Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 19:21

General

  • Target

    a85144a2c4ed68d0e7ecfd200d018c4a.exe

  • Size

    512KB

  • MD5

    a85144a2c4ed68d0e7ecfd200d018c4a

  • SHA1

    f0035d0141735df4584ef1350bb5edb86c1d9502

  • SHA256

    d97b2ec5c1969d1c1704ffbf8bb9e36dac57545d353a61ad73c36d48607727c6

  • SHA512

    951e391705803ab960571e1da80f50bd743d21c9aed095c291daf46f2366ce32fde81376905cbab55599532f37cfedffcb43d3c77838e310e40a36c577c953e5

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj69:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5q

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 14 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 19 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a85144a2c4ed68d0e7ecfd200d018c4a.exe
    "C:\Users\Admin\AppData\Local\Temp\a85144a2c4ed68d0e7ecfd200d018c4a.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\SysWOW64\gicqfnthwk.exe
      gicqfnthwk.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Windows\SysWOW64\djdgljti.exe
        C:\Windows\system32\djdgljti.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2964
    • C:\Windows\SysWOW64\euknqqypysmqx.exe
      euknqqypysmqx.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2808
    • C:\Windows\SysWOW64\djdgljti.exe
      djdgljti.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1476
    • C:\Windows\SysWOW64\mgprebzqzivoevw.exe
      mgprebzqzivoevw.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4892
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3916

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

          Filesize

          485KB

          MD5

          b8ca5d41918be0a332ce0ba3ee0b2891

          SHA1

          ec82eae7f1fc69198a06c55d9132a57eec5c3dfb

          SHA256

          f0e0b0c74e46bc8cc0368f053f213a86f5e72d9a99455280d1630142807cfcb7

          SHA512

          2bdfc8ffd274da47c324e13faacb3316787bb0369f6922c3b8ac339ddd93101dbed1c10e4ba09788184904f0ccbeefa99047e3e32c81507bdee419e8e201ed31

        • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

          Filesize

          287KB

          MD5

          af529ad6e25b578e54ba7e001d79c1e7

          SHA1

          e9a459e17a5703dc0b9e5b1df0c67b5ffd5c1548

          SHA256

          b7a6830fe942cdf68669b3421c87ae5e1cf0233671e41f19dbd228450db01ce7

          SHA512

          7c0f497ff31d1ebd072c56f210ce97e2b3036d474b0d16a21770bc6491503994af529fb23df6e0b4c5a78f6e19d4d70580ec2df39db1834a85986411f1f9ec55

        • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

          Filesize

          239B

          MD5

          361ba5cdfe246f4303b0a1638e0daf43

          SHA1

          eced7199b1af3c8e92209a68cb9a925ff3f369a3

          SHA256

          507143acb38e64408d03a0dd98e16bd34ca557294c466ae8ec9c7c763eb3a2a5

          SHA512

          81b9d124396d138717aea4dc71cec59426a3b65b47eaa0d13523adf030c5e3df9fa670ed48f7634d0301812d4b546dd43bc5bf863b58112570a2ab049bc7ab54

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          1e50bfc02441e517e2262d5c27fce820

          SHA1

          86e302f0e61eb59eb9872dfed44d15a102d43b79

          SHA256

          495502d8f40d1dc21d6705dc8ff834977782d08a0f3b2698fba33c72a4e8b257

          SHA512

          3cd2ed038e112c73e98b0ab34a17b6284bf83a2626a75696ab4ffe8fee3b9b0f73715e33d6255c42719f95743907e766e033862a523b7e142ec2f89eba8be7ca

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

          Filesize

          3KB

          MD5

          f2afa840fd40cf402aa9eca9ea811871

          SHA1

          4efd5205f1427af6cfe16744f9700e0d34148f32

          SHA256

          60b8dc3bf0a75646391067af6fe6376e64d4c057f31c264bf0eaf82bf765a40f

          SHA512

          ab744e17dc2cd18b8cda7ae2cedd8ecc43f29a82a85ac0dafcd62849604131df1db3bd0c36a7c2d74a9b963abed72f43acb3055bc0f13fd2e5096088044427ca

