Overview

overview

10

Static

static

5

b8454f9bd7...b5.exe

windows7-x64

10

b8454f9bd7...b5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08-03-2024 02:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b8454f9bd7d91e7b04eda20436dcebb5.exe

  • Size

    512KB

  • MD5

    b8454f9bd7d91e7b04eda20436dcebb5

  • SHA1

    119374f36cd329d9ed74c44b36216056119ac9fd

  • SHA256

    312d5d5661561fe40af4281524c7a872f8b3f0ff26710a52efbec4a04825cfb6

  • SHA512

    07c680adfb17d7ec4da89c1560d488727a01baf107110a88cec9ec0c886fc94be0df3b589d73e723d6c286ea48fa1a99fe35eb329cc9c9e379e0516db6fe4187

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6E:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 28 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8454f9bd7d91e7b04eda20436dcebb5.exe
    "C:\Users\Admin\AppData\Local\Temp\b8454f9bd7d91e7b04eda20436dcebb5.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Windows\SysWOW64\rfrjaocudr.exe
      rfrjaocudr.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1456
      • C:\Windows\SysWOW64\dnvjyfzx.exe
        C:\Windows\system32\dnvjyfzx.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2812
    • C:\Windows\SysWOW64\mxjfxtfbogfcnfe.exe
      mxjfxtfbogfcnfe.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c xtpxcvvaljdmr.exe
        3⤵
          PID:2900
      • C:\Windows\SysWOW64\dnvjyfzx.exe
        dnvjyfzx.exe
        2⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2172
      • C:\Windows\SysWOW64\xtpxcvvaljdmr.exe
        xtpxcvvaljdmr.exe
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2644
      • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
        "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
        2⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\splwow64.exe
          C:\Windows\splwow64.exe 12288
          3⤵
            PID:2800

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
        Filesize

        512KB

        MD5

        15c573bc24c4fc940e0eec0e44d8a226

        SHA1

        2f33197fbc50b950170f2e44aaf9c6fe2d2857e4

        SHA256

        6fed0fbd17e72a968bc0124f3f6d53d54aef704641bb95bf9981652fcb6061bb

        SHA512

        c77385b7420c51cb1faee0c198677b8427789c501250e732a6e9d0ce1622f4ec167f9a7cff8aef4fd173e199375cb949c87078fceda3a72fd5487164a510cb22

        Download Submit

      • C:\Program Files\EditUnprotect.doc.exe
        Filesize

        512KB

        MD5

        7d72b7a474170f7ab491d5634c97315f

        SHA1

        940a8ec569dbd39abaade1ebc3a913b2584447ce

        SHA256

        fe4f372e13c4f7bb8125a34b1a07afa4a3e7bf864c9dbc02f6288e89933fe616

        SHA512

        fd09076ac57bb4a356f5d1dc9d2402c0445867a20ce790be01d1b76d9324b3d4285c5a3afd02945f381389d4badaa0cba1a2e3d5090cd1f325a40353fd762fa2

        Download Submit

      • C:\Program Files\EnterTrace.doc.exe
        Filesize

        512KB

        MD5

        76095f3dfa9cddf6866aed5432a87516

        SHA1

        61a1e4f3e8c9c4b7fc7528e491c0970e4e87f9fd

        SHA256

        22cedaddd9db0832a27272fd5ccf66e68c0d94a8234d4d3cc54b74e215f43899

        SHA512

        e9212cf27800ff57a375962c33c40d5e77f5c028ecc8049456d04b078742df2e9a2e2c3785307879e6bfb077cc8fb5ebb25d25cb42ad3f8d98eb8574fee0a6fe

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
        Filesize

        20KB

        MD5

        a467db00b41666b599b8c6597bab793e

        SHA1

        ee3380f599c3827e925c8621ddfc4a9c86b3972b

        SHA256

        3366b9a85e85edbdde58c2f49103d326a6987e5dbe8c5ce1aaf2d6d91e312ab3

        SHA512

        98734a9ee705af908ca0a9e13476692f6dbd91a753401146bcaf3b907454a799531ce0737253b815772edbf90022409861fcbe6240dbc0b197b8dd9a41f3e3b4

