Overview

overview

10

Static

static

5

c77f7a60ef...ba.exe

windows7-x64

10

c77f7a60ef...ba.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    133s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01/01/2024, 09:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c77f7a60ef57684afae3dcf19110dfba.exe

  • Size

    512KB

  • MD5

    c77f7a60ef57684afae3dcf19110dfba

  • SHA1

    95db3302117728fd83b040d8794543a42491f7b1

  • SHA256

    029dd7eb6b008bb295a8056f2a88b8f3f3ee6ea0f631692417307734a0ce3483

  • SHA512

    79af59a90602202482479988975207b5631d84bf8b4b446bec2517bdfe7672006926ccfc33b53d7460ba84d0459fafc22b117b25aeb0752116055ccf58f6fd94

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5P

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c77f7a60ef57684afae3dcf19110dfba.exe
    "C:\Users\Admin\AppData\Local\Temp\c77f7a60ef57684afae3dcf19110dfba.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Windows\SysWOW64\lgfjdjgmow.exe
      lgfjdjgmow.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2696
      • C:\Windows\SysWOW64\gxebumot.exe
        C:\Windows\system32\gxebumot.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2628
    • C:\Windows\SysWOW64\dkrnsnjowpaom.exe
      dkrnsnjowpaom.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1376
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1608
      • C:\Windows\SysWOW64\gxebumot.exe
        gxebumot.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2676
      • C:\Windows\SysWOW64\dwefixygehnybig.exe
        dwefixygehnybig.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2780
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c dkrnsnjowpaom.exe
      1⤵
        PID:2840

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
        Filesize

        512KB

        MD5

        8bbc67aff9c0755ffd42533cc7673b44

        SHA1

        8b0d501cd80ab701d6494d5fe7e4c6fd3d42c02c

        SHA256

        94caeeec4d036194547e484e78a84fa61d16251d9cf85f3d3f29d934014bd255

        SHA512

        101785512fcf7834b77d310d4f3c89e220a4df52c1ee742f88f8b22fb157246966b2632fb64cd861687735126e6e4acb618889fb99747bfdb976b88b8c6cd3fc

        Download Submit

      • C:\Program Files\PublishRevoke.doc.exe
        Filesize

        512KB

        MD5

        86ec0c0a9b95cd941d9efa6f771c9632

        SHA1

        1adb611e21f84d185901dc509acead29a70e680a

        SHA256

        a509aff7198ef278110122054953cbcf6b2c228d350b13430fbfcf7a94d5d6e7

        SHA512

        834f87de52979181ff001a73a057879dad1f0ce745598b8c74f452be9b6306e64c711114c713b75b4b40a49caebcf26ce42a22feae2d5b1126800805bb522a53

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
        Filesize

        20KB

        MD5

        891835d70277c412629c5cb285c1e8b7

        SHA1

        374a66a2646f45ae7d53f163425de2de3513a2ea

        SHA256

        bf983201b021d64b090161991cc8d561b3071243c2878aaed7e557ca35781a57

        SHA512

        4fd33640b3c20d2e2d2bbf9b82991d721dff7031341cdc5ef6767e258a595a6cfe70e92c132e4b27e15a4d5a025339efff2ca083fa1b75b85bffe4833ad8a127

        Download Submit

      • C:\Users\Admin\Desktop\ResetCopy.doc.exe
        Filesize

        512KB

        MD5

        118a457ec964fa0702a1b26c7d71f2ca

        SHA1

        91f453eb65213a95252344d867dc1d163b87becc

        SHA256

        e3da57d6af9aad3dc3ab81f2be5012ce86665abbb3d2910a7d25517ecf8a0e43

        SHA512

        70569381506137f6963d98d22975ee8d995d5ea2b33339a62dd71379924fb6c49d3e6010bf33290d5bf160ee50b60eb0ce77e32bc562bb84abcabe2f756ec681

        Download Submit

      • C:\Windows\SysWOW64\dkrnsnjowpaom.exe
        Filesize

        512KB

        MD5

        4757038ecc0f0b94966287e8556daa65

        SHA1

        cd1cefc97945eeba4642a5cc95bb8ceff5f69fd5

        SHA256

        97d297ca54d707713dddd1b1702825da060e0ef512f91da93922dd5dd45e49f4

        SHA512

        9f20f0fd908fcc4b8fb6e71bba721e0cef32e5644f88d0bfe75f3a99e4eccbb113ed90a64e5a4e30c00cb78c35d88fb89e7f7d74690515bafe19ae1bf53583de

