Overview

overview

10

Static

static

5

0c327b45e2...d4.exe

windows7-x64

10

0c327b45e2...d4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30-12-2023 02:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0c327b45e2e2619cc1116c01db9fecd4.exe

  • Size

    512KB

  • MD5

    0c327b45e2e2619cc1116c01db9fecd4

  • SHA1

    1897e432062b78a0e44d387042f7feb7e8a50bba

  • SHA256

    559797107580982cad1ab552b0d3b930315fd0caa04e143c13de2f4cd7d00774

  • SHA512

    66b2b676e0208da13751c726c33b6a5a0c99f7a809262b90a499b3bbc6acea7876949553f63801ae1de1405ed8af4ababb44feda8953419161c5c21229d7986c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 30 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0c327b45e2e2619cc1116c01db9fecd4.exe
    "C:\Users\Admin\AppData\Local\Temp\0c327b45e2e2619cc1116c01db9fecd4.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Windows\SysWOW64\kradnlqhff.exe
      kradnlqhff.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\yewloher.exe
        C:\Windows\system32\yewloher.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2628
    • C:\Windows\SysWOW64\mqocigwhaspnywn.exe
      mqocigwhaspnywn.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2852
    • C:\Windows\SysWOW64\yewloher.exe
      yewloher.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2696
    • C:\Windows\SysWOW64\uqhdhxuqcvwpx.exe
      uqhdhxuqcvwpx.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2976
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2640
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2944

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      b03ca37291ec49766f720be0b3cd5f6a

      SHA1

      e00d9ca6b3dc8d296029f8f5c71b052f2a128b86

      SHA256

      b9bbb8ddcb11379b29e2b5839f953e101ddd7ca71465cb7269b642c491b1a182

      SHA512

      f2dd51b9f3212d4630a24bea927394a5e2b5b6c137e713fc0a670625be42a3097217bb868384323a20b93cc5c523f919930e471e0113fcfafe50f3df1b4471c3

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      5c0cb805fc17a1c5988d1d58c79e8876

      SHA1

      c2f7d884535ffdbac1df32e7035861af49cb535b

      SHA256

      5d161f91acef64ac0148f93987a55c97b93b01356f613b113b250639103b5a96

      SHA512

      dd7adfcb2316c4781102ef4cef69f0ebd5ac61b43be085bec0116010d2f8952963e1be7e59c2a8a8b944031d653620bd9dc806abb6ab88c9f2035cdb50c2247b

      Download Submit

    • C:\Windows\SysWOW64\yewloher.exe
      Filesize

      512KB

      MD5

      48b9ecf1d8c89e9293bf405c63a94158

      SHA1

      e6576dbba99c7adb10845b1f6f341005dfa75c59

      SHA256

      64f1b9507bb3beb0ac28f70cdefb1f0c4b4ab3b389ebe48fe8916a1388909c38

      SHA512

      3a425fa59ca9c4fdd837f164aea05d257df8b331a0867498d74eb0a0a9f05bad341e5e5df5bab0fd3b508eab21c98f3de0d51b6a25cde8f478aa48e4e3b08b00

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\kradnlqhff.exe
      Filesize

      512KB

      MD5

      d04f5558e138d3aed0f6849727d0b7a8

      SHA1

      8bc106a9afbe4203591d3d751280c58c91ab51cf

      SHA256

      dcbf570b0a0b665241ed56e1b14735ca6c3019defbfb4ff09891fde577d83ee3

      SHA512

      adec0782dcff428638f6c50c125c297cb979dd45fc03e815a509a748a7350039f557c08828b476d00f030240fdaba1f063ded1c06778dc8628d14ad897ccb7e5

      Download Submit

    • \Windows\SysWOW64\mqocigwhaspnywn.exe
      Filesize

      512KB

      MD5

      c9da74de66de9c3e59c7b007f76a46bb

      SHA1

      0359f412b4ce0d843b8fe889ee015125f9917c3e

      SHA256

      f0fd74403022fa23db6d9fd62e357ec66db59158bdb50d2f24d0b315e719e9eb

      SHA512

      ae496c38854742a1b019001d689162d0b5be4c4a7ceb3e9c1c822bc35790dfa2ca8efd949bdc8d8b9ebc865ba59e52307dad46d9607d04e653f238e9208e00b3

      Download Submit

    • \Windows\SysWOW64\uqhdhxuqcvwpx.exe
      Filesize

      512KB

      MD5

      d2652cd5275fed3b552afbec3c5805a1

      SHA1

      9aac0916717f4a934074f198280b1c70165b70b0

      SHA256

      c6351c720490ac1246b6ace75d64ab577c0acb8ebd72c7fa0e32e2871eb68c62

      SHA512

      28a684f20b1199a92b3fbe6403fdd5f225c86695a3ff3c44c008a487768df30d222552b44af5287cbb13a80812c46167048ca207b1d1bf30ffaee092132cc35f

      Download Submit

    • memory/2208-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2944-75-0x0000000004090000-0x0000000004091000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2944-78-0x0000000004090000-0x0000000004091000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2944-83-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3052-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3052-47-0x000000007182D000-0x0000000071838000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3052-45-0x000000002F1D1000-0x000000002F1D2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3052-76-0x000000007182D000-0x0000000071838000-memory.dmp

      Filesize

      44KB

      Download