Analysis
- max time kernel
0s - max time network
118s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
07/01/2024, 19:38
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
a666831d63d7e13bb8d76596308db7d6.exe
Resource
win7-20231129-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
a666831d63d7e13bb8d76596308db7d6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target a666831d63d7e13bb8d76596308db7d6.exe
- Size 512KB
- Sample240107-yctnpsdfe3
- SHA256 947142ee17bbb69b1b24f90ce034caef13fae7f4e1cd62bba7d9838c1f64a7f5
- MD5 a666831d63d7e13bb8d76596308db7d6
- SHA1 0f8e72da4e1304aaa4f857d1c97a12ec49525d5c
- SHA512 261e5b332c0f4f30e20b587850f9ece3a2f745432af954041752071f73c28a255a537d721bfdce6b9657137833cd859b8bd7b9eab721b09da7e988275d0a250d
- SSDEEP 6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" uaohvduxzi.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" uaohvduxzi.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" uaohvduxzi.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uaohvduxzi.exe - Executes dropped EXE 4 IoCs
pid Process 2836 uaohvduxzi.exe 2540 rgrvczkxjxvvvyr.exe 2644 vwyqxwvi.exe 2604 nogspecrhncow.exe - Loads dropped DLL 4 IoCs
pid Process 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" uaohvduxzi.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" uaohvduxzi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" uaohvduxzi.exe - AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2372-0-0x0000000000400000-0x0000000000496000-memory.dmp autoit_exe behavioral1/files/0x000a00000001220d-17.dat autoit_exe behavioral1/files/0x000a0000000126e1-5.dat autoit_exe - Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\nogspecrhncow.exe a666831d63d7e13bb8d76596308db7d6.exe File opened for modification C:\Windows\SysWOW64\nogspecrhncow.exe a666831d63d7e13bb8d76596308db7d6.exe File created C:\Windows\SysWOW64\uaohvduxzi.exe a666831d63d7e13bb8d76596308db7d6.exe File opened for modification C:\Windows\SysWOW64\uaohvduxzi.exe a666831d63d7e13bb8d76596308db7d6.exe File created C:\Windows\SysWOW64\rgrvczkxjxvvvyr.exe a666831d63d7e13bb8d76596308db7d6.exe File opened for modification C:\Windows\SysWOW64\rgrvczkxjxvvvyr.exe a666831d63d7e13bb8d76596308db7d6.exe File created C:\Windows\SysWOW64\vwyqxwvi.exe a666831d63d7e13bb8d76596308db7d6.exe File opened for modification C:\Windows\SysWOW64\vwyqxwvi.exe a666831d63d7e13bb8d76596308db7d6.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf a666831d63d7e13bb8d76596308db7d6.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf uaohvduxzi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg uaohvduxzi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1939C7081493DBC4B8CD7CE2ECE237CA" a666831d63d7e13bb8d76596308db7d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat uaohvduxzi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" uaohvduxzi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32462C799C2683576D4376D477232DD67C8464AB" a666831d63d7e13bb8d76596308db7d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCEFACAFE16F2E483083A4B86E93E99B0FC03FC4215023FE2C845E909A8" a666831d63d7e13bb8d76596308db7d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F368B4FF1D22DFD109D0D18A759165" a666831d63d7e13bb8d76596308db7d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc uaohvduxzi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" uaohvduxzi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" uaohvduxzi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" uaohvduxzi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" uaohvduxzi.