        Download Submit

      • C:\Users\Admin\AppData\Roaming\UpdateSplit.doc.exe
        Filesize

        512KB

        MD5

        3b51332d1392e99337b8bff699cfe8ab

        SHA1

        7026d9ebe69432f40f43276e861af88a9b60fbe9

        SHA256

        823ddf58bc18e90f11dca93100d7ae3ac1644813637657eb05e437293c38201c

        SHA512

        d057cb5d73ef572f30b7ef3cc4cae96edeb6344fa1c44c9b6a24a931e9d597336cf802c4f08131ea09d31117a57a1d875b102ecab0fe081d9848c7f857dc3f93

        Download Submit

      • C:\Windows\SysWOW64\mxjfxtfbogfcnfe.exe
        Filesize

        512KB

        MD5

        a934404bf3c75082dc0c470338cb51ba

        SHA1

        c38c9f51d2d9241e90fc9ef0f0de56e5a356fc73

        SHA256

        f9d31a5ce4ae144d05a842a18fa3fb3bb8d42b2fd8c828a8ff25c5e961e503ad

        SHA512

        c3af99722377d7e00bec81eead3edf20b00ac3db71c684cc4b2f9181446352c3bef30b29c9fc9511de3a76cc63edc8bf0b4ad9109a880c39db1ac1a38c0889d5

        Download Submit

      • C:\Windows\mydoc.rtf
        Filesize

        223B

        MD5

        06604e5941c126e2e7be02c5cd9f62ec

        SHA1

        4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

        SHA256

        85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

        SHA512

        803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

        Download Submit

      • \Windows\SysWOW64\dnvjyfzx.exe
        Filesize

        512KB

        MD5

        7c14d573f4cd4e11a3965111e0477001

        SHA1

        8d87f76e3de056966a5a4e37be41ab5e0c63f463

        SHA256

        1f0be0f05ff9b937889c9abbd79609c03c36fe73b48cf11b6d218efba8400f14

        SHA512

        4b52b56ac8c3613c74c75a1acc59c1bfde14f70d4e8c9cf1faeee14fe76528a83540fcbe259aaec4bd0255a3b496f63bd119cd704e11fcab3bfc65eeb711905f

        Download Submit

      • \Windows\SysWOW64\rfrjaocudr.exe
        Filesize

        512KB

        MD5

        3c3bafa152a1d7e1c7e2f379cfcd62ef

        SHA1

        87ab605bee9a58f956ec99fbbe1c386ef65a9e81

        SHA256

        0ab7d690fc6e1b87719a81efa1d18751f948b0befcf048c1a54801700994b675

        SHA512

        e98d09d76f6a8474c7aeb224e499ecd79eaff59395ffa1f5c2e97b970c9514dd6c893518f722ff99bc6c86255e02246270d4177cb89eae1bd4ffd61cc54c204a

        Download Submit

      • \Windows\SysWOW64\xtpxcvvaljdmr.exe
        Filesize

        512KB

        MD5

        6ec15fd55a4c90b60b5df9f97bd525f9

        SHA1

        a71449c00d35e5b45a5259f96b249bc5d4bcaf0d

        SHA256

        e3461b8a697d5df0b7343bac26714ad13d52c576788b01568ca106adcaba0b3b

        SHA512

        08577a5272700d4a797d98a13de2b9d0fd67f434b04b768e79323cec6d6111e6ce78ccb6ff43ea11c147f9facfb6a778f2a1b36c34b3c513c551124155ef6bdd

        Download Submit

      • memory/2572-59-0x00000000714DD000-0x00000000714E8000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2572-58-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2572-45-0x000000002FF61000-0x000000002FF62000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2572-96-0x00000000714DD000-0x00000000714E8000-memory.dmp

        Filesize

        44KB

        Download

      • memory/2572-117-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2720-0-0x0000000000400000-0x0000000000496000-memory.dmp

        Filesize

        600KB

        Download