Overview

overview

10

Static

static

5

53ff378496...64.exe

windows7-x64

10

53ff378496...64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2024, 16:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    53ff37849612f8403876d1c9c0fc6264.exe

  • Size

    512KB

  • MD5

    53ff37849612f8403876d1c9c0fc6264

  • SHA1

    adb76cd9d1da5d27e0d0479636d263e371ab3318

  • SHA256

    f5ac01c91a46a2349beda1ce04870c3abf28fd697d0cf946c8ffa3d24c2d29b1

  • SHA512

    9c4a8e00b51feca6161f6190f3b7182994024c163e5f826f3b3ce15699c367c3c7543fa7edab8c6a0556da39f08ec23c147fd3c1fe40baf8d32b894b595cab8b

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6q:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5n

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 17 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\53ff37849612f8403876d1c9c0fc6264.exe
    "C:\Users\Admin\AppData\Local\Temp\53ff37849612f8403876d1c9c0fc6264.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\SysWOW64\womjaielmh.exe
      womjaielmh.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Windows\SysWOW64\grqspqxk.exe
        C:\Windows\system32\grqspqxk.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2588
    • C:\Windows\SysWOW64\fokslnggxmyobqt.exe
      fokslnggxmyobqt.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3052
    • C:\Windows\SysWOW64\grqspqxk.exe
      grqspqxk.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2872
    • C:\Windows\SysWOW64\towbjjokudusb.exe
      towbjjokudusb.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2888
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2580
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    8fdcc285931dfb2e0746012eb5cbe642

    SHA1

    1f58a32222916a9df372dba20aade3bc649c3881

    SHA256

    3be1d8916c5d557dd6b7a5fc02a6c0affa01619e7a8d0d36394f059112b5c019

    SHA512

    f6fe45e4fa44d53a70cfca32040382734019e617494130f5637ee31731f86740be004128d479097cb8546ead42dddaaa3c215be4c0d1d04b31a3ff2f262db020

    Download Submit

  • C:\Windows\SysWOW64\fokslnggxmyobqt.exe
    Filesize

    149KB

    MD5

    5a1366d811460096a3c3f9960094826e

    SHA1

    73404ca8a2aad03e5abf7adeb6cbb311b2cf6a0a

    SHA256

    4e9231d36d7c9aadd6a627de644ddf942629f80c1d33739a9cdded3380bfca92

    SHA512

    95d7b50fe24e86d40df88c6c7c2c57c1e2a9575c3922316dc842e3cf41712b8f511a6602e83aa43b45e819dd85a0b853340e47055ea5d8e00794344328cb58e1

    Download Submit

  • C:\Windows\SysWOW64\fokslnggxmyobqt.exe
    Filesize

    330KB

    MD5

    823a0f48a437b531858878e96fcd4882

    SHA1

    a2e2c0068beeb2b8c5284efcee2bf22a42283db7

    SHA256

    0c08b142fd1beeb74134300137daf3305486234aaa97a83ace05a1f75813bf52

    SHA512

    807f6cbb71ad9dd2100cf7abaea6c448a84c49e7e688b4f8f8c444f8ad27d3a2e8530f4fdf538f5619c665c6fd7fc05bba161e4e35fb6ddcca61a8825376e1cb

    Download Submit

  • C:\Windows\SysWOW64\fokslnggxmyobqt.exe
    Filesize

    512KB

    MD5

    f927a9cf29c79ac9ba381bd5da6a7a57

    SHA1

    5dcc01ed415075022b9695fc914a6f9ba7276d38

    SHA256

    2676e3b719ebfc61a1c0981947b655a958fbafdee604f82468e7c66983c413c6

    SHA512

    89b335f168535c566ba766e168e043a295d2816c31c0f1f044208550e764aaf14a8a0378e50ffbf53dd1c7399081a1409855685ad16f7a8c643be6919af55ab3

    Download Submit

  • C:\Windows\SysWOW64\grqspqxk.exe
    Filesize

    218KB

    MD5

    4846e041410c7a40532b108113e320cd

    SHA1

    bd511bb5da38ae78963518adbf673b8d7987c4a7

    SHA256

    eef879153104d3fbe34620ae7c921be18811d0a62b8e065ee57b47386447bd6d

    SHA512

    21e763057839072f70301f5b56430f914c77faa4fbb7b9eb6f465ca7a111a85009d153c14763338bc040a5e9898eb6b5c85646cb347e153aebbef250790e6b6e

    Download Submit

  • C:\Windows\SysWOW64\grqspqxk.exe
    Filesize

    226KB

    MD5

    169e8b72ebf0cedb32c567f5cf1d6cd2

    SHA1

    366b76a4cefbfd44b73ae3cd6dd3d946397c1b48

    SHA256

    2ff1294655c1bf2c0ee885465af0c7912edcb71df48a77eb168efc374d15c44e

    SHA512

    9a36ebebc80a3437653e61cd1bfeaf740038e0849f60d7b31a17c42c0f1e34431ea77ac62660e686628c3f5b61b85c6dea1bf779b196ef6a7403e76a957f309d

    Download Submit

  • C:\Windows\SysWOW64\grqspqxk.exe
    Filesize

    226KB

    MD5

    2d97297b3463c04a7b2bd7fbbb8156bb

    SHA1

    90ccbf9c024ea1901c73aae12f09638f3c2f253a

    SHA256

    06cefd5fcee9504dbb1603a71ee45e2712da18ec885b95b1b0abb08399c882a3

    SHA512

    3b6093e7a9177b009be8448b62ff0bc852e98ff525cc919c46e8d5493627c9f1989b2d19e4b0e3acfc259cf9fb03467c8d6b8c236fbad66cd7c15a6d04225aa6

