Overview

overview

10

Static

static

5

01170219f2...5c.exe

windows7-x64

10

01170219f2...5c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 18:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01170219f212365d3084e3b3d7ffe85c.exe

  • Size

    512KB

  • MD5

    01170219f212365d3084e3b3d7ffe85c

  • SHA1

    28f35a5b8b2c0bbd7914e3efe72f26c59dd265bb

  • SHA256

    c0986f9a98cb6a124b1ffd8f233741747f459c17f350507292af5ee436944bd1

  • SHA512

    52dbbb6181178be72375bc984da6553ec7c4c9475af201fb579fa2c392ce80ec1db25f27c8b8e04263b1b0b557e1a8f082416267539823ea8d988d0d71ff348b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6c:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5h

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01170219f212365d3084e3b3d7ffe85c.exe
    "C:\Users\Admin\AppData\Local\Temp\01170219f212365d3084e3b3d7ffe85c.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Windows\SysWOW64\txxfmsxgal.exe
      txxfmsxgal.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\SysWOW64\qdhtttfx.exe
        C:\Windows\system32\qdhtttfx.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2756
    • C:\Windows\SysWOW64\umapthfifiqifbp.exe
      umapthfifiqifbp.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2772
    • C:\Windows\SysWOW64\arxscvmsjgctz.exe
      arxscvmsjgctz.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2688
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2624
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:296
      • C:\Windows\SysWOW64\qdhtttfx.exe
        qdhtttfx.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2776

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      7231d4d702e4605d036bbdf1bfe421d9

      SHA1

      22278677f8a5261d7aa94c71c4a281f2014a5b1f

      SHA256

      fad8239d9e35618d73af80454ea83281b1c872f15ec45088ba9d246be50f7577

      SHA512

      5bfd7bbe9a9fa7d26cf92e7e41e6cc8c0d44fc1c83831169786364218b8d7ea5fbe48376e29aa9b8ed4c2d729d765e27e5f0ca8ef23904a8ca94fcdd4beec622

      Download Submit

    • C:\Windows\SysWOW64\qdhtttfx.exe
      Filesize

      512KB

      MD5

      e7f6f25922a79b4df1a8e886e3465d65

      SHA1

      8fe1058d77c504a4ff15698296adee626bcfb2f5

      SHA256

      81875e5392516780b28106f2bfa4c9b01d0063a29d6d27fb7a9331cb6df0b240

      SHA512

      1808fdba1ad895de668970ee548d5e1081f9b9aa352d667105cf3ab4a846563797607cb90eb841c44dbe4eb26dd4b0677bcff877ccb37ddb4316d3a10da6dc1a

      Download Submit

    • C:\Windows\SysWOW64\txxfmsxgal.exe
      Filesize

      512KB

      MD5

      9e97e266308765c367eba964c9b01bf6

      SHA1

      46e5dcc6ff1456b5d349ed1d12951c582a36e803

      SHA256

      fc2b3ca949733ae900f20f62fe4e95556d39d0210e737e7fa2ea22f5c1e990ed

      SHA512

      71b99024ad15812bf380a2fba66d91c4ffdc0f04c6c12f47c258178fe658fac45cbf51661d96e1c0aeb171188fbcad775ad17244f6cd2809c7e957f3e201d57b

      Download Submit

    • C:\Windows\SysWOW64\umapthfifiqifbp.exe
      Filesize

      382KB

      MD5

      badd716c7c48a8241873d9251da496d1

      SHA1

      6bd2a072c8f64a1780fe75d983cb7b6584985c6d

      SHA256

      ad4373bfa026f66380b8ce44d6bc300d146770114fb10087019af7c616dc11d7

      SHA512

      7bf3f09216e2ba376053e668963797cd78f91119467917a84f467dd3110d6bd26592784cdf7cefd293413ff5b6dbe10a996d89627177235d9f109732c05f36c5

      Download Submit

    • C:\Windows\SysWOW64\umapthfifiqifbp.exe
      Filesize

      93KB

      MD5

      257f28bd5bdc2b725434b7ab570814e7

      SHA1

      972446e0f8d210c5d6f42a57a921391a236d564d

      SHA256

      d80f45a5995ba038d69dbe87f7c12827ffa2b53e79beedb0bc6ee91c10a61688

      SHA512

      c27aa91c3c3605941a1a121021c840fc7886cf27d43e9d6b2c371888a276d9dfd39135600a4f933f62dfa3d46cb6e12de6e31b3f8b939676701ff37f8cc61575

      Download Submit

    • C:\Windows\SysWOW64\umapthfifiqifbp.exe
      Filesize

      512KB

      MD5

      ee13bd93e8cf55ccf36edcf18b7d0eb8

      SHA1

      41f2ec40c11d881ef73e93bc2296e8cd19feba4f

      SHA256

      3826226098512188dff4cae283ecbd2df8204fcae33c5473cd8da4860fbe7381

      SHA512

      40c5f15417998927004e23d27d22590a7a81b68c4647c19173486617ede20c90bea5a0bf4be1e17cdcb225cfd4b78c993d118d405f70841ce96aa65119379faa

      Download Submit

    • \Windows\SysWOW64\arxscvmsjgctz.exe
      Filesize

      381KB

      MD5

      30aec9e0b33fbd99234328357879f812

      SHA1

      3c9d37139d4ccfe2b694afba9633170d0f510a92

      SHA256

      15aad0daaaeea2f1eb8d19a8999f42844b2885d6bef949f6787feba7dad46563

      SHA512

      2060f2cc8c90181dd0a9965f0ff3a94aece08c82c4a68454846f66778bc60dade3ba5ddc38be57311ff4a7bd78217b89a9cd09837eee4b5d9893277299dad415

      Download Submit

    • \Windows\SysWOW64\txxfmsxgal.exe
      Filesize

      258KB

      MD5

      dda975591dd846234da6d704f9c1df87

      SHA1

      8118b77ad5be11b39852640ddac80bb7b04d97e3

      SHA256

      676f8c9f0e2bc7dad320a13741e8a13770f14dfed63905ad1627c45da4b9191e

      SHA512

      c99e12bcb4622f51f099104811979cff39a4c4a24d7f99f9612835976bb3aad69b2f697a48a8775428a14c48ff946045a287318fbfb08ab44cb79f54a3e3a2b1

      Download Submit

    • memory/2188-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2624-45-0x000000002F241000-0x000000002F242000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2624-47-0x00000000713ED000-0x00000000713F8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2624-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2624-75-0x00000000713ED000-0x00000000713F8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2624-96-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download