Overview

overview

10

Static

static

5

aa2cab0241...e5.exe

windows7-x64

10

aa2cab0241...e5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:41 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    aa2cab0241781a572a4dc3e33bfe73e5.exe

  • Size

    512KB

  • MD5

    aa2cab0241781a572a4dc3e33bfe73e5

  • SHA1

    276b64512c473f9015938b249498a2635608f5d1

  • SHA256

    fe77ab007c8ae2130dafffab4e8fd2545abc3736cfc028f45b573848a08051f5

  • SHA512

    abf6113b00cb8ad96eace6f21bbac4644b36bbfb5090accc960d5b9c4657c910756c12b6168ecbb9b2522b48d5699b95b8d1a26010a93fe2c477f10ee797e790

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6J:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm58

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa2cab0241781a572a4dc3e33bfe73e5.exe
    "C:\Users\Admin\AppData\Local\Temp\aa2cab0241781a572a4dc3e33bfe73e5.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2132
    • C:\Windows\SysWOW64\wrkenkzxle.exe
      wrkenkzxle.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\SysWOW64\dufrdmmx.exe
        C:\Windows\system32\dufrdmmx.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2580
    • C:\Windows\SysWOW64\uggvylnfkgdjeqd.exe
      uggvylnfkgdjeqd.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c isnnodddggcec.exe
        3⤵
          PID:2620
      • C:\Windows\SysWOW64\dufrdmmx.exe
        dufrdmmx.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2716
      • C:\Windows\SysWOW64\isnnodddggcec.exe
        isnnodddggcec.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2088
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:1668
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1908

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
        Filesize

        345KB

        MD5

        fa8d7303b284fc8c3f123f360409ff48

        SHA1

        2427d86d58417ba071557a21ccb584b21603fa16

        SHA256

        0cd405789a220323a4d5f1bfbb80d6c64961c355de4b8184a827785d4a8cb0ca

        SHA512

        419f09a228509b8ae6d2d14ed8b790ef6668d5a1cd144622c53b4683be5a6de7ade779aece4553da0dc322e229b90f3db4efb66984ffff74ef9f412b0e841190

        Download Submit

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
        Filesize

        290KB

        MD5

        a90ef7e2a47dc0136d408bca04850302

        SHA1

        ec79dbfa432fa0850529b59e7e42d3ce2eb8e803

        SHA256

        344eaa3ab29eb42288d6df53fa1328f38277ce981b0cd8d66a374ae298cee336

        SHA512

        8c5be93b87046ecfd4af55f31a51eec7623cf76f8cfa562aedb051c7eedb10a9438b482d996afd4d9f0a7a5911a9a8d8d0515586789f37ace43bd27c2b9348f2

        Download Submit

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
        Filesize

        349KB

        MD5

        040d3416ee3ec4f6c54ef8d1d9be80fe

        SHA1

        b93791e0509601cf0b4378a3d086b26eb2e47191

        SHA256

        e934d47a0e38e6a3b2038f671b341f7fe7f613743062c5c99d6cac0a44ec87ec

        SHA512

        a9f727ced3b860afaa8dc7a1a4bedfebfdf3590ea0f06b5f6ea207186d95960d2c3ee27c0a2baf58cc7fa68a4a33314a802413120294da215e5c975bc298961c

        Download Submit

      • C:\Users\Admin\AppData\Roaming\CompleteApprove.doc.exe
        Filesize

        115KB

        MD5

        fa2d24f92a00dcc44de28115005c4bb2

        SHA1

        e88c4892e8d8c4a045d9d683b482e05fcf6abba9

        SHA256

        11380c8aadfb49938368617488320d28235a21162811220faedec380c79f1e5c

        SHA512

        1f7e5be3db780c17cc15622a06bcfdec5607cf7789a91bc00f6133496b938a098baf54d9d15c365c8986e412f65b32840e1abbb9eb06afced44755eb4d1c7db8

