Overview

overview

10

Static

static

5

7822ab79c4...28.exe

windows7-x64

10

7822ab79c4...28.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 18:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7822ab79c42b8084d8e1ea3b498d6828.exe

  • Size

    512KB

  • MD5

    7822ab79c42b8084d8e1ea3b498d6828

  • SHA1

    4ba32b1fe142cc8fcffb4fd5d3947ad78920e016

  • SHA256

    0db52b09c8c7c64c51c8923c1c7580e2f27b70e91172b00b20ccdceab99dfb33

  • SHA512

    d4fa69712661dd9c5125d770a8944f9a06f09d325c6393d4177f1c94fc246f5bd00a451dc24702bbd7875ffa719eea5c0d2ecf6b2ff3fd22b3d743cc4f8e7a85

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6N:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\7822ab79c42b8084d8e1ea3b498d6828.exe
    "C:\Users\Admin\AppData\Local\Temp\7822ab79c42b8084d8e1ea3b498d6828.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\SysWOW64\ulxorurwts.exe
      ulxorurwts.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Windows\SysWOW64\lqdhlpbk.exe
        C:\Windows\system32\lqdhlpbk.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2612
    • C:\Windows\SysWOW64\qipaaydeizpyype.exe
      qipaaydeizpyype.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2868
    • C:\Windows\SysWOW64\lqdhlpbk.exe
      lqdhlpbk.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2732
    • C:\Windows\SysWOW64\aitqcpihkvpfq.exe
      aitqcpihkvpfq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2892
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2276
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    0c2cd520fe714f2804d5332fe77cf5b9

    SHA1

    d974581f2c5d130627d2e6274cdebe6bd74a2f18

    SHA256

    7720edfa77561c6c62491f27e8872296d2772a199fcd03377028569962e4da1d

    SHA512

    8e2d040febb31fd90c9a0652ac14f2e278dfb79ef1ed187a19cb73c231fab6476117ef6e0c16694e8d3582eb0cf0cfd234b0f553617c0f71ec3994190f0ec652

    Download Submit

  • C:\Users\Admin\Desktop\ImportConfirm.doc.exe
    Filesize

    512KB

    MD5

    dc5495733149b4b7583911f2de6095f7

    SHA1

    03a7e144aca2cac65f11cffe66193b9beae55900

    SHA256

    e859539c8c5075fcc2da32b52ccc6a26496802af3fc2665c135a91393c6aec79

    SHA512

    d777be218efdcc2e150f075738a4c386247fb72e8960f8a7d382c956b8aafdc0fffddfd7c1d3a34f4febdc7e3b0f12c3340c3b53169e273493b5197b4dceacc8

    Download Submit

  • C:\Windows\SysWOW64\aitqcpihkvpfq.exe
    Filesize

    512KB

    MD5

    fe53bb2b461b253e546861c7aa25c0ce

    SHA1

    2c8e295552dd893a3bd5b476455b3923386c2d98

    SHA256

    ba90a4229e13df0f55b7888d326748836e1cb14debf249dfb4c452011792e197

    SHA512

    70477c758c81326e01e68306b83934f31367e98ff6c77f28252af4f1f8f3867dcd25288056dbfc26da3e5451b0741706c44b373b1e972e06bdd8c4b61bc4341f

    Download Submit

  • C:\Windows\SysWOW64\qipaaydeizpyype.exe
    Filesize

    512KB

    MD5

    b4bc8b7c1fcc1ccb88cfd8f65d003d17

    SHA1

    3b5fa9bdff2a3a7800c95a80baae6308ce2ef08c

    SHA256

    2fc02c02f38361380723035df7c9424c143be4e51bb41b0e394444de0aebed5e

    SHA512

    2278395d17400e0d5db44291825733d3291dcc1f809710243d5821cb2595b40dfc1365d65e9610132b526fa98fa44afdb3954cc128d5d7c9bb0bb8b56b23bcaf

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \Windows\SysWOW64\lqdhlpbk.exe
    Filesize

    512KB

    MD5

    d2a03a70e9289f8929efdd03151f2486

    SHA1

    89bf5b3ed4eef84de5cc5830a68fd90cff4e36f2

    SHA256

    6bc676ccf44fda8b2642450d2d2d33a3f19a0b59a2ab40835c6fca8ee21537d7

    SHA512

    38eaaf272c3ecbe2977e2e5fbdb4ed0f9a67a226cd18e7d06a3cc6902036cf39ccdd81dbc1e628467febeaeb22b9150e8ca328014e6377dec14bb4811bf81c3d

    Download Submit

  • \Windows\SysWOW64\ulxorurwts.exe
    Filesize

    512KB

    MD5

    80246307feecfbb4a8a11fa2b525c0f0

    SHA1

    d6d989b848efde35d735d3a65779ee66cf89cf8f

    SHA256

    126adf8d7cce301cf23728d92041c1915bda63d58bf0f4c35b8df18a9798f0ca

    SHA512

    1fb532a5dd29bb7cdc45d9605ca5d4f2a5637b17f27d537472d4de5f49cef6013a70603f270eb388c488ea0d221c54d459a3e4331063b1332270c0b2bb0337e0

    Download Submit

  • memory/2252-81-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2252-83-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2252-89-0x00000000026D0000-0x00000000026E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2264-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2276-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2276-47-0x0000000070FFD000-0x0000000071008000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2276-45-0x000000002F891000-0x000000002F892000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2276-82-0x0000000070FFD000-0x0000000071008000-memory.dmp

    Filesize

    44KB

    Download