Overview

overview

10

Static

static

5

19bf6d501d...67.exe

windows7-x64

10

19bf6d501d...67.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 13:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    19bf6d501d0f03ce0b12e482c79bab67.exe

  • Size

    512KB

  • MD5

    19bf6d501d0f03ce0b12e482c79bab67

  • SHA1

    f91a77f4933428775ec8f38071525686a00c4d12

  • SHA256

    c3707edb71bde0917dc8cca23cbc53ab60abceca14bc3aa9ff3b647700809bb6

  • SHA512

    b5d60a1265982cc571442afdbc7a6efad7889be9ee912162404e288bb98bf01d314969fe059256c3f3f631501f2ed3814c94333e0b4d67d7e93421595813fa04

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5b

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\SysWOW64\qdzelwhauyonb.exe
    qdzelwhauyonb.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2700
  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2604
  • C:\Windows\SysWOW64\ypejdaig.exe
    C:\Windows\system32\ypejdaig.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:2764
  • C:\Windows\SysWOW64\ypejdaig.exe
    ypejdaig.exe
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2664
  • C:\Windows\SysWOW64\wpendkjklsrvlzh.exe
    wpendkjklsrvlzh.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2848
  • C:\Windows\SysWOW64\anafpqircs.exe
    anafpqircs.exe
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Executes dropped EXE
    • Loads dropped DLL
    • Windows security modification
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops file in System32 directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2656
  • C:\Users\Admin\AppData\Local\Temp\19bf6d501d0f03ce0b12e482c79bab67.exe
    "C:\Users\Admin\AppData\Local\Temp\19bf6d501d0f03ce0b12e482c79bab67.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2952
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1716

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\anafpqircs.exe
          Filesize

          512KB

          MD5

          2716a0df066f7f5888d34805a47371d2

          SHA1

          0f92d85f4dae2f2ffaa3cd138e4c40c757b18544

          SHA256

          8f1826871571a79bbae848f9b0a6175c843ab6aff6d3c90cef6ee9e17b633549

          SHA512

          687fdc9bd5c3abe68e52425a426382623676c9aa0f3c3f58262f251919be243409c34096e38ed864acb97ef0785416a6b123a890ad0866b672ac7933c1ae2af6

          Download Submit

        • C:\Windows\SysWOW64\wpendkjklsrvlzh.exe
          Filesize

          2KB

          MD5

          f8d64fbc319cb58315b645e476ab77f9

          SHA1

          db35f786a78ef8f206424d594c90ade339b62931

          SHA256

          58facb95e3bed902972446b15300f57f25ad43739ef0999e6778a1d76eee915d

          SHA512

          f6bd89fe954e75447753d2bce6c3c9c1b31e67e4d224414f48f40255d285c4cfc9a35db41a62f837314fcc6a450239de88b71307a202b940779214447a67ebfc

          Download Submit

        • C:\Windows\SysWOW64\wpendkjklsrvlzh.exe
          Filesize

          512KB

          MD5

          8f72e48b4b8a18e8e965d62e11a8ac0f

          SHA1

          453df72350ee51d99d7e3bd01137128ece232989

          SHA256

          3a517da17039ae7a3179d9a4516fb7a2bcad3997cc67910ac22d01d6cf5af646

          SHA512

          a1d1546f146d1e2f5369623bb7e8e7fbe81c8d68e5170da37f2887cdccd95dcbca1bde9bcf7c57e9aef8838f6952d6c29d9bb882ba32c111506984f74742363d

          Download Submit

        • \Windows\SysWOW64\wpendkjklsrvlzh.exe
          Filesize

          342KB

          MD5

          68e03d22a5e8edf25d975fe37fda5d35

          SHA1

          6c9e7b6c48d069c6e74fdb758f0a09fba80e66f6

          SHA256

          117fe6a4f3f763740bce8c21482894b3b094ffaa8be7ccdf774be598be4efbf3

          SHA512

          6cc9eed08d8a596cfd397addf9a8b099e6a5a2ada0b6552b01017b80ca30bd6aa668c8aa1e7b889539f856c111b8368d69002c1b6883107827281a409ca3af29

          Download Submit

        • memory/1716-77-0x0000000004360000-0x0000000004361000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1716-79-0x0000000004360000-0x0000000004361000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1716-85-0x0000000002A30000-0x0000000002A40000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2604-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

          Download

        • memory/2604-47-0x000000007096D000-0x0000000070978000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2604-45-0x000000002FC71000-0x000000002FC72000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2604-78-0x000000007096D000-0x0000000070978000-memory.dmp

          Filesize

          44KB

          Download

        • memory/2952-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

          Download