Analysis
- max time kernel
0s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
07/01/2024, 19:33
General
- Target a8541dc02112e2f872a6adf0a6f18c22.exe
- Size 512KB
- Sample240107-x9nchsdec7
- SHA256 3fff49603d07d802cfb1e2a5e00f27b2de20794449d9ffdf66d95bdaab880af3
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 8 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8541dc02112e2f872a6adf0a6f18c22.exe"C:\Users\Admin\AppData\Local\Temp\a8541dc02112e2f872a6adf0a6f18c22.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\qvdlchhbynvwn.exeqvdlchhbynvwn.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
-
-
C:\Windows\SysWOW64\epedmuzl.exeepedmuzl.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\orohbxhnfdbviea.exeorohbxhnfdbviea.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\azcpljrloz.exeazcpljrloz.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\epedmuzl.exeC:\Windows\system32\epedmuzl.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
orohbxhnfdbviea.exe
memory/428-0-0x0000000000400000-0x0000000000496000-memory.dmp
memory/3904-58-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-42-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp
memory/3904-51-0x00007FFF707B0000-0x00007FFF707C0000-memory.dmp
memory/3904-54-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-56-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-57-0x00007FFF707B0000-0x00007FFF707C0000-memory.dmp
memory/3904-44-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp
memory/3904-59-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-55-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-53-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-52-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-50-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-49-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-48-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-46-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-45-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-47-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-40-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp
memory/3904-43-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-41-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-38-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp
memory/3904-36-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp
memory/3904-39-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-125-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-126-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-127-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-152-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp
memory/3904-154-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-155-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-153-0x00007FFFB2B10000-0x00007FFFB2D05000-memory.dmp
memory/3904-151-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp
memory/3904-150-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp
memory/3904-149-0x00007FFF72B90000-0x00007FFF72BA0000-memory.dmp