Overview

overview

10

Static

static

5

0a256af7b9...36.exe

windows7-x64

10

0a256af7b9...36.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    276s
  • max time network
    276s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 01:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0a256af7b98eafa0d1a37f2a41523236.exe

  • Size

    512KB

  • MD5

    0a256af7b98eafa0d1a37f2a41523236

  • SHA1

    5e1935f94c962974d4823cd65cc601456f4265a1

  • SHA256

    d2347a7c05c92b203b6b6c8eab2d028baa0042b78b2c2754aa2796d359c5dcd5

  • SHA512

    ea638e8f146ee0ee7bc2e96876557445df0e7de77dcff670d3dee34ec9948ed2de1d0d0db2e4394547af556da073f6bffb952577474ee48e3e0f078d3c87b9b6

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6I:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a256af7b98eafa0d1a37f2a41523236.exe
    "C:\Users\Admin\AppData\Local\Temp\0a256af7b98eafa0d1a37f2a41523236.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\rkdqqxynky.exe
      rkdqqxynky.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Windows\SysWOW64\dxdgwgjy.exe
        C:\Windows\system32\dxdgwgjy.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1380
    • C:\Windows\SysWOW64\niswqaookabvvxk.exe
      niswqaookabvvxk.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2952
    • C:\Windows\SysWOW64\dxdgwgjy.exe
      dxdgwgjy.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1512
    • C:\Windows\SysWOW64\vhyfddsbxfycp.exe
      vhyfddsbxfycp.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1532
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2792
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:668
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0xc4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:552
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2528
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      PID:2304

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      9a5e433d7c5d7aa392458ee3d46d759c

      SHA1

      a2d93dec13894150dab2aa24ad3e039c736510f6

      SHA256

      832fbfded05ecc19a3190d68bd31c3282d5937d94872681137f4e1e81cb0660f

      SHA512

      38d03571e30910ca75bf3f67e2f188c478e212c136476bcfd04337c13e5bdce3f8794240b3c92a40aed71421458bbbe0621e1b5d6a0e7da6e0730103f24e4c4f

      Download Submit

    • C:\Windows\SysWOW64\dxdgwgjy.exe
      Filesize

      512KB

      MD5

      59a08b31fd646cc7393b8e252f49ebbf

      SHA1

      edac3339dc429d9f041888ca15c252941a4e8b68

      SHA256

      3cc368e8fd650b1e1b7fb7dc314364831f16993a99745026205cd9fcc1fe60c0

      SHA512

      1c88f1bf4b380bf70faa9b58dbbc0c4a5aa0afd592913e4b5a7726727f7c0aceb58540dbe1ff0c2719eecabc61f4bd7c3d2be09334416adb45b747275a0bd3c6

      Download Submit

    • C:\Windows\SysWOW64\niswqaookabvvxk.exe
      Filesize

      512KB

      MD5

      0ba7c7370546ccb28ea60861161b6d96

      SHA1

      011887e45728a3f95d1d0b5d2d4cfa775497be97

      SHA256

      dd4064fd367db148687a86bb49a74d533e0be097aea895f5f194665ae7e2a47b

      SHA512

      f3cac872eaf3f72c6c1765ad37118e2159cbc4617a0cd75142e529543927c2230ba8768af778af1aecff4f211cbcacd0aeaacf3d7bfb6e1b4d445d75a65aea0b

      Download Submit

    • C:\Windows\SysWOW64\vhyfddsbxfycp.exe
      Filesize

      512KB

      MD5

      90edd0733276970d8e2ddced2ec203b1

      SHA1

      6da43525a151b705610deb6b2ce4a9f0ff8dbd66

      SHA256

      6b50a947be9db7ea9a9d39238239185b0d4ad96462525f08e9577b661939d301

      SHA512

      ae9e50f43f33573587aa2383cd1f7ea9d5a14db7cc70c7c167e3067cb0817685bba45a866456bbb257dc2304d3041b02fd658b2db703bf694fa61613fa77eb82

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      db8815862c80110a96816642ad30291b

      SHA1

      7118cdf224358d317ef70ce0716f54e1e434df85

      SHA256

      3fddfcfb76354f9b249cc535f80a698eb1cb0f8a9c99a3e8a2b52a93bca7a4a8

      SHA512

      6d428caad9091ee087eb00d5035544e8bf77f173e35d7c27f3dd79421a2d1ed4702d5cb17c0c9ed2f42389f973d4c43970ba47e4c839f6a9c341fbb6209a80e0

      Download Submit

    • \Windows\SysWOW64\rkdqqxynky.exe
      Filesize

      512KB

      MD5

      30bc3491171392aac9852cbe933eec18

      SHA1

      8135c0e1095feb1a8169e3b47c3088149ee602fb

      SHA256

      e37937380fd92c9a8e1db8f02ebb6179d06143dbcc976c33393f505301440f9b

      SHA512

      efcf3254343d419b5e0f75aba2009159e26ce8957beabb3f80cc58999abc1be7c0aa6c5afa6ec1b37c34f61b62beaf68a4b4ef63d450a893a684f545f84f9788

      Download Submit

    • memory/668-60-0x0000000004130000-0x0000000004131000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1664-45-0x000000002F401000-0x000000002F402000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1664-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1664-47-0x000000007105D000-0x0000000071068000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1664-64-0x000000007105D000-0x0000000071068000-memory.dmp

      Filesize

      44KB

      Download

    • memory/1960-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2304-65-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2304-70-0x0000000003FD0000-0x0000000003FD1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2528-62-0x00000000041A0000-0x00000000041A1000-memory.dmp

      Filesize

      4KB

      Download