ae4da564866452f3d461d2416a2e36aba4f7e163602640b0ab793f8824452375b65c80b04536387a4493092b3b8ab8f989a

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\iazhyadc.exe
      Filesize

      512KB

      MD5

      ae2727b0b9cb26ee4738197845d79b2b

      SHA1

      9bcf7b841fb6fa1c3a94336b1d000cbcb7ca426e

      SHA256

      a5ce809311ae2a0141d30e1cb9a6cc8ac101eccf9533cc4582b529c206e68553

      SHA512

      f6b2ea5d21bff8ec9b88c0bfaa160c6368e324db1ee4216fc46271002655ec2b5b18c64d34b04ceae41729dd1cc6e948cb98e74cb4c96affedc21cb2943d4cae

      Download Submit

    • \Windows\SysWOW64\zfjwxmitel.exe
      Filesize

      512KB

      MD5

      b736b773cf6c5e8696a399ff649459bc

      SHA1

      cca546b35297a206d60bc81bc71acad7baeffc40

      SHA256

      9586643291c89689b2b2a42d047578039509991faff6be66428a55f037cd9594

      SHA512

      a665bb43fcc7da2bd24bf75cbeb529735c89ae2277dbaf3322d04d8b394d18a4352bc01160d92ab91af0f56b0581e88a9feeb416b4a2ad22224193430becd5aa

      Download Submit

    • memory/2208-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2500-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2500-47-0x000000007182D000-0x0000000071838000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2500-45-0x000000002FFE1000-0x000000002FFE2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2500-76-0x000000007182D000-0x0000000071838000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2956-74-0x0000000003EE0000-0x0000000003EE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-78-0x0000000003EE0000-0x0000000003EE1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2956-83-0x0000000002710000-0x0000000002720000-memory.dmp

      Filesize

      64KB

      Download