Analysis
- max time kernel
21s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
07/01/2024, 19:34
General
- Target aa2e5e8ccb35844fe45afca446afa078.exe
- Size 512KB
- Sample240107-x926nsdee7
- SHA256 0951f2832775255ea973eb4b51d66158834c3a6e05cc6c66b04e6449233e2910
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 8 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of FindShellTrayWindow 13 IoCs
- Suspicious use of SendNotifyMessage 13 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa2e5e8ccb35844fe45afca446afa078.exe"C:\Users\Admin\AppData\Local\Temp\aa2e5e8ccb35844fe45afca446afa078.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wqnxhvsetv.exewqnxhvsetv.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\qtamchrj.exeC:\Windows\system32\qtamchrj.exe3⤵
-
-
-
C:\Windows\SysWOW64\zwjmkiuxdjfhf.exezwjmkiuxdjfhf.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\qtamchrj.exeqtamchrj.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\xtlbctrpisttxov.exextlbctrpisttxov.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1852-0-0x0000000000400000-0x0000000000496000-memory.dmp
memory/3304-37-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp
memory/3304-41-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp
memory/3304-44-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-47-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-48-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-49-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-50-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-51-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-52-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-46-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-45-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp
memory/3304-53-0x00007FFA73690000-0x00007FFA736A0000-memory.dmp
memory/3304-43-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp
memory/3304-42-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-40-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-39-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp
memory/3304-54-0x00007FFA73690000-0x00007FFA736A0000-memory.dmp
memory/3304-38-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-107-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-108-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-140-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp
memory/3304-142-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-145-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-146-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-144-0x00007FFAB5F70000-0x00007FFAB6165000-memory.dmp
memory/3304-143-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp
memory/3304-141-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp
memory/3304-139-0x00007FFA75FF0000-0x00007FFA76000000-memory.dmp