Overview

overview

10

Static

static

5

13031b7536...aa.exe

windows7-x64

10

13031b7536...aa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    159s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 08:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    13031b75367b2e693536340c9991f2aa.exe

  • Size

    512KB

  • MD5

    13031b75367b2e693536340c9991f2aa

  • SHA1

    29c270b87d6370f21b1be73377a75a96b9d88c8a

  • SHA256

    4ccde3991140cea6b86acb8d2fd3ec64804567cd77711d154e7668b9d0dbde95

  • SHA512

    90014ebce8fc47ef8a229e8423291d9b256643d0ee0022ea8772b774519b9d06f0e5cc577318d5d74d83286b743f0e7dce6d02567612ac8d33ffaf14bbea8c63

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm53

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 15 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 33 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\13031b75367b2e693536340c9991f2aa.exe
    "C:\Users\Admin\AppData\Local\Temp\13031b75367b2e693536340c9991f2aa.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Windows\SysWOW64\cpxjrnvpvx.exe
      cpxjrnvpvx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\SysWOW64\tfeaypis.exe
        C:\Windows\system32\tfeaypis.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:1592
    • C:\Windows\SysWOW64\tfeaypis.exe
      tfeaypis.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2876
    • C:\Windows\SysWOW64\jyraycomgpjqgdx.exe
      jyraycomgpjqgdx.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2116
    • C:\Windows\SysWOW64\erqfturyylvyu.exe
      erqfturyylvyu.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1892
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1268
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2324
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2624

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            46348b13ee0ece89dce4ac3c1b3c9220

            SHA1

            15758da6b28fc0cf2f015ce689a41841f03727ea

            SHA256

            e42f733d3e304c1c209dece0dfb17a0997675a7dff7d26e235655fb7a8e9fbf8

            SHA512

            102044663e3f4dfe02acb2564056c8230083c5e6aa6529c1f41cd2ba224f627bdaf9632279f20f7d2ab5f64f99c4b97755e3ff1758b640e615bcd98b623c2f7c

            Download Submit

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            86800bd009748e1d56faaddb6561fbc2

            SHA1

            781f443c642854f5fe7664b95f76871f50a3a8ee

            SHA256

            9ab8e48cfbdf0a6b1a21434f863ad833e3c4301a7bae840771124eaa40a3a00a

            SHA512

            33da4df871a2cd726696e677dacb13f9cc8206ea3fedd8107c35b3abb5e2dd9487ff397799524631e287e66481a637e03f3c423d9fd58e2b9696aa13a3fe2e78

            Download Submit

          • C:\Windows\SysWOW64\cpxjrnvpvx.exe
            Filesize

            512KB

            MD5

            cc4dd35ce53dfba1b243ff72139ba387

            SHA1

            5146164bbbb7d4181ef379eeda774a6823c442d1

            SHA256

            6c87a3ea218a4cb8b69ecc7e564816d4d0ee392f9039ad1ffcbb6fc0837400c8

            SHA512

            26871b2581545ee4a5fbd7eba658dfcd12bee57466536df6bf0efb4a946d1431368dad4b87c0b4d847338ced0af2e36c472fa4d4199e75a5de390380db75df51

            Download Submit

          • C:\Windows\SysWOW64\cpxjrnvpvx.exe
            Filesize

            383KB

            MD5

            411fb548616d3e06940b7fd7b0722043

            SHA1

            da2d1ce44bab1e534034dbb2450d09ccf764cffc

            SHA256

            012e826a0cd849ea25446b47c250e7084318a3f2a68f744ff46e93879cd76d77

            SHA512

            66e7b44ad72af8b804c79d2b0637cbaffe00e16b2165d18cf1eff104ee12cc18f782859c79ecd272485a52748769118450a453fa23ca489e0ced5dbdb4569d2b

            Download Submit

          • C:\Windows\SysWOW64\erqfturyylvyu.exe
            Filesize

            512KB

            MD5

            bbdd0299784d61096b70fd425aca06c1

            SHA1

            c9608a286b6717b8daa3854c83bb7598d74731ea

            SHA256

            2e4a858dc433aea9f1bc72f3dab9d8c4555b7fdd00f9ca2f72045d2aa093d7cb

            SHA512

            c2180af733f7c84c316aeed80c7a38c3a4f05cd8801ae23226a6cac337f1d1a8c28318732dd4ecd5e70498bf5c3fffe310379563c2994187074170b932faa8b2

            Download Submit

          • C:\Windows\SysWOW64\jyraycomgpjqgdx.exe
            Filesize

            416KB

            MD5

            1f6c284b1067c0e39390b8b96c81ea89

            SHA1

            07318079d72e0edfe8b4417d3a0e415ef26ac716

            SHA256

            c29b8e21e273d705735aba693b6718fcbccefc2ffc2ffbaf9da9e50435e2557b

            SHA512

            888cdf6710653edba494af3d748993e40f3d45aa011c1f0a04c9dbae9fd7895446f119603ff98e027acd9e6d8409b134dda8ec4d00ede3e4904dbd0100aa4df2

