Overview

overview

10

Static

static

5

05906c39ca...28.exe

windows7-x64

10

05906c39ca...28.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 22:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    05906c39cad698da162ccf37f3964228.exe

  • Size

    512KB

  • MD5

    05906c39cad698da162ccf37f3964228

  • SHA1

    0cf0214a3cb6a32e5bc139d6dcff6b7cbb2bcd88

  • SHA256

    e1d59c5b329a280bc03ddc31f57e993eb14fb4afa7d80c4feb7b99c787699065

  • SHA512

    3654a9d697e49d2c245d6dd82c49e5e5db9eedb347e7349d443e9a2247115a15fc27294f3def10a83a71a241fc4266e50d84b4d6633eb5304e139c3b9869c26b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6i:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm51

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05906c39cad698da162ccf37f3964228.exe
    "C:\Users\Admin\AppData\Local\Temp\05906c39cad698da162ccf37f3964228.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Windows\SysWOW64\dhvrzutael.exe
      dhvrzutael.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Windows\SysWOW64\vtegwyxd.exe
        C:\Windows\system32\vtegwyxd.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2704
    • C:\Windows\SysWOW64\ckhiffuzygisdhc.exe
      ckhiffuzygisdhc.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2760
    • C:\Windows\SysWOW64\vtegwyxd.exe
      vtegwyxd.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2396
    • C:\Windows\SysWOW64\tkukfoxdyctcs.exe
      tkukfoxdyctcs.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2712
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2528
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1972

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      3fd4f16f7257c86bed086ab7827d0982

      SHA1

      7474408e550ffeb87875d026758660188f40b020

      SHA256

      e1f6bf334688724d0b5c6dde87e984cbea305777211b57f2122f432f1a8347c1

      SHA512

      fb8b5cfd22ed59ff06da9f4be7929e09d837b1c3037c0c7e76850d460c9e88c5bed2c6b64367125d135da70a7f90e8f9db177cf16fd44754790368734583ee05

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      82ae36eb00d4118fa59f134f3b7eb74b

      SHA1

      a3450e7b02d92a927360bd463651aab27243719e

      SHA256

      212d1e21ec45e617cf42290d7565b6177e7bf73ad97cddc1b6d1b5a856ba5237

      SHA512

      06100e526ce8010c2622b2e0d323402babc1ffddde6a1dde7db7fe3d3f9f666c5aa28d5612ee0335c9f66a366989715443791c2d15a1d262e482657753d94eaa

      Download Submit

    • C:\Windows\SysWOW64\ckhiffuzygisdhc.exe
      Filesize

      512KB

      MD5

      ddd76f04435c04652a265dffd175588e

      SHA1

      f5fb330b4cbe1a197b9747d16c22c5e74e62e9db

      SHA256

      0c13c21f53868edcb5cfe196ce1efdb306fa8ac6a0d0a74be57858228c1660f4

      SHA512

      329d0a77b43d512ec4cde18dcae3b26973b04abe35fc04d99a524b57fd9800f4fec41b2311f8bd82da9c27ff5f3deaf68e7c1eead6d6de081e059c6a6b7d8a9c

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\dhvrzutael.exe
      Filesize

      512KB

      MD5

      d6969d1de3e3f4777b5327d01ef3eae6

      SHA1

      a28da7ace97fb5e3e75ee7c124e8705c4bcaa320

      SHA256

      9c3d88f667bb401833f39df3d2e9a91590c8d024c2173409c23b88cf6140246b

      SHA512

      09c6d3771d4eca7da8bd55503672c52303c8e2fb216a3609aa60a24a4dfd2a8f756a05ec998b4d5cf1cd5f951e1cdd0cd2bca070f8c45c0d56d1025d0a743052

      Download Submit

    • \Windows\SysWOW64\tkukfoxdyctcs.exe
      Filesize

      512KB

      MD5

      3182d282e2b5f3300c7173aae93a99df

      SHA1

      02ba8c51977cc667a14cfc7584a007c86b46081e

      SHA256

      2397691f127ae364efd3b37f75101ed93f30d7b2c1b6c9f21807e3f3cf711195

      SHA512

      82d1303df884089bbb35b9a50c0b57f6bf54b960d9b50f1a26a0efb15dd92619bb3272ce03710edf79d0fdac0751b7499d2ff77bf2d6a9901ea0fc1ff84c3d09

      Download Submit

    • \Windows\SysWOW64\vtegwyxd.exe
      Filesize

      512KB

      MD5

      c35fa3e5d37c117c6293c3f553f58aeb

      SHA1

      31f504f932f8540bf17f75cbf39949301dc390a4

      SHA256

      90a8fa326b062b1e5939adc109efd3761e72a2880df8bd5971989c03e0fabc8f

      SHA512

      427c50e114c295a6e35555828411e31349b19f9a4d97e5a69b72beb3ad894ea299c10780c4adabc0072017add45eed476521a103383509b74b7c797c1090bc85

      Download Submit

    • memory/2000-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2528-47-0x000000007187D000-0x0000000071888000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2528-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2528-45-0x000000002F3F1000-0x000000002F3F2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2528-76-0x000000007187D000-0x0000000071888000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2528-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download