Analysis

  • max time kernel
    12s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 04:08

General

  • Target

    98705b5a907f1a691359259b19b16d3d.exe

  • Size

    512KB

  • MD5

    98705b5a907f1a691359259b19b16d3d

  • SHA1

    baef9e414aa721ec9c310a32c78b1160ab99f48b

  • SHA256

    69347a80b962904a59cc1114412832f2449c79f5601468d5e424dda355aa2296

  • SHA512

    44d4b37bd5d1d2da6065e062f7b549c966d177e960358ed46caee459d1df7ad954b4ae04fa8affdba0a5713e926d5a21847ace76af08a0683c334e6b20949598

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj66:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5F

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 16 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 13 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98705b5a907f1a691359259b19b16d3d.exe
    "C:\Users\Admin\AppData\Local\Temp\98705b5a907f1a691359259b19b16d3d.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Windows\SysWOW64\bouiajcukk.exe
      bouiajcukk.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Windows\SysWOW64\uiqnmbiq.exe
        C:\Windows\system32\uiqnmbiq.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3568
    • C:\Windows\SysWOW64\cwodpaymwhzzn.exe
      cwodpaymwhzzn.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:404
    • C:\Windows\SysWOW64\uiqnmbiq.exe
      uiqnmbiq.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4580
    • C:\Windows\SysWOW64\xozupjreolixhwn.exe
      xozupjreolixhwn.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2472
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    120KB

    MD5

    681fedf0b68c6169bc76c7271f48a8ed

    SHA1

    8f169f275c0dd73f4c9e8664b0120afded816a0c

    SHA256

    193ce321e01ea39adebc944607f19593ffd0ab2248a0964a39bd8d0138a595f0

    SHA512

    6002296429d820f3d3ab0cfa142cf481602df44a0059041f8df21d4963f7f3a1234f869d706bdc5bca757c0359a20d5c4ce6ba8a3a1eb56173d35658c4ed2b0e

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    170KB

    MD5

    2d519645be98d0362ec41dacf59bf070

    SHA1

    e79c9c40ecc77b3d77211b5e0d36d14abe3bc235

    SHA256

    11f12c2d58cb8ff5c73acc4f33b32ca747de315734b1a6155a64536e391f14dc

    SHA512

    661f5e84d34965546941bda3bc2a2f33b02ab2fce33ffe84dc58f5e05b2b3b173427f6a49f3b131540f35f4aaffab392f1a503f38d168b556c74043714990070

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    361ba5cdfe246f4303b0a1638e0daf43

    SHA1

    eced7199b1af3c8e92209a68cb9a925ff3f369a3

    SHA256

    507143acb38e64408d03a0dd98e16bd34ca557294c466ae8ec9c7c763eb3a2a5

    SHA512

    81b9d124396d138717aea4dc71cec59426a3b65b47eaa0d13523adf030c5e3df9fa670ed48f7634d0301812d4b546dd43bc5bf863b58112570a2ab049bc7ab54

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    8208798c6cf37631099038b1adf51794

    SHA1

    9e2c3aa23074a5c31369f9dea737e37ce55f7a73

    SHA256

    4a54bcb566cfcb244806b476a938fc3d4512fe8bb4ed8a15550c4bc2a075d1d5

    SHA512

    110ef5d39c550bda60f1ab19d618c00a1e2418069fbda657ef13cede2ce9881470e4d720afad65ea1c5b8c4f9be2291aeb94ede28331f030c5ec2ef3f6cad2ca

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    011650e66a42e970a1bd630ac98c5355

    SHA1

    e4fdc89d3b23051fc55f851c72fd078940a45436

    SHA256

    3c4fb92b2e16d7597f86fdcbe4cc78beb21f2ef5106f40ed3a797b7655758e27

    SHA512

    27930d39189b16e1d456225bca5882b26bd6f4a02616842f2d55fdd8b596995a41c5959aac17641103cde8d0490e44c5e66f78460b3c763a7fe84b2cdeb900c0