        Download Submit

      • C:\Windows\SysWOW64\dwefixygehnybig.exe
        Filesize

        512KB

        MD5

        e3690474e7ef9d441caf9d86603ed3ab

        SHA1

        39cb23d51faef661c73739f7912598c84789df24

        SHA256

        19871eea09fe77d487da670fd5bac5802098c072fdd0c9f5cbd3ea5178bbfd81

        SHA512

        f9ebca328001b7198cbe6ce59e89915fd2160290bbe703e26a6b5f2714ccc0ce9d7fc88af39a2dd8e9451496dfd0549b91c6f7a41207b6cdcc6364c6d24becca

        Download Submit

      • C:\Windows\SysWOW64\dwefixygehnybig.exe
        Filesize

        407KB

        MD5

        3dfb7c1dbe638e327f923b2d8ee73a42

        SHA1

        38e8a7b90286f01f9c7f3059ba4c8500b48ef24d

        SHA256

        e18621ee3c8616f683019118741ad96eff0bcbf003d7a1a33fa0aa77562a1c6c

        SHA512

        452dd62087f37d1b8c7d7e28f0be6880d0b10356693f5ca6a43f0d492ffe525dd7084e4252bce6ceb85090a9c6b44f4abba14d60ca80855846f47e291b3c9a5a

        Download Submit

      • C:\Windows\SysWOW64\gxebumot.exe
        Filesize

        512KB

        MD5

        fb021716402b163579f7f9e0a945e600

        SHA1

        9fe775cf6dcff7b252bbeace7f4bb90cbda36ab3

        SHA256

        9289818bf86bd7ab3b1e69b5c37d5ecd72c14f9ad9400484709934402149b6b4

        SHA512

        210829795c74b01086a398d3b918ee8973cd562dbdb3497dafd9889ccbaf4e653ce9b972b992065a2395dc45a5ae8b15769cfff861247c1ecb2591fc5fccfdd8

        Download Submit

      • C:\Windows\SysWOW64\lgfjdjgmow.exe
        Filesize

        512KB

        MD5

        c76a8388c35d9b9dd1ab67e87b0619f4

        SHA1

        5fc0ed5361fc6cf9094dad8d1302d88c4b1ebd84

        SHA256

        1e634cad92046a6055b3f25ca4c2411b024592b6bc6e29735b482dd4311a1728

        SHA512

        8b9e550d013ab68444d2ba6dbda85fedd62317c2add1b8889c7c46e048ba28890b3cf9ef9c7838e23fdb54affca479a3f9720c14cc8175e40931873f9b90c27d

        Download Submit

      • C:\Windows\SysWOW64\lgfjdjgmow.exe
        Filesize

        457KB

        MD5

        6145a2f054f828fde75a208028f81d77

        SHA1

        236052a265325d17c3ccdcf6696d41ef60207a20

        SHA256

        3a8327970d21ae65772bc302ef616896ecdfcf54e34745a510b56255dea0daa5

        SHA512

        3a5cb5ecb8230a4394fbcb8194656a16920cc0ac5c773bda5d25e0bf8db1d164b52365c8355aae1e792768aaf0ee6397c99eabf2acab3169775a991d8112afd2

        Download Submit

      • C:\Windows\mydoc.rtf
        Filesize

        223B

        MD5

        06604e5941c126e2e7be02c5cd9f62ec

        SHA1

        4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

        SHA256

        85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

        SHA512

        803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        Download Submit

      • \Windows\SysWOW64\gxebumot.exe
        Filesize

        348KB

        MD5

        cbff73b0ceea9ec35a3c9164961e7296

        SHA1

        0c30c72b0d29f743d6118b97abd90fca13e0c7cd

        SHA256

        05e82bb6bd6fdcb6973650245d56eb6d575835de9840b825d0374d5e6de8bf54

        SHA512

        2f88e4367083912b4ef2bbe40722c6415abcaf6bb6f5562e014a61de1040757ba2eb14f13c2ba1d6e87d508c458141a01e20766e529cdddfcd45a3d82b5c3ac1

        Download Submit

      • \Windows\SysWOW64\lgfjdjgmow.exe
        Filesize

        475KB

        MD5

        9a35a08eb521477f02b05fd3ee548ac0

        SHA1

        4a900929bd1854cee90bdba9b2ece89e0fe77316

        SHA256

        b6fbcc845b6d84b5f1341577f1f1f50887e22f22d4566103165daf0ce678f531

        SHA512

        3141d9a13de0ec6aca38c5658b610ca64c6c5bcff43768fb741dc70260419657f0b759dd9f287fb6c6173373b94b11ec2421724d35f96179d0d7743a059e873f

        Download Submit

      • memory/1356-47-0x000000007169D000-0x00000000716A8000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1356-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1356-45-0x000000002F2E1000-0x000000002F2E2000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1356-85-0x000000007169D000-0x00000000716A8000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1356-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1768-0-0x0000000000400000-0x0000000000496000-memory.dmp

        Filesize

        600KB

        Download