Overview

overview

10

Static

static

5

56e044d4c3...5b.exe

windows7-x64

10

56e044d4c3...5b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12-01-2024 15:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    56e044d4c3201d7da77a8d820d7dc15b.exe

  • Size

    512KB

  • MD5

    56e044d4c3201d7da77a8d820d7dc15b

  • SHA1

    8d92a2560df036f0436c0a50aa5e1be43b5328c1

  • SHA256

    9334bdb6affde65f0b8a08c160bf9ddf130c80928d041efd6ce3c098ddae4eab

  • SHA512

    8387f1d0447c0190ba6202795b2315515083924f955dbde6bf5bad1af4013304d96a64b83bf864c703a574154e214ae4bf817111ec24cbc6c4a8579f9ab186b2

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6L:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5e

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56e044d4c3201d7da77a8d820d7dc15b.exe
    "C:\Users\Admin\AppData\Local\Temp\56e044d4c3201d7da77a8d820d7dc15b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2392
    • C:\Windows\SysWOW64\hittbdgrnr.exe
      hittbdgrnr.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2900
      • C:\Windows\SysWOW64\djbhmnjq.exe
        C:\Windows\system32\djbhmnjq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2628
    • C:\Windows\SysWOW64\wajryoybrhgzpuw.exe
      wajryoybrhgzpuw.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2572
    • C:\Windows\SysWOW64\djbhmnjq.exe
      djbhmnjq.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2724
    • C:\Windows\SysWOW64\dwanevsmeejfs.exe
      dwanevsmeejfs.exe
      2⤵
      • Executes dropped EXE
      PID:2884
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2580
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2492

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      1b6fc5da65c75c2f2eb01521b210d8ad

      SHA1

      65a321e3cfec498a377f020bc9d9bcaff994b0c6

      SHA256

      0f089222c219b5979b6b5bddb41c03c0b0aaf9cd70786781aaa2bea74cfc61ad

      SHA512

      390d520f5367a8fb73926eb36c05c76bdfde34f3291250f4e783b03376f62cd6d27951b9b1c2be2de8df11bc40abe3e48d5ee375b93867d7913d378eb9e7b0ac

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      6c3bd68eb23ce25194de681a411ddfbb

      SHA1

      c8e8a7e0db4131f929abba0ac639b37da628e52c

      SHA256

      ccbca0e17ceaa9072b190b293cd634f164d4d79c0ec0ac709972561cf332ceae

      SHA512

      83a75ae463aaa841c679d53d05e8cd6ec4319ff2f9e19a814fd7687a4ec0433565d99600882cdeab7d4fc30fcddf9c29570e1df76c2ef37ed87b508371ab210e

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      b0871c02cca19340f73ad75b09aa7c95

      SHA1

      508022268034734f0d3a9157b187f1f7a046e787

      SHA256

      26d976e9ca26470bbcc652686062bce5c2a740c0cca5ddea3e1a71142e300a2d

      SHA512

      748a95542b31b20f8df9ec0330de014054afe8f11da2cfd1d2798f10e64029f5dd4e3ec9b384679d9562762ff7aad1bf04e3d21d752faafc468ca6c4753053bf

      Download Submit

    • C:\Windows\SysWOW64\wajryoybrhgzpuw.exe
      Filesize

      512KB

      MD5

      88f1303ccbda3b96cbf0bc9d3df52ee5

      SHA1

      9342fbaf55c8398864c72e10f2ec8bfc76c25b60

      SHA256

      a8b3347dc08ce179e3fa466652f180132f341bc2c7e6163b9c58f20ce60a23f1

      SHA512

      de1a0fa34b9d6160099a7e4814407c3a57176a2d4cbf2a10b5b82dfc022634e37254425537057b583801510d10af038722a02c060367e0d95b9ec899109307ae

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\djbhmnjq.exe
      Filesize

      512KB

      MD5

      e6ad6b22986f1d87d2d5503f64a1c8c7

      SHA1

      2e7cef1bdcf3e266f7876f72b2cd06139b7e192b

      SHA256

      f90976e1ee5865b4afe61aedf4d9aa9e0ca6e3e31431cc3d18537f0503583c44

      SHA512

      80451a3c775ae1ad6754917e09c43782c02fe7ff80a885d9b50a9348a8cfb6c99824f394eec699e44a99f80dfcb9ba96bbbc66df4841ea6fab512faea4d25cf6

      Download Submit

    • \Windows\SysWOW64\dwanevsmeejfs.exe
      Filesize

      512KB

      MD5

      59ac3f35d1fd69163cfb765ab32af01e

      SHA1

      fae1925d0f15a295452894164e06d21328b062d6

      SHA256

      d83eee39ffac5607620de1e2fcd741c4b4f1007f4cacf46e87f1182b5160cb25

      SHA512

      e1b5acb3d886728ab578bd65072ee527c3ffb8af37f8368b49233fc170835c266b4ae245958c99af6be2ca58014d23d952de60866145ec49c9a63d9cb02c8ce3

      Download Submit

    • \Windows\SysWOW64\hittbdgrnr.exe
      Filesize

      512KB

      MD5

      a02c8d6e96601d5664bc462783d5f10b

      SHA1

      5c91ce52c2d626507442e106431cf0293d6301ba

      SHA256

      db1791ed0dacf89c3455071a5af873d99818a036650a98ed1f0bc171562a68cc

      SHA512

      6f3fc35169d45655f409bb30e613f6ec30a75ff22803509528c12c643cf0f8c108056c300cf1a994e8d5586b578bf9b4ad24dadc69f1dacedd57a5a87c626796

      Download Submit

    • memory/2392-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2580-46-0x0000000070FDD000-0x0000000070FE8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2580-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2580-44-0x000000002F271000-0x000000002F272000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2580-82-0x0000000070FDD000-0x0000000070FE8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2580-103-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download