  • C:\Users\Admin\Documents\InitializeRename.doc.exe

    Filesize

    172KB

    MD5

    489c382f47d723b3d33a1ebbafc20c07

    SHA1

    ab85f5dd3cab9b8cdf431fffe6908ff3be0508ee

    SHA256

    120f5cae967c36205259b2d20620f8812a6071c299b9396537af86cb871302bc

    SHA512

    978e2a0ea66fd15811d4518d5f1bd0db0d950cf7e357ed4404d54cdb188c700b93ecd5f5c2b18aa25a213cf44e2bd09a99c5d4c0a571c3299d737c880b1e9b8a

  • C:\Windows\SysWOW64\bouiajcukk.exe

    Filesize

    265KB

    MD5

    fc6744d0cbcc4a525b11bf73e3929fad

    SHA1

    7a506f1a874a95341bdea7306e4d75295f173016

    SHA256

    2df6c224fc6bc4a48611ef4137215a35479e7e273c31a41978a8db3a4d7085fc

    SHA512

    030632abf6895362af8ed6292af5cf0d3e4f293d763aa1b8e33d9e8fcd8fd27248454da71f0cd536887d5e6b4270e3ec2a941ff256b624f80a9244ada5fe8951

  • C:\Windows\SysWOW64\bouiajcukk.exe

    Filesize

    236KB

    MD5

    3c0a51c27c233d681812c344463f0e0f

    SHA1

    94ce91126beb72d64492bdc516f0fd8bfe0003db

    SHA256

    70c3263fb1ae3ac409481ab0e6b4c6cfc462c9848093044e8c0fb36e8255ab2b

    SHA512

    24517716a0fc9dbf0f0a1e821e399a6c7fc8b258145d06fad3c1c5ef4db7f2ab32f23ff731af25a978fec042949d98134c529038258a070bad1bf36b4e2167db

  • C:\Windows\SysWOW64\cwodpaymwhzzn.exe

    Filesize

    228KB

    MD5

    1c3d964e4976c45f9ba8885a68dec8ca

    SHA1

    af19241fb66a27d741a33e61520948b3710b7671

    SHA256

    9d4e7c0351f6463b14ac2c516d040bb73b0a60cba093fb2098a32cb317e240e3

    SHA512

    8e68e27e5b84fa6731c557c6bf7aee22972c2437ad34b31c54112194a164242343dfa0baa111c69ac81eca7105eb191f12bc58db22a0808078461151039ecae5

  • C:\Windows\SysWOW64\cwodpaymwhzzn.exe

    Filesize

    190KB

    MD5

    410be96e6dfc52d37e89da2638252ea0

    SHA1

    3ae7c1abdcc6fd7815eaefd9cb7698deb8c52807

    SHA256

    6e232cc4be80e3c81a50b6acfee7b11edf428d8d281377394af3a771c324072a

    SHA512

    6e72bf0729ea637718538c5a57a9e17cc32ffc366889cde6b45e06d09ce7de5c34f7a68c25a697035d4064ebca8154993c8d8994dcef332c9d510c4ee391704a

  • C:\Windows\SysWOW64\uiqnmbiq.exe

    Filesize

    209KB

    MD5

    3e3fb6af93dc3818da0a82772009c825

    SHA1

    c25cfb264481022916e12ac1f2f38346b7df0192

    SHA256

    7f794964e3cdba4143f74a9a1f6a4357666b574c31e44bc1991befac963fbc93

    SHA512

    cc7a276b36fc1620d999ea117a64439398318f90b78a6cddfa69383fdf2787138a731a8fa7468769050cbee6952b4b9cf5f3acfa8ca19d4ebfe5c83bda9a3cf5

  • C:\Windows\SysWOW64\uiqnmbiq.exe

    Filesize

    315KB

    MD5

    750129771b9ac77aa3e325d21ef2187c

    SHA1

    37ed086d2bf255b3f8f13e135ed9eedb5267fcc9

    SHA256

    e4f0c4403e356dc179f4ca38daf9df6f3f8a45b5abbc191050ec7ebdbe50965c

    SHA512

    f8b70a4fa8aa64c4c959e09f5b9b8cfc3fb2f8e570840ca39cd0752e4d41b8474280cce00d67c257338206f5fa540449c91386997f7d599cc7337cb8b7332f46