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes a666831d63d7e13bb8d76596308db7d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFFFF88482782129047D75B7D96BCEFE143593267446331D6EA" a666831d63d7e13bb8d76596308db7d6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh uaohvduxzi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB6B02D44E738E352BDB9D53393D7CF" a666831d63d7e13bb8d76596308db7d6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" uaohvduxzi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs uaohvduxzi.exe - Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2836 uaohvduxzi.exe 2836 uaohvduxzi.exe 2836 uaohvduxzi.exe 2836 uaohvduxzi.exe 2836 uaohvduxzi.exe - Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2836 uaohvduxzi.exe 2836 uaohvduxzi.exe 2836 uaohvduxzi.exe 2540 rgrvczkxjxvvvyr.exe 2540 rgrvczkxjxvvvyr.exe 2540 rgrvczkxjxvvvyr.exe 2644 vwyqxwvi.exe 2644 vwyqxwvi.exe 2644 vwyqxwvi.exe - Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2372 a666831d63d7e13bb8d76596308db7d6.exe 2836 uaohvduxzi.exe 2836 uaohvduxzi.exe 2836 uaohvduxzi.exe 2540 rgrvczkxjxvvvyr.exe 2540 rgrvczkxjxvvvyr.exe 2540 rgrvczkxjxvvvyr.exe 2644 vwyqxwvi.exe 2644 vwyqxwvi.exe 2644 vwyqxwvi.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2836 2372 a666831d63d7e13bb8d76596308db7d6.exe 22 PID 2372 wrote to memory of 2836 2372 a666831d63d7e13bb8d76596308db7d6.exe 22 PID 2372 wrote to memory of 2836 2372 a666831d63d7e13bb8d76596308db7d6.exe 22 PID 2372 wrote to memory of 2836 2372 a666831d63d7e13bb8d76596308db7d6.exe 22 PID 2372 wrote to memory of 2540 2372 a666831d63d7e13bb8d76596308db7d6.exe 15 PID 2372 wrote to memory of 2540 2372 a666831d63d7e13bb8d76596308db7d6.exe 15 PID 2372 wrote to memory of 2540 2372 a666831d63d7e13bb8d76596308db7d6.exe 15 PID 2372 wrote to memory of 2540 2372 a666831d63d7e13bb8d76596308db7d6.exe 15 PID 2372 wrote to memory of 2644 2372 a666831d63d7e13bb8d76596308db7d6.exe 21 PID 2372 wrote to memory of 2644 2372 a666831d63d7e13bb8d76596308db7d6.exe 21 PID 2372 wrote to memory of 2644 2372 a666831d63d7e13bb8d76596308db7d6.exe 21 PID 2372 wrote to memory of 2644 2372 a666831d63d7e13bb8d76596308db7d6.exe 21 PID 2372 wrote to memory of 2604 2372 a666831d63d7e13bb8d76596308db7d6.exe 19 PID 2372 wrote to memory of 2604 2372 a666831d63d7e13bb8d76596308db7d6.exe 19 PID 2372 wrote to memory of 2604 2372 a666831d63d7e13bb8d76596308db7d6.exe 19 PID 2372 wrote to memory of 2604 2372 a666831d63d7e13bb8d76596308db7d6.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\a666831d63d7e13bb8d76596308db7d6.exe"C:\Users\Admin\AppData\Local\Temp\a666831d63d7e13bb8d76596308db7d6.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\rgrvczkxjxvvvyr.exergrvczkxjxvvvyr.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2540
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"2⤵PID:2684
-
-
C:\Windows\SysWOW64\nogspecrhncow.exenogspecrhncow.exe2⤵
- Executes dropped EXE
PID:2604
-
-
C:\Windows\SysWOW64\vwyqxwvi.exevwyqxwvi.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2644
-
-
C:\Windows\SysWOW64\uaohvduxzi.exeuaohvduxzi.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2836
-
-
C:\Windows\SysWOW64\vwyqxwvi.exeC:\Windows\system32\vwyqxwvi.exe1⤵PID:804
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\rgrvczkxjxvvvyr.exe
- Size 92KB
- SHA256 d251f3126813d9f42461b0d23153c37c405979347a47fb0f04e0503beaf31a06
- MD5 59ebf1358a9b829f5709baaedeeee6fa
- SHA1 1409fd65da1b814db0a08feae54366dfca196f1c
- SHA512 a2d71b94a087aa6d376f4f065d9f7ff987fd50ea93949372fa9ef5b6692b45cef7ae267c88376b9d2953e4476496f67af1173e9f0f8ba81101dc94c6872cf417
- SSDEEP 1536:1VY0W0/xYGG2BIUuR1v7hvFPRVaai49TRIKl/75k3Jeu0Fyg4nJOWkkOBC3nh/4w:1VY0W0/2RbBxRVaaNRR/dkAiQkOBC31z
- MD5 SHA1 SHA512 SSDEEP