Overview

overview

10

Static

static

5

99384b91ca...24.exe

windows7-x64

10

99384b91ca...24.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 10:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    99384b91caeb3db7b013c5f13f292424.exe

  • Size

    512KB

  • MD5

    99384b91caeb3db7b013c5f13f292424

  • SHA1

    466c3070c871854cf8283bccdef2bc93bd7fa6e4

  • SHA256

    21f1a55e503601078df14945d4acd57d816d8abc55d7c17d10f48d06c410e53c

  • SHA512

    1702a41d75a54bcde75b45b8790ad44fa51e2e924a046898fc8d545b5add792c2f1db1e5002c07a37f683b95211b123d7bad29ce407f50d5483a4044796f816c

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6k:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5L

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99384b91caeb3db7b013c5f13f292424.exe
    "C:\Users\Admin\AppData\Local\Temp\99384b91caeb3db7b013c5f13f292424.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Windows\SysWOW64\pfiakaohai.exe
      pfiakaohai.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\fixpaafl.exe
        C:\Windows\system32\fixpaafl.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2644
    • C:\Windows\SysWOW64\dltumwxcfpasmtq.exe
      dltumwxcfpasmtq.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c rbshnbgovrphm.exe
        3⤵
          PID:2616
      • C:\Windows\SysWOW64\fixpaafl.exe
        fixpaafl.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2304
      • C:\Windows\SysWOW64\rbshnbgovrphm.exe
        rbshnbgovrphm.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2892
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3056
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:2848

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
              Filesize

              20KB

              MD5

              da8d5f948275c0048ab2cd2abc418c89

              SHA1

              667d7fb087b53bd26a3ee8c9a0b91fe3cdca2b41

              SHA256

              9ac09cfae68d075e49b61f5b728d24df78cf6ae078b547685b568e30108cc22a

              SHA512

              5862e5e2983a85a02f38210789308b3a67940be7cc794ef337cf4629ce968e49424c3ec96e13fb387046e2b4f7abbaf24f52ea61d14e6a5dff7e4bed3b968b70

              Download Submit

            • C:\Users\Admin\AppData\Roaming\MoveResolve.doc.exe
              Filesize

              512KB

              MD5

              306583432a76c8c5a5da9744fd90736e

              SHA1

              08b547dd07770ca36d8fc8c716b44156c27134b3

              SHA256

              d2d61c81dc4d57068b116a4c275ff26a83db937c726835dbf6e053459e192376

              SHA512

              49e05a86968caf70485e6b486b9dc1ab699134697808ea5899c4da6f289cb8f1101a48fe79ecf163825866c9b3381d4ea051fbb712ea025f2da0e48cc26915d4

              Download Submit

            • C:\Windows\SysWOW64\dltumwxcfpasmtq.exe
              Filesize

              512KB

              MD5

              81482e382e23053875ecc70580e01fc0

              SHA1

              1ce62c3d8af9a21356b527df5a35bbbb0cd0cdd0

              SHA256

              ae54b6738ab78a59e6a75df140a476f5819c12010e796480814c20396c2db849

              SHA512

              7db593152eddfcea053381dd9ca8d3f6051a836f5d5a2586dd1cbbd80bfc10324f013789629c3afb1764085fe33733a64aecb04ee9e7cb0294de6b253088c7fc

              Download Submit

            • C:\Windows\SysWOW64\rbshnbgovrphm.exe
              Filesize

              448KB

              MD5

              9728739f509ce0f3b3b073c945c208bf

              SHA1

              31bf207a650a7f1bbb8e90552891f1a6f4e4783b

              SHA256

              f252517c755af447fe73347dd23cd133e28c7a203d01382306a195c8ddda3dba

              SHA512

              76e963f4d1b88528ebbdbc375372889efffba4768f6a99bccce4c1faa730e9515f93fa74bd10bb61c0034f2ceb9ef85ee8234f9d13df183ffc7e163ae3dd38e7

              Download Submit

            • C:\Windows\mydoc.rtf
              Filesize

              223B

              MD5

              06604e5941c126e2e7be02c5cd9f62ec

              SHA1

              4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

              SHA256

              85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

              SHA512

              803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

              Download Submit

            • \Windows\SysWOW64\fixpaafl.exe
              Filesize

              512KB

              MD5

              9587423d4872301b1589ce2e5468f961

              SHA1

              7a6dbfaaf74c0ff00dd2aff370f8748b248f0241

              SHA256

              f75f201a265ce2513b936d3e5f5f7d8f21cf65372468161c05e6915b2e06934d

              SHA512

              6e6d6c44f8f5a60b2e015329377a5554a990bb2bd87ea6a46ef66c8216f5c2312e5b319fc9e04759873f139e7929bc3a09786f18cd0078db7dc201ab8912fbe0

              Download Submit

            • \Windows\SysWOW64\pfiakaohai.exe
              Filesize

              512KB

              MD5

              33618e1c4b5a71cf6f586c3154824800

              SHA1

              4193a4b7458479a0ee881d5f084751a5c01092c2

              SHA256

              a793fe8d2c52169d0b70b02234040da7e26e9ce1bd6d57af315cb6386697100d

              SHA512

              e2dc0cc58d15127330df3fd14392eea3219db575fdfc548c53af4ddeb2760204f50d1aff1b9de01dea4eaa09a46524c278d1e3d632d17c166243ff7f65bfc70c

              Download Submit

            • \Windows\SysWOW64\rbshnbgovrphm.exe
              Filesize

              512KB

              MD5

              a5af646c9d713af8f66f8df4a60b3406

              SHA1

              bb9c56351cb717a2005987316071c072aceb916c

              SHA256

              663b93498510570d620d0bfb8a094712fbf9a3f931be5dbb557d0db29b47557b

              SHA512

              8a39eb9fc21c7c84df710393ec9e4dfb1663126d78bfa977b209b28fecf0d9a9d5bcf7fe4215b84ffaf85aab47cc81210c442fbe3ddda80d2a9b9e6492cc0769

              Download Submit

            • memory/1980-0-0x0000000000400000-0x0000000000496000-memory.dmp

              Filesize

              600KB

              Download

            • memory/3056-45-0x000000002F391000-0x000000002F392000-memory.dmp

              Filesize

              4KB

              Download

            • memory/3056-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

              Download

            • memory/3056-47-0x0000000071A5D000-0x0000000071A68000-memory.dmp

              Filesize

              44KB

              Download

            • memory/3056-92-0x0000000071A5D000-0x0000000071A68000-memory.dmp

              Filesize

              44KB

              Download

            • memory/3056-113-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

              Download