Overview

overview

10

Static

static

5

b9708e1862...78.exe

windows7-x64

10

b9708e1862...78.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    160s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07-03-2024 19:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b9708e18625186abd70bce3077763b78.exe

  • Size

    512KB

  • MD5

    b9708e18625186abd70bce3077763b78

  • SHA1

    45dc8d175729cc14838338db558c7f385af218eb

  • SHA256

    ae9b6e88c692f3d343c886b723b7b1afe3c5da8a060e49bcc2bfee8759328fce

  • SHA512

    a6465e30be424416e78b4997721e43783e15317da32da3d85705a7421b3f1a21f8e0474ffb5903554389416d9951f9ed52c59f048469ed8eef8b1b6ab688c0d6

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6U:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5n

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b9708e18625186abd70bce3077763b78.exe
    "C:\Users\Admin\AppData\Local\Temp\b9708e18625186abd70bce3077763b78.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Windows\SysWOW64\gviiwnrgug.exe
      gviiwnrgug.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\SysWOW64\qedalgsc.exe
        C:\Windows\system32\qedalgsc.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2480
    • C:\Windows\SysWOW64\krdilfvzvudbzti.exe
      krdilfvzvudbzti.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2532
    • C:\Windows\SysWOW64\qedalgsc.exe
      qedalgsc.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2724
    • C:\Windows\SysWOW64\owbeubbzzcghb.exe
      owbeubbzzcghb.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:944
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1524

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      6c55416fb910bb72f101aa4d487623cb

      SHA1

      1c24d1f60d66bb7a4b8941cfabf07ad90194e990

      SHA256

      e3d81f11de8a5fd790f53514ae61e7f5abd05b6fb8c83811e3ed58e3a7021abf

      SHA512

      3548d0651bd2b85301ac98a08c2d24865331148348abfcdad406ecc0eda5917dc073bca4a3194ae3ad175b78fed3d0760844fc7e391702f357cc19ddeeb058f7

      Download Submit

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
      Filesize

      512KB

      MD5

      6e252102d6d89b8a6342f01bc502ed4c

      SHA1

      b73aaed8e3580cf05828bf000ead2b9bc0fbd259

      SHA256

      54d0e3856c6d37311605c8fd3e6066cf56c248279af9454af7a76e4e2ede24fb

      SHA512

      31af1d1b93f8feca36c39bafc328a6275d8f31768e6580c7f5cc65ffd2a3b9af93821406f316dc548067e9a5ca3421f2dbd5cbf56d17c1eb5e7d093a9fc2d0ea

      Download Submit

    • C:\Program Files\PublishRevoke.doc.exe
      Filesize

      512KB

      MD5

      23914db4c52231774676616580897216

      SHA1

      b24e551a8ab790669f4b357d17a9f45ba0aeadaf

      SHA256

      bcbb4c24bcb0dcc2baef62b60a75de072f7183e7ba7cd18b5da83d0e892f65dd

      SHA512

      e7f2957331ada8e75d19672e59c46fae2b9faf7a1c9224c5c9a3ed069d985de0b3661083ed44454cfec9281dffc2cfb5f80d3c8afc94fe243df0866bdba9d52c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      bc9959f512a2a789a915b3364a534523

      SHA1

      9307942e100937804a9b784e36b8ea0fa4280c31

      SHA256

      c8a36a004251a0d2e8970ab1fe9064a4475d4b05703c49da243f3a99eddaee52

      SHA512

      a80433177d28431a0afd30cbee2bf679c24fe6a86bb8d5d18903371a28ecbb12e0b407121a49868577816912805c6b55835a66d9b08b4be7633df87d45fe4dc6

      Download Submit

    • C:\Windows\SysWOW64\krdilfvzvudbzti.exe
      Filesize

      512KB

      MD5

      d79eee8efcaed8166fe709c980949697

      SHA1

      1af381c5f5108191ec96c878e03b1a4eb615504f

      SHA256

      d7cacf4a7e492f38fbdc231e4289f4b8eb88ab39c7ef56e9da60b24b6bbb7073

      SHA512

      2622d69607c078e9a861d786dc487018213019035e790c25cd6a791cc68392d67ff4aa5b48ece9e5c4b74691019ba3afd99c3f7a1948def92bc6eb1eea0f0d3f

      Download Submit

    • C:\Windows\SysWOW64\qedalgsc.exe
      Filesize

      512KB

      MD5

      076af07363bd43df3f9921b4a03bb7f0

      SHA1

      aaa7e7f7a137411c0410aaec2578d5c6d717ff27

      SHA256

      21b3c405df006e0205e9803a26aa54e323500ad7f225f501b1c031a118eafeff

      SHA512

      058d4b4a10ab486fae8378234abf6364725b22fddebfa982900872863e42b8538ff414a3db1bf82ff06441875561ecf622ec33d0f8a62748dd202447b97451f0

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\gviiwnrgug.exe
      Filesize

      512KB

      MD5

      e2a2f7987203a4212b8475b887ba8630

      SHA1

      250f62da5036f343c3dac9d527fb7ee7bc44d613

      SHA256

      68233c4faf5e084ad042555442561f76400251cbc18975d648703e320c50bce4

      SHA512

      b362211fcf87f5270a8b87323853bd1c6677e39c3516211ecd6bcae4b8ce7ff085d566f4e12c8c47eaa9b29c12c73742f95b751fa5defd8470c8c3e1ec28e63b

      Download Submit

    • \Windows\SysWOW64\owbeubbzzcghb.exe
      Filesize

      512KB

      MD5

      cdcdc894879f46d314283aa2c82ed8b1

      SHA1

      24db505f76a006c4c235ccac98f7fccf7e8c3535

      SHA256

      0575babdb5bd83d9498916430f96481a87362068f05fa60947c537ebb3c738bc

      SHA512

      8d929721a568a1631ce0b93a59cfa5fd40408eae8e32ad287d68f3f293b8c183de5b095715c31729cbafb95b8067bc881b856eb3bd3acf7211846ed744e3b970

      Download Submit

    • \Windows\SysWOW64\qedalgsc.exe
      Filesize

      71KB

      MD5

      9153546029eaa84c7d7979b51476f43c

      SHA1

      cb64f17ad72b1f4314ef3b799cc7185171034636

      SHA256

      6a1f23fecdcc5ec5332f632856e108981a51436a49acb6b02edbdc5ea0495cff

      SHA512

      d2713efc2077ba19cd8061a236dbb4adf4782a120b063924057664430e7f1e2d9a60688c57cbddfa3e1d77c8eaae5d5a2287d61b749a51f61e3763989fea53c7

      Download Submit

    • memory/2608-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2920-44-0x000000002F7B1000-0x000000002F7B2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2920-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2920-46-0x000000007199D000-0x00000000719A8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2920-85-0x000000007199D000-0x00000000719A8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2920-106-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download