Analysis

  • max time kernel
    0s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:20

General

  • Target

    ad7a5d13335355b29d8ea0f3f2878aa4.exe

  • Size

    512KB

  • MD5

    ad7a5d13335355b29d8ea0f3f2878aa4

  • SHA1

    153204300260657de1724b4f6571724d8c49a17e

  • SHA256

    b262b9df3885d2b65839220bf0ff28ac8f889859fd056371a8435c31e84d2f7c

  • SHA512

    9cdc38bde5ecf397192b3e2190b677b33b9f8ca42f9e24b9d5eda4366f88460c7c23e8c7d2a4690f7097bcfbbe3f91258f094ec48ff72590a2fed8119d7fc2d1

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6R:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5c

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Windows security modification 2 TTPs 6 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad7a5d13335355b29d8ea0f3f2878aa4.exe
    "C:\Users\Admin\AppData\Local\Temp\ad7a5d13335355b29d8ea0f3f2878aa4.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Windows\SysWOW64\sedqhxonze.exe
      sedqhxonze.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Modifies WinLogon
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3016
      • C:\Windows\SysWOW64\jnhdippi.exe
        C:\Windows\system32\jnhdippi.exe
        3⤵
          PID:2668
      • C:\Windows\SysWOW64\spglagvmteyzxqc.exe
        spglagvmteyzxqc.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2724
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
          PID:2508
          • C:\Windows\splwow64.exe
            C:\Windows\splwow64.exe 12288
            3⤵
              PID:1708
          • C:\Windows\SysWOW64\isctssvucdjfd.exe
            isctssvucdjfd.exe
            2⤵
            • Executes dropped EXE
            PID:2688
          • C:\Windows\SysWOW64\jnhdippi.exe
            jnhdippi.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2060

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

                Filesize

                20KB

                MD5

                0cea8562c1c8813e310c831c969d6a4f

                SHA1

                d7e3119723a1694161d86ce09a6f752689af236c

                SHA256

                83aaa2f7964c5b15ca14002033e4d746bcaff93196a2883b114df9a4066561fd

                SHA512

                eb7f1791ebe5d32ab05759323cf77a46aa6ef2ef7797b77f170279455d1e2196251036ed9bd75c33869583c1297b3f9aab2371ff5960932f6770394f98853664

              • C:\Windows\SysWOW64\jnhdippi.exe

                Filesize

                92KB

                MD5

                6662b185f19fbf697c56a25c92de7961

                SHA1

                0df0c0df0de3724258df2549c583e3c934aca726

                SHA256

                c11edb9e97848e20319fba876d9382c7193f68323eff1f7ed805bb04303bdc86

                SHA512

                c6e2cb83f68a63ca299dae843d2697d41dab8b565fb4005755b0d255b388779b6c1dad97375009c995f0a3d2e0acb4cc820090ca5dc24ee11e1a3de5b1a4921f

              • C:\Windows\SysWOW64\jnhdippi.exe

                Filesize

                512KB

                MD5

                0a0846a1b1d06361151ab94d05d5c6c8

                SHA1

                b3c00db5280d830046a2b1dcdec7a5c82e132186

                SHA256

                617d0f092af9a0bf7ad4696060e5a867439ce896183dd11b1d539e2ae8acc7fe

                SHA512

                a9315851ee6de995af605dfe0cca5b0df02db05690964398eb0dcf1c47beb36d898f23fd2eef91ff4e4a23b5fc4d4edccf50b60a185a4eb4af8e9af612270712

              • C:\Windows\SysWOW64\spglagvmteyzxqc.exe

                Filesize

                512KB

                MD5

                9a7addefe11d860d9355f1ed0d8f80ab

                SHA1

                c4dab3ed23731d35edfed17a0c1baa074325644e

                SHA256

                acac40a4f7d7cce42f30c2dcc0b443dce599a1497d6d1dfd1dea1919707b2996

                SHA512

                842e89a8cd2b22268c2815d3c022c30ba762b68d6038270d0aad13a7506ccb7c5ab767a5b48a22912a95d3e69b6a3f375725895e0c84c549f0f1299728fa365b

              • C:\Windows\mydoc.rtf

                Filesize

                223B

                MD5

                06604e5941c126e2e7be02c5cd9f62ec

                SHA1

                4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

                SHA256

                85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

                SHA512

                803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

              • \Windows\SysWOW64\isctssvucdjfd.exe

                Filesize

                512KB

                MD5

                7546625059e6afddb354e2b79d02b5b8

                SHA1

                aa9ba8bbeec815758d027df42d661c9660d0785f

                SHA256

                03547ea2fad82b0b3762261f0e9fa06ee88516bdde6d15184807bb4f4bc22919

                SHA512

                0f91352d7d3d962cb80c3514b96bd08dee1a88aa028ca3dd6e94ec0e89b9df48d78b25cf843f7b0f333ca4033cab4eca4d98993e71980d8c45ebfd42e5375bc2

              • \Windows\SysWOW64\sedqhxonze.exe

                Filesize

                512KB

                MD5

                16876a7b264d720366fa0d8072cbbfc9

                SHA1

                66bc7200cc412fadbcba03e3123f90cf44ca36de

                SHA256

                8570de4fc971cb1c0e13b2841bff4491a489e032903499c675c35a82e101918e

                SHA512

                d5e43e5e406e7a682ac67615a98a785f9bd18fad1b240c9128471cc736f6ccd081194d02842a315026299673c70642f0d10b346f8094cc88edd2af06228cf0b7

              • memory/2044-0-0x0000000000400000-0x0000000000496000-memory.dmp

                Filesize

                600KB

              • memory/2508-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB

              • memory/2508-47-0x0000000070AFD000-0x0000000070B08000-memory.dmp

                Filesize

                44KB

              • memory/2508-45-0x000000002F5E1000-0x000000002F5E2000-memory.dmp

                Filesize

                4KB

              • memory/2508-74-0x0000000070AFD000-0x0000000070B08000-memory.dmp

                Filesize

                44KB

              • memory/2508-95-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB