Overview

overview

10

Static

static

5

4a3fb4e1f4...e1.exe

windows7-x64

10

4a3fb4e1f4...e1.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    45s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08-01-2024 02:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a3fb4e1f4f9b3ca096d79c97a8919e1.exe

  • Size

    512KB

  • MD5

    4a3fb4e1f4f9b3ca096d79c97a8919e1

  • SHA1

    7f44fd0c2627a885eba16025c681eb0b8dfbf38d

  • SHA256

    bf8d972cd7da52d8e6ce3c79996c1f444ce57fbce63d44329abe13c2bfba31d8

  • SHA512

    dfc33f856fb658106f392ca0b589b91a60d24a544ad683b5cb960db7b6e6e3348af527be372402e68f5ba5638500c0027bc9b68b99f82d907a55392fba568e84

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6u:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 10 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a3fb4e1f4f9b3ca096d79c97a8919e1.exe
    "C:\Users\Admin\AppData\Local\Temp\4a3fb4e1f4f9b3ca096d79c97a8919e1.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Windows\SysWOW64\rtxymzwyrt.exe
      rtxymzwyrt.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\SysWOW64\wyjxqrje.exe
        C:\Windows\system32\wyjxqrje.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2828
    • C:\Windows\SysWOW64\ujdgekxbwcqcy.exe
      ujdgekxbwcqcy.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2592
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1240
      • C:\Windows\SysWOW64\wyjxqrje.exe
        wyjxqrje.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1692
      • C:\Windows\SysWOW64\ufkufpwgfbhipev.exe
        ufkufpwgfbhipev.exe
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2260

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      1b471a3426a7af9f8b25f80ce35b4c49

      SHA1

      c5ae12ba579328b9ee3bce94be68a2d23fe636a6

      SHA256

      61c489f47a312df7f67890f03a4a1647d791e0b8b9a9d95ecc8f03c6a7e9c3d1

      SHA512

      9a39fdd565bb211a12d6c3a3583b83d9224e464cc65600b21bd1a48d6524ec0a45fdc3feb61385041364c80272277dbb34fbb74282278dbcafd3580c88fab848

      Download Submit

    • C:\Program Files\OutClose.doc.exe
      Filesize

      512KB

      MD5

      8810c9f8fc274002ed08ab50688b29cd

      SHA1

      5a5798b6d1f508934ca8a8ec3326725b165b591f

      SHA256

      ec360311f90805a369b7101eb8a372a40f63baebf2d3f477a8eb636baf2c0e59

      SHA512

      598c3891cde630d8fd6ef7ee82678095a9dc33e4a91aa164200af71d9f5c3211493504a6a1d5acb16870fab6a8b0b8794cfeec4732affb9a3416edfa986e71e8

      Download Submit

    • C:\Users\Admin\Documents\RestartSend.doc.exe
      Filesize

      512KB

      MD5

      90421a229033d524ae78b60b8bdc625d

      SHA1

      c8b500495d65b7aeb0f248af85d86a7cfd63b043

      SHA256

      eceaa3f9d40b93d099e0db9ece62ee54657027a446099dc598ad98ad3628807c

      SHA512

      bb92b1d767d1e4706cf103621a9754baccd76d0e39d9daa9b690c93bec725f5c06f86ae5310f4a33df4d05935c72de7a45b5185ac426dc01df0b005348a8ea89

      Download Submit

    • C:\Windows\SysWOW64\ufkufpwgfbhipev.exe
      Filesize

      512KB

      MD5

      9d3ec906986b988a7bdb8b66c087526b

      SHA1

      3441deeb4040dca852b8fea2a9b01a36542b30bc

      SHA256

      25d8874b8c4280f16e9f7ea9982d8359b32ceef0a76b0688be31a84990d4b62a

      SHA512

      72f28b31b9ef4c3442ed1c4c24d27816047807c4c141174c9b57c612692c3be84ec3c9e032561c3d85d2ffe780d7e31d378d93eff2e7adcd4fa9cd0f6b4c170f

      Download Submit

    • C:\Windows\SysWOW64\ujdgekxbwcqcy.exe
      Filesize

      512KB

      MD5

      d52061dd9649a58a1e7b862241ab3d66

      SHA1

      41d4830d1e75cf8acaa4d195119a11426bda7204

      SHA256

      50c5bdf5ceae03721a37f6d8726d01621d4d6655f47adc3e8170d1bb7683816a

      SHA512

      ea0a9a78b948298a90b66d2c781594d0c9cc9123c311c4386b8b12c598a01491e2089a778195698a940741e1305664b5fb707662ffed784bbed3e65ef00a6083

      Download Submit

    • C:\Windows\SysWOW64\wyjxqrje.exe
      Filesize

      512KB

      MD5

      dd73b65ce408e827ee576de0ba902a97

      SHA1

      95f57c19b42068678bbe8128d9a3050a678cc64d

      SHA256

      9ecd1ccaaebee2ebdfbc22e05f3cfde460f2deadbb0299ff7327f2792c872868

      SHA512

      db80f788edba79aa03bcff58213cb6cc7728fc17ea808c09a74b130626898a96be4a3d3cb4926c912c5a70891847d53ca08018ce3477880d0f1ff04ae07968e1

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\rtxymzwyrt.exe
      Filesize

      512KB

      MD5

      ffc88df7a39230958bb149161cc208e5

      SHA1

      b369c4d45fe70e5601ad2b74c316db84297d98ce

      SHA256

      de22947908c3b288d860abb11e64083148f1d980ec4505baade49ce4abb529f0

      SHA512

      2ff078f5b457a690b46bd9e08b6abb96f793e3d0bb4a73e8c27c82b3aca7cef76eb5cd9d46deb1ba4197e84e6c7fb0641ea9b62c607cfaa3ab4a0c6c011ec1f7

      Download Submit

    • \Windows\SysWOW64\ujdgekxbwcqcy.exe
      Filesize

      88KB

      MD5

      fe3610a36cd9da0eac4429c71a94cc5a

      SHA1

      d42992454b608e441faed2238ec6dcdb931c8d10

      SHA256

      bfc9ee547eba543225181d9a4544f7eef9aeb965cd34eeabdfd8cdc591d0e46c

      SHA512

      fafc6cb70172cb59a50d6c5c43dedc96038f63a8fdf3da609a62f22a6eb619ea008cc7d1a9b5a7001ca52f579dd977229f9307c2e6c26689d9d062c2d6fd089b

      Download Submit

    • \Windows\SysWOW64\wyjxqrje.exe
      Filesize

      361KB

      MD5

      a4129fa7836c449d34c9207b2398ac6e

      SHA1

      209c419ddb57cea3266409f2f9bf58bda8c887f3

      SHA256

      8a8ddf7403d518c136b023cc8f65eb786bbf6f974146e29c6441ade2befe16ce

      SHA512

      410848f6b6a4229d27f2fc09ba5a9642bd95da8497e2942793a24670e6355165995063e0f13bc57998e173dc33813bc3806c16155f25bd3b872235006a7649dd

      Download Submit

    • memory/1764-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2476-47-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2476-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2476-45-0x000000002FCF1000-0x000000002FCF2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2476-87-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2476-108-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download