        • C:\Windows\SysWOW64\djdgljti.exe

          Filesize

          148KB

          MD5

          26d0fe90522a5aa9d4386aff8286ae92

          SHA1

          87c05bbc00b45895773aedb30993b4e44d753f3d

          SHA256

          50eacaf6993684060002d40b24091a3d11c31e47009d645406801fc8bbdaa3db

          SHA512

          d65479998703a01128cc37896c8cac711e397840dbee31e255c189c4b3b7559e9e3085e11a4e0e2d439ad6b16932b7a0f15f5a488ce9b664e7cec6b517a1e825

        • C:\Windows\SysWOW64\djdgljti.exe

          Filesize

          73KB

          MD5

          3a81a11124e256ccf1aa17d99f5d87b1

          SHA1

          cb9eb79d3b0f96f17a3c69c6ffc8f5c39cad138e

          SHA256

          21f3e387caa9001c9d6244dda8db5b40a5bb74c07643f85753f08cae44b04566

          SHA512

          d7bf56829ec9647c5a21a45d7bc53f12be7e470f13ab802f1de6b83d71ff6afdb8cfe81ad26f94846a8fdc9d1ece4ce13b99883a5c25bcabae1e64f8bd046c22

        • C:\Windows\SysWOW64\djdgljti.exe

          Filesize

          142KB

          MD5

          d0d6227e3eff5309d000e366b5063a77

          SHA1

          cd72500fe9e67e69980b8353c1746b1ac952a1b9

          SHA256

          0dfaa5a941f32997e3d511a6f84ede24ee4ead6f5c1689b9087861959ba236eb

          SHA512

          1d4391f94f862d5c240690dbe4bc0851d7a12ad479e1d0b545bab786ccfe90df465a57e4b3d10300741a7b221b0b8027bbc8c63f6ad2d5a4e71b1525279e6f49

        • C:\Windows\SysWOW64\euknqqypysmqx.exe

          Filesize

          72KB

          MD5

          1ff9516954b686ea8a8bd388ff33e7c1

          SHA1

          b6372136b7dbe8357d0f7947abb638962ff46ddd

          SHA256

          9e015bb5b813665110cb96eb31298bd9e86cd98096d98a1625f0d63fd9e8e791

          SHA512

          f201d4d0652e8cdaca50d0ed700c8d166bac7bb57c08dd7bfcbbc6dca82a2167b9858433046b33b7428d5dccf83401f8fc300168320f4929dcaf37e75de79dc3

        • C:\Windows\SysWOW64\euknqqypysmqx.exe

          Filesize

          152KB

          MD5

          88428070f54083ed7c9eb62c09bfa146

          SHA1

          e624a26fa6669a1cc9dbf038b3531f6a22c46e26

          SHA256

          8167e3d3a94dc5d797285767dd447be371d07adc110d6551318ad2a9d77ce221

          SHA512

          d14edc5ad9a9b8ad3df9e1d36cb0bd40c4981a45f82f104a426238d23e32d96fb6fc4aae67b14e1e9fcccc52a0966b9635d65077efc9aa57853d485b46b4b3a6

        • C:\Windows\SysWOW64\gicqfnthwk.exe

          Filesize

          171KB

          MD5

          41c0170c2999b3b0e062a5f93a3adedc

          SHA1

          219558a479fc736a2df946baba3ba9f804d8a8b7

          SHA256

          f095077e34b1ae477d9cbfc33175f04de1e209c81410e7f22e05a882ae797947

          SHA512

          aebf2ae985c386f03ccb09cac37de1edb5899108837c0c508c9674beaf27d620ab3bce04ce9d1438e6bb675fbb16b9c81de27e0b39e3c1fb74d7c8b28b62a5ff