            Download Submit

          • C:\Windows\SysWOW64\jyraycomgpjqgdx.exe
            Filesize

            286KB

            MD5

            1fe4634c8524fee84fcfbff636db2c65

            SHA1

            fd77e4be4aa9764c2a74b1d61726dc22a8cb9944

            SHA256

            b2b6f3394e2529f0a371af0a858a602b6113832123054696fc2dfa5ccb433421

            SHA512

            641f988fa0f83439a8f350511adce43330697672e078573af1d4b721d2d5f8bc5f3b0dcf561befead228c3530a7d4b1c4d9c855a96ad1c4cb174eb8f556d276b

            Download Submit

          • C:\Windows\SysWOW64\jyraycomgpjqgdx.exe
            Filesize

            512KB

            MD5

            e8ac78a7265bb7af395b10d1fba3f89e

            SHA1

            aa7d8f24685329457d263781b3df7aa88dc8b09a

            SHA256

            fd01814435eab1fa79e695a93d6ab758610f2d04cd72e62559366d48cd0b00b4

            SHA512

            b5a7b7752a6870333e2f5b84b4c9087cce5f8b2672fa3c4443a2a5c78c39cb921caf1cf7fdac824507a61ef24c7d2831b61a451bcc165ddb3018aee3c9c1be60

            Download Submit

          • C:\Windows\SysWOW64\tfeaypis.exe
            Filesize

            328KB

            MD5

            08cddf1c7855a1aa8431dc59a0edbe33

            SHA1

            1e3fc8233aefefd74d8abfbfb8cd6e56360859f0

            SHA256

            a216160cfc7159d3fe28148b64a3d32d22bce8689907ed34a88efc18bb9fe0af

            SHA512

            defa857664e61646d8d630d559b08020d81ad07afee519bb439925ed5de379011dd0b381f15ce229585677490b7715f3e06b9febfd494bb11b84fccc8dfc4191

            Download Submit

          • C:\Windows\SysWOW64\tfeaypis.exe
            Filesize

            439KB

            MD5

            8dcb5dba5d4238e2c1f3f3389deb3fe8

            SHA1

            1736deac19b1f7fc82d4ab2d392f64ce1e61a77c

            SHA256

            029c88accd903e87fdd305c7d4918014218298d83857586d3ad48fdf1d6844bc

            SHA512

            fb45538a33e66218bf745a70ce80ca9408f9effca283b337f239b369ad5fd4c8a82d5dc96ab0ad5bf1b07421f224b72de60f549f643ced582d6d041aaaa709ef

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\cpxjrnvpvx.exe
            Filesize

            152KB

            MD5

            bac1439a35feb1f91e2e74c05c4150db

            SHA1

            e105c50524f5acb1457c4b67a8348897f18ffcc5

            SHA256

            028c2509d2743e26bc414331a2e6b1aed3d5f51f94a690a211d03bd563636749

            SHA512

            e660baf725c99f4a69ea7847d6be8af0556ef054e58eed5eae984a47cdb6df299b7e2bea9c2e946fd277e0b7fdfee23d4b75eddb8ecbfc09862c8356e680f7ab

            Download Submit

          • \Windows\SysWOW64\erqfturyylvyu.exe
            Filesize

            433KB

            MD5

            03b8daba3994ab75e6ee84bb80313b65

            SHA1

            19bae2a99d00b0e7ed1c0e983f4fd8bf505547f5

            SHA256

            2e0756645649a8a77c31802364e4df49b0a70d1ba43a84f0b1c455eba86c76e8

            SHA512

            ef7b277499a0c315ea3136108ef78de0adcfbcd1104afbb7afd7877ee0f27f00813f2aafd4a0105971643e9a8fa446d731dc629664c98da2e0ca70bcf7e416dd

            Download Submit

          • \Windows\SysWOW64\jyraycomgpjqgdx.exe
            Filesize

            64KB

            MD5

            d76d22b81130bc9206c7c947d7a9ea5e

            SHA1

            5956e88a6ec7949ce5a350e21703307d855f34b1

            SHA256

            b96acd28ea28c51de470bf63ebbc33a346440fe63e236ab9f092e0cb3035b870

            SHA512

            112f4f23127929556f27e12a7979ebd1536af790c92f8ff7870a5b39470bd02d83fbf1697e7ab3eccebd71c44ae7bfbd1dac9c39fefa6e15a488baf840b8aaf1

            Download Submit

          • \Windows\SysWOW64\tfeaypis.exe
            Filesize

            512KB

            MD5

            62ec2fab6cb3f60c1f9543ded0006ce0

            SHA1

            163451f5dc9778bd023a60a104754c66d4a6a00c

            SHA256

            d6caf27a26edf845f6e13c40d5dce78cbe70ea86e932f3e5d9f5f37dba8ab391

            SHA512

            cbc39703ebc15d63438e191ca28e00a383109764556fb4b131e25a2fa5098535980713a95dafa3e6df95087ddcda134037281b5c717e2d9acbc9e1bb6b3c3c49

            Download Submit

          • memory/1268-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1268-47-0x00000000710AD000-0x00000000710B8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1268-45-0x000000002F3A1000-0x000000002F3A2000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1268-77-0x00000000710AD000-0x00000000710B8000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1648-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2624-68-0x0000000004440000-0x0000000004441000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2624-82-0x0000000004440000-0x0000000004441000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2624-88-0x0000000003960000-0x0000000003970000-memory.dmp

            Filesize

            64KB

            Download