    Download Submit

  • C:\Windows\SysWOW64\towbjjokudusb.exe
    Filesize

    278KB

    MD5

    ff82042eafd31399903e7df4a281f722

    SHA1

    80130fc95f2439c79c8e126ef57a4ba81027c6c2

    SHA256

    ee37cb08d42416ed7921615de7baf3c9b534204809aaa38f4a9aa1e3946f1c85

    SHA512

    9b0ddaf01bb427b2f87dd0c8b930706543ca5fc5846753ec52cc6350765626d60bd15c6a06828371cf64988c7dba8b462a7a518e31156762d9ba32c3bf8aeccc

    Download Submit

  • C:\Windows\SysWOW64\towbjjokudusb.exe
    Filesize

    195KB

    MD5

    8167525ff8ac4ff9b648e521204babeb

    SHA1

    bc6dba902f49b077dd576a5467c5fb629e517181

    SHA256

    b4c077b8e8f58e924bd18dd9148c114c497e17307e79c44f247e6fbf1d202822

    SHA512

    760e8534656220d4f3b2cbd46b04564dc5c083e4c9f48f0191364dbca0bc2d0068791fd727852138a405fac413778b8332dcacf612666c87ce049b81906d425c

    Download Submit

  • C:\Windows\SysWOW64\womjaielmh.exe
    Filesize

    314KB

    MD5

    235c44f3188d57518e9b6b8e4b829e28

    SHA1

    98abe95c214a5d675669909c2676ff6b9b70c151

    SHA256

    be8205a160a697f29cbae406c8b1821238035599c056b686898df40eb5c2dbbc

    SHA512

    59299141d0e95f3b1af3af9b8767b9da11fd852997a77e30e63bd7803becc098cd5070b1b59a03cbd4a4f4a9575ccc27fc2d8719c7141c33a6e2ff760050cb0a

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    fe556dd77f4def5da693e90e76826a40

    SHA1

    3c708314472eb359a157cc729dee8516cbc648b0

    SHA256

    a375f0a1f4fec6c12b5f7b65fd83ecdc35ae28fff27d692efadaea83ceb53710

    SHA512

    726223554f5f7c9da8103860eafc3cf2cd2f134bac214c25ed5b3da00e3614977b0f69eb8b9389ae1ee5dfa9c03fcb73285ba9ef785338c4b4dcdeb297adc77a

    Download Submit

  • \Windows\SysWOW64\fokslnggxmyobqt.exe
    Filesize

    128KB

    MD5

    33be84de0fa03c6883fec2ead970e3ba

    SHA1

    dbe35ed4343779aa93200c24966ccb805e18f223

    SHA256

    ef0f2733bf476c4dc632a27627cb24681d552719aafcc969eec5db1a90996887

    SHA512

    3e93ab8677009d404503e243038ae323b1bc55af56c8c53bd3d44f5313ed4383c987ccb1f1f0e86111fc36db67c7b1b76de4eb4b1c6742baadffd70d7dc6c093

    Download Submit

  • \Windows\SysWOW64\grqspqxk.exe
    Filesize

    483KB

    MD5

    c58ec385c71bc691f2d38ae05e55fa4e

    SHA1

    656d1826a9e8577e3968dfa289e13075c8b45dfa

    SHA256

    78156779d3a607d21031e555e017c5d5766b0387ae2fc7ec893ff549b758d6bb

    SHA512

    dfa72cb559bba8f753f2bf7aa5e3c5ce72f64326404d54d28f85eddd45635fcab6880903ce353ebd123f0e98ee15579aacede21a97ea1ddc69c9266b27a37032

    Download Submit

  • \Windows\SysWOW64\grqspqxk.exe
    Filesize

    160KB

    MD5

    29bff36e2d3c21d104cf4b6773248532

    SHA1

    561946787d4deeba70a8b9cd7e2061f5872344e3

    SHA256

    7e24bbd4d177b346edbe9744737df27464a4516485d4547422946d6c19967770

    SHA512

    eabe96511a5ec35345025f1babdefd292015755d0667d019320f33d2e0abf32ef9e0de22ded7b1366a8e19f5948062bb3a2810d7ff2ab0933447702e52a75242

    Download Submit

  • \Windows\SysWOW64\towbjjokudusb.exe
    Filesize

    191KB

    MD5

    0a57104a3a202c7eec99d2a879dc88a1

    SHA1

    b2e29055f44ce3f17c5264cfb3da9a3f9b783297

    SHA256

    490aabb3d6629ddfe77a61b0b888fa0332914f7a03ecced60f6a3c3473d2022c

    SHA512

    62b4ce3946ea4f58e05ac586555db417cca1659993b0bcf6a217808fff58d60519ab73d313c4ea30bfb40ed6f102b2cb7bfb0e6bff536b11c8eaa02ee68b8de2

    Download Submit

  • \Windows\SysWOW64\womjaielmh.exe
    Filesize

    512KB

    MD5

    dc5491ef234f3001c935569aa24b90d9

    SHA1

    2c9d3705dd301067545df8a8fc8dfaaf16290e0b

    SHA256

    dd1b11fe35ff4d12cbeb648a1f5ad5904f07a11a6da631fa5836979cbd52d18c

    SHA512

    9f67a767d5c69342e2ba2e6e17e0081678c15c6570913182d849efbcb348c0eb24434bcfc464244a961c8da18251d7c0dac2126d6b6f04f3b1f54990752300cc

    Download Submit

  • memory/1584-80-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1584-88-0x0000000002600000-0x0000000002610000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1584-83-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1708-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2580-45-0x000000002F741000-0x000000002F742000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2580-81-0x000000007175D000-0x0000000071768000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2580-47-0x000000007175D000-0x0000000071768000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2580-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download