Overview

overview

10

Static

static

5

78698680a2...64.exe

windows7-x64

10

78698680a2...64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    26/01/2024, 21:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    78698680a2a598868ccf4c413b63bd64.exe

  • Size

    512KB

  • MD5

    78698680a2a598868ccf4c413b63bd64

  • SHA1

    3ca8009203ff4894f169096972dfdf151e57adfb

  • SHA256

    3eef7da00817bd8ec60dbcf222c6abac7df76e68c89ea934df56c883893511bc

  • SHA512

    011ec3ee60caa2a52c67975add62cd4fb2162700bfc605e88433e579660d32f6e934b25f09d9522c533f0a364008e6ad72b915a088232a6500a7ada058ab181d

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6F:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\78698680a2a598868ccf4c413b63bd64.exe
    "C:\Users\Admin\AppData\Local\Temp\78698680a2a598868ccf4c413b63bd64.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\ahcksjwwqj.exe
      ahcksjwwqj.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Windows\SysWOW64\jcgtulxv.exe
        C:\Windows\system32\jcgtulxv.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:1320
    • C:\Windows\SysWOW64\ozsmhujrvwrwqnq.exe
      ozsmhujrvwrwqnq.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2816
    • C:\Windows\SysWOW64\jcgtulxv.exe
      jcgtulxv.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2784
    • C:\Windows\SysWOW64\vxsxfrhqsomml.exe
      vxsxfrhqsomml.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2752
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2628
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    b222bb26ac86babd6f6900c4dc4de8a0

    SHA1

    555ac574fde98e6224e570819d7a38168d173d73

    SHA256

    324d815df723d17403d6ea49a2fc9dfc2d2dd07afd8e067fc95c07fc3a903e98

    SHA512

    c41bbe9f797198484ab9acba5351970d1d0e9734e809648cee78b3943edf18855b1ccb0040d49e6e637813331e81c5a530424c015b15ff2139c6b8cf08bc55d4

    Download Submit

  • C:\Windows\SysWOW64\ozsmhujrvwrwqnq.exe
    Filesize

    512KB

    MD5

    3b546333b9121d6ea701501b3d997f72

    SHA1

    497fe6af35eea523d53231f5fb3b6fdc9824c410

    SHA256

    c83843e9d5dcd65bdd12960a866745dee1ea80b5140b803ee8cc654598a3c5c5

    SHA512

    4c691c5764e34b6549e2194cebef5dab2532daae0df18d71a43b9f10836d972f7a45ec1bde34f74101784ab769bd2e98054b2269acf8d7b0b029da478d04eb13

    Download Submit

  • C:\Windows\SysWOW64\vxsxfrhqsomml.exe
    Filesize

    512KB

    MD5

    0ae432c907ca00ad4e422a807e9b13fc

    SHA1

    5b866c9dab8f2ac9c8ae8b3885d53d8fb21a1e06

    SHA256

    f632e41ffcdcac0397185941ce50fa8e88c54bc3f4ca2ed070d93f77c8942727

    SHA512

    dba0a7cf8525a50dc793ff47ec324985f813b74a7b3b45356298944f505f8a41c6cece2fecffe5215d216d7f1b87ab825a7b6cdc9dfaba3e3a55beb5dcf32500

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \Windows\SysWOW64\ahcksjwwqj.exe
    Filesize

    512KB

    MD5

    a566cc46041704d4d4b04d99e997bef5

    SHA1

    640a395553ace8ae628b6fbc56df5c6163468e6b

    SHA256

    2a31c4b609162eda693c17e18611f76a5188e2b1cca2aa846830b242bb0253da

    SHA512

    ac6d20602948e66847dbb8ecd43a0d23d3fcf0f8bd03b136314c896d5a6e1f7b9f450faf0e9431b113ea53c18f70390e1d718e1e999bb28961be31a199f2c829

    Download Submit

  • \Windows\SysWOW64\jcgtulxv.exe
    Filesize

    512KB

    MD5

    04018900a7b6c6f1cc4afc76ec201f2b

    SHA1

    714c7a63c107859e1e271dc747fdfa1f3e77cef1

    SHA256

    982ce28c2ca4cb12a5380dfd5481c10a53cbe9323e3400fb5e878e6ce6430238

    SHA512

    e90e074c1b3c8d836e7caf653e7038de57fed6eebc252cffcf9facce317a679dfd6ffba1d5cbdec10d69a701d19f1da97a34a6475dbb6c17d3b326fa49176cb8

    Download Submit

  • memory/2040-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2628-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2628-47-0x000000007182D000-0x0000000071838000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2628-45-0x000000002F561000-0x000000002F562000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2628-76-0x000000007182D000-0x0000000071838000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2940-75-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2940-78-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2940-83-0x00000000025F0000-0x0000000002600000-memory.dmp

    Filesize

    64KB

    Download