        Download Submit

      • C:\Users\Admin\AppData\Roaming\CompleteApprove.doc.exe
        Filesize

        128KB

        MD5

        33be84de0fa03c6883fec2ead970e3ba

        SHA1

        dbe35ed4343779aa93200c24966ccb805e18f223

        SHA256

        ef0f2733bf476c4dc632a27627cb24681d552719aafcc969eec5db1a90996887

        SHA512

        3e93ab8677009d404503e243038ae323b1bc55af56c8c53bd3d44f5313ed4383c987ccb1f1f0e86111fc36db67c7b1b76de4eb4b1c6742baadffd70d7dc6c093

        Download Submit

      • C:\Windows\SysWOW64\uggvylnfkgdjeqd.exe
        Filesize

        512KB

        MD5

        8302530a084d4948728d6bb52ebefeb6

        SHA1

        363116361a5aa0e19aa51562a96866aa4192ba21

        SHA256

        d0d172e32f4a4f1b722d57d7f8bed6aa450040c0e8de655787b43d07291985cd

        SHA512

        241e8b42d433b6c57cefc400945b80ccd8cf6aadd6de2c3f3bcb0d8ace468bfeda9d994a99b1699293ec4942da35bc9beb12a0c9dd3e5b9dec776482bcd5db71

        Download Submit

      • C:\Windows\mydoc.rtf
        Filesize

        223B

        MD5

        06604e5941c126e2e7be02c5cd9f62ec

        SHA1

        4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

        SHA256

        85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

        SHA512

        803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        Download Submit

      • \Windows\SysWOW64\dufrdmmx.exe
        Filesize

        512KB

        MD5

        d1dc039f2b1e6d6232fb1f7488ab0913

        SHA1

        27cecaa1dea02a3b8020a629072be3c5d4a2ee80

        SHA256

        f844666a818592f07826f4e0fcb701578f3ef41006f18f42239e00357fdc102c

        SHA512

        cb95d3d75544df1083b08d65ffe88ed248c1db7432dfc89ddc1ff7d1be517f65b58e024c7c34c0d3e1b9f70aefa3a2d4faa6167407ec47ad813c81323218af23

        Download Submit

      • \Windows\SysWOW64\isnnodddggcec.exe
        Filesize

        512KB

        MD5

        d710964a1ae480a0ed188a88bfca1db1

        SHA1

        d4c970006552f043a535ea7b164b09f6bd3142d2

        SHA256

        e1b88b11591ca95539010f394b88d7cfa9399b6c321ca6dd5629a5b65455d478

        SHA512

        cea510bb58c17d624ecaa54765bc67c0f8bf59947af58adcf3d40f0659760763fc88d87cc66e845f2e74c87ad880423cbabf7167fe2dfa12bf7d928cc8c45b68

        Download Submit

      • \Windows\SysWOW64\wrkenkzxle.exe
        Filesize

        512KB

        MD5

        033476cc9660f0132fa3903cdb77de41

        SHA1

        c1c8630bea41dcad744512ccfe122bc911436e17

        SHA256

        69a5d21203eda660de583be254fdae9528514e6a2186ac428dd9f7a48d5aff8a

        SHA512

        6c89d3c140edf2559f839c2472f41ef2a6fe61c679c12b04095307b64e6b99344874e1b6321303c83b229ed3fb16c406bc0bb5e9387ee2adc4cf36945545fd5a

        Download Submit

      • memory/1100-47-0x000000007126D000-0x0000000071278000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1100-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1100-45-0x000000002FCC1000-0x000000002FCC2000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1100-79-0x000000007126D000-0x0000000071278000-memory.dmp

        Filesize

        44KB

        Download

      • memory/1908-78-0x0000000003FC0000-0x0000000003FC1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1908-81-0x0000000003FC0000-0x0000000003FC1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1908-86-0x0000000003950000-0x0000000003960000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2132-0-0x0000000000400000-0x0000000000496000-memory.dmp

        Filesize

        600KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.