Overview

overview

10

Static

static

5

7b3f2bf469...35.exe

windows7-x64

10

7b3f2bf469...35.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    135s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/12/2023, 16:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7b3f2bf469259e42c06811890bd9a335.exe

  • Size

    512KB

  • MD5

    7b3f2bf469259e42c06811890bd9a335

  • SHA1

    e5a42ad251d46f55e882651b4493154aff9e3db7

  • SHA256

    c95f4a8754789c3a0f3e84f1d7b360d74e4daefe8742332ae7bc7534baac9106

  • SHA512

    7d5cfd7eec7385cb8fc68e46f157fffae2c031a8152af586cfc54492005a9c21e85881b2f90b7bb2fe07d3cd73611782298ce5ad7cf66e1e21377648b4e7fe90

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2560
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:340
    • C:\Windows\SysWOW64\atwkqaet.exe
      C:\Windows\system32\atwkqaet.exe
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2572
    • C:\Windows\SysWOW64\xoqqzxlmputfi.exe
      xoqqzxlmputfi.exe
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3036
    • C:\Windows\SysWOW64\atwkqaet.exe
      atwkqaet.exe
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2800
    • C:\Windows\SysWOW64\wucddcstwrujler.exe
      wucddcstwrujler.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2756
    • C:\Windows\SysWOW64\jdsvqwiuot.exe
      jdsvqwiuot.exe
      1⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2688
    • C:\Users\Admin\AppData\Local\Temp\7b3f2bf469259e42c06811890bd9a335.exe
      "C:\Users\Admin\AppData\Local\Temp\7b3f2bf469259e42c06811890bd9a335.exe"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2400

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            f78da39b6518367dcfa5b978cc9455b0

            SHA1

            1b11314710d45e80f947b5185a56f4eccab1d782

            SHA256

            48b1fdddab2f04e1ce4f617409c436ca80aef06e443b656b2382c0d8adc8284d

            SHA512

            05b1b55d67e44f85c74d7b836626fe6ab50eec71edc46aed39806e4a84d16a7b4530bbf10e9c2c46ca9ac6dc2574d563645a8ea839c44c19566d1eaf4db72a24

            Download Submit

          • C:\Windows\SysWOW64\atwkqaet.exe
            Filesize

            512KB

            MD5

            759462388e14f026d046043b1a63755d

            SHA1

            5cc8e70cbc9887ec8619ab70681458543477f1ac

            SHA256

            33b8a1a7f45ea3e8bc2242c7fe53da3d29bfa517915c3d9f981762cec5f622c7

            SHA512

            0f0b955cdf74dcf11412d4207a2ff5a43beb5eeea29d8657644b1b1a37f83cc9c8b933e974243d6f33cd44c1272a3d9a4c6884293e2fa5f750cb89047458f145

            Download Submit

          • C:\Windows\SysWOW64\jdsvqwiuot.exe
            Filesize

            512KB

            MD5

            12d75016a081d143cf566814eaeb7c68

            SHA1

            757e361bfae5cb6a7b5062e7b214e797989ed1fb

            SHA256

            baa880c0e9f357bc96c677143782a41f7b0323958bbc8b74a306b3441d50d39c

            SHA512

            e02901e371548c8f6c2211f0814578908a54fc0af3910f0637dbd71a87f96de504849deb700a8b7bfa6634868219b3360b08c78845d39678b460d9f71ca0cfa6

            Download Submit

          • C:\Windows\SysWOW64\wucddcstwrujler.exe
            Filesize

            512KB

            MD5

            7a9d5d81c70324d7f17c9d6f947802a7

            SHA1

            ccab51f1b54908ce0c456e554d1f318c70785fab

            SHA256

            9dae65d8ae1e5b07d2305edf681752207306d828fda2eb19d9d0bdf97309d3cc

            SHA512

            44c01b939feb0868a31d9db72d5edf0732c97c109e31e49c4fc59363bacef3d00d21afcf5d35e1d711cba0a950687eaeefa78eec8fa837066a46211fb939f23c

            Download Submit

          • C:\Windows\SysWOW64\wucddcstwrujler.exe
            Filesize

            381KB

            MD5

            30aec9e0b33fbd99234328357879f812

            SHA1

            3c9d37139d4ccfe2b694afba9633170d0f510a92

            SHA256

            15aad0daaaeea2f1eb8d19a8999f42844b2885d6bef949f6787feba7dad46563

            SHA512

            2060f2cc8c90181dd0a9965f0ff3a94aece08c82c4a68454846f66778bc60dade3ba5ddc38be57311ff4a7bd78217b89a9cd09837eee4b5d9893277299dad415

            Download Submit

          • \Windows\SysWOW64\xoqqzxlmputfi.exe
            Filesize

            92KB

            MD5

            6662b185f19fbf697c56a25c92de7961

            SHA1

            0df0c0df0de3724258df2549c583e3c934aca726

            SHA256

            c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

            SHA512

            c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

            Download Submit

          • memory/2400-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2560-45-0x000000002F8E1000-0x000000002F8E2000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2560-47-0x000000007155D000-0x0000000071568000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2560-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2560-71-0x000000007155D000-0x0000000071568000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2560-92-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download