  • C:\Windows\SysWOW64\uiqnmbiq.exe

    Filesize

    123KB

    MD5

    b9db33c66c316d298ea9f9b70550ad54

    SHA1

    a8b495e6a7af953793e2cf9ade48f8041a37f4b0

    SHA256

    f9efd8dee97c671c6097adaa89911146ff6d97bb46703789a9e41f4287f9cd04

    SHA512

    d672da6beac64fbd79d4632135781859e66e788b782bd07017c420ff331800b8354718c56cd1600fd9addd65af29d879467e16fddac1c3200af2b3c3b77e6de0

  • C:\Windows\SysWOW64\xozupjreolixhwn.exe

    Filesize

    267KB

    MD5

    677dbf144502c516f24cc8129cde78d0

    SHA1

    48076eb466c8c3e53d32f8e08a3f2be7e5dade13

    SHA256

    6e3a37cc4e79df96c39186b13eef985d1f547c18a876382cdd4727e91fca2307

    SHA512

    8857ed99eebfb9c719dd685772e15eb66e8fc51305fe14554ee9f66f7466f941a3cd36d431a2348d678ab7874a365137d1c95d6fbab3f47d15d1d658293f2f26

  • C:\Windows\SysWOW64\xozupjreolixhwn.exe

    Filesize

    335KB

    MD5

    7ae872399675c7de388dc07e01767ec1

    SHA1

    b6eb40f3321b8e5baa53476c7ac2f41caaff24ea

    SHA256

    62f1cadf0b8df875a19f202d0b0fe51dfd3e03fcd1a6abeadba51c47cf5c1d61

    SHA512

    71aec8ec6e88c19582da8316c8ea507c1bb119e4f9569ab50ae8c63e5903c2050178df6fffad45586b67aa38e801ccd93389c8ac06d1cc982f70984b6e95a178

  • C:\Windows\SysWOW64\xozupjreolixhwn.exe

    Filesize

    232KB

    MD5

    d61734c683b3e2a72e841a88a4bfc6f9

    SHA1

    f3834d0f6ad22d51fe2c6c350c2c966be18a3b07

    SHA256

    e02fa9cbf4b9a5d59c4f741fadb8de6ba7d56c4374dc818275482f6892e3bd73

    SHA512

    51d1e75569af44e7ec7400e991d57a09cd5063e784adcf4fd7fb34f1ce9f9feb7d04d18c1b2eab4282b87e7f55c90aa1e2b0df9ea0e73456e3ea6181b140d437

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    322KB

    MD5

    52ee4382162db5df198c7d9578e3b959

    SHA1

    1f58806c065b995a6d49dbfef12d861a6a735c27

    SHA256

    80751551a010ab7db00e225a26845109a8636b012ff619a580202e480dda0806

    SHA512

    29f40950c130d52dbc1d3cf28a2f17d789b52cf0b10660be6fe9b18d7c6c8e8d8293618605e595f12add49c92a351cd8399411a91b706ae6530b3f2d5ee05760

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    66KB

    MD5

    0d3a9d7f81f48e108ed3f6912a394ac4

    SHA1

    0a88f553d8df87930ceb2146c6072086dad155b5

    SHA256

    c0cef10be6bc60087a3f4529b1495deae319e5e2473a369ab73efc28b5881490

    SHA512

    d28dca4c4080e7cda6d2c15c2b5635da299c3f1e13f635015ab3a72319f2591e3115ed288640b0f90bc3271ba169494e3f750235d4653aec222235768d56d9bb

  • memory/680-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

  • memory/4624-39-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB

  • memory/4624-40-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-60-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-59-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-56-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-53-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-52-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-48-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-47-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-46-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-57-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-44-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB

  • memory/4624-43-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-42-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB

  • memory/4624-41-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB

  • memory/4624-58-0x00007FFBA6180000-0x00007FFBA6190000-memory.dmp

    Filesize

    64KB

  • memory/4624-55-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-54-0x00007FFBA6180000-0x00007FFBA6190000-memory.dmp

    Filesize

    64KB

  • memory/4624-51-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-50-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-49-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-45-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-38-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-36-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB

  • memory/4624-116-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-117-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-118-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-142-0x00007FFBE8570000-0x00007FFBE8765000-memory.dmp

    Filesize

    2.0MB

  • memory/4624-141-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB

  • memory/4624-140-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB

  • memory/4624-139-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB

  • memory/4624-138-0x00007FFBA85F0000-0x00007FFBA8600000-memory.dmp

    Filesize

    64KB