        • C:\Windows\SysWOW64\gicqfnthwk.exe

          Filesize

          92KB

          MD5

          53f2b30196288d450883c0ea994c9757

          SHA1

          5301cb14720838cecc31c7c1d6519b2fbbdb216b

          SHA256

          52eefeb04689c004a59ed5499cc5d81bad16315da15e04101b966cac4a8068f9

          SHA512

          cf55c5e972f22357f8b8ba11c93939d81f3e7a86ae5664f55928ff5ad2fb27b27effd43a6e2da2e1846d266f27eb666b54a5f0ad4a7885b7733ea477c5b844f6

        • C:\Windows\SysWOW64\mgprebzqzivoevw.exe

          Filesize

          149KB

          MD5

          1604295f37366f462b98320544ba7c0f

          SHA1

          ff229916c326614fdbd2717b3a7108b0a84da6a2

          SHA256

          5636ac611065dc7e30bad34ec872f05a4d20308104d2a463276096a16857228d

          SHA512

          798e1a04c8e3639b7efd713ebd168cd1b7e66acc0d7e327a29643467c0a3f03c74750d678bd4846aae50ec839cf5916ba7141d17cbaba88eb833a48dbe09f969

        • C:\Windows\SysWOW64\mgprebzqzivoevw.exe

          Filesize

          151KB

          MD5

          7f0eb36fa729254c94d00d3891e66fc5

          SHA1

          9e4c499e34bd47c8d858bd043c7cdf1e589dc7f4

          SHA256

          3ea8403a506b913c99202753d6b17c5dc7ae8b33ba587cacd7a40e5a9d94d8af

          SHA512

          3d8d66b6d812e9ae960883533ff6751d2ce8f005e2c5ae8d7b9e6b997da8a426fd2b4d8737707363dde79b02b0ee5c228f2d0cb422d15fa526c61c060c7e90f7

        • C:\Windows\SysWOW64\mgprebzqzivoevw.exe

          Filesize

          129KB

          MD5

          b9b1c58a708dea18b6b590848c98e344

          SHA1

          2e0fb6b0bb17be5a4f872b30e92fdfe8c1b4e924

          SHA256

          837469df3c12c204c1bafd6e5095fe5992663f23e7691b5e7ea722c905d6f6d4

          SHA512

          2321b04050aec4c958477e53062f22bd5609b4a9df610811d1471536ba9a4bf394f49252c8c2d9ef4074c171fb296298b528006a850a4d627129cf95281ed02d

        • C:\Windows\mydoc.rtf

          Filesize

          223B

          MD5

          06604e5941c126e2e7be02c5cd9f62ec

          SHA1

          4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

          SHA256

          85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

          SHA512

          803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        • \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

          Filesize

          245KB

          MD5

          551ffe1d933a2b0ca0e02270a9cb2db8

          SHA1

          c499d5d6d98bbb25b00d5eec4d1a2e2b43cf45fd

          SHA256

          4b4b30994da91e065c432839e6107e7aa3960ef7963819d94f5252e0517dc1ca

          SHA512

          89cf6db24a5a4fefef8befc571447629ec9f68071c317fc315b138cc0b24f143ccd6870f120081bb8d0c1dc1241f64d9a3f29bc0de5a430b626ae48dfe899982

        • memory/3052-0-0x0000000000400000-0x0000000000496000-memory.dmp

          Filesize

          600KB

        • memory/3916-43-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-38-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-55-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-54-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-56-0x00007FFCA45B0000-0x00007FFCA45C0000-memory.dmp

          Filesize

          64KB

        • memory/3916-57-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-59-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-60-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-58-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-51-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-50-0x00007FFCA45B0000-0x00007FFCA45C0000-memory.dmp

          Filesize

          64KB

        • memory/3916-44-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-42-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-41-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-39-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-53-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-37-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-52-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-49-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-48-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-47-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-46-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-45-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-40-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-102-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-124-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-125-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-126-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-127-0x00007FFCA6610000-0x00007FFCA6620000-memory.dmp

          Filesize

          64KB

        • memory/3916-129-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-128-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB

        • memory/3916-130-0x00007FFCE6590000-0x00007FFCE6785000-memory.dmp

          Filesize

          2.0MB