Overview

overview

10

Static

static

5

c6bc872d73...f4.exe

windows7-x64

10

c6bc872d73...f4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/03/2024, 20:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    c6bc872d7343ffeec96b71352192a5f4.exe

  • Size

    512KB

  • MD5

    c6bc872d7343ffeec96b71352192a5f4

  • SHA1

    593040758bec6126a76b78ad661dcadf3ade869f

  • SHA256

    a4c105ca89c85e54a7b0dfa1b30a7458801fe542a083a1956494eefcf107b9c2

  • SHA512

    af68c0b8f537daefe1500a6f9c15c605461e1912bb447d226251fd5612dcb197b4367a859e814243bb184de36f1a86b327e38142a1df31cfac515690cb8d8293

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5E

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6bc872d7343ffeec96b71352192a5f4.exe
    "C:\Users\Admin\AppData\Local\Temp\c6bc872d7343ffeec96b71352192a5f4.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\SysWOW64\yljkgisdry.exe
      yljkgisdry.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\SysWOW64\pyqalfjp.exe
        C:\Windows\system32\pyqalfjp.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2008
    • C:\Windows\SysWOW64\akxnywnjzsxsvtv.exe
      akxnywnjzsxsvtv.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1116
    • C:\Windows\SysWOW64\pyqalfjp.exe
      pyqalfjp.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1288
    • C:\Windows\SysWOW64\xtxrsytvmmjpj.exe
      xtxrsytvmmjpj.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1968
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:676
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2832

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            16e3fd4a145326585a295c5c7c2eca35

            SHA1

            0aa5d656f61a4e35f371e818b325da179a0e6a18

            SHA256

            508ab36220eafea828f352d5ed6ace7e2391f6baf14503ef9c4af6447614ee2a

            SHA512

            3526baa0dc25366aa87fc5952756758050f86e29ad0fdb291a3a2abcbf7e186648bb7a560d636f765447744f376aa5f5c4c9d276d6cdb821742a95f6d9485a5d

            Download Submit

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            b23936f675a6f110b1a6e7e62a21d763

            SHA1

            deb8cbfe030ff4cb542c5458f81b9511a1251a98

            SHA256

            371fed11cb37a11fab1d1bea38f4cff995a82c0638c9b5746a64a920e01abd06

            SHA512

            0ec1ff9667f2eee4b7255a8d78f0cf30f726fb29cdf1d964de28fe07818e857fbfb2710701e3ffff9f87cec260cd702f622c91376fe38b2387f4d579dba50c89

            Download Submit

          • C:\Program Files\ExitSync.doc.exe
            Filesize

            493KB

            MD5

            4aa564a9ee70efdd817cede42806163b

            SHA1

            c75ffcfe10532f814a2e9c050c989f28ba1dcba0

            SHA256

            b8a60f58c6a29d7d3251fbac8351d7b520af87bea591c39db727fccf561510c7

            SHA512

            44b66ab8b09d1d3fa27f8d67fb14fabe0942eb2539d94fd5a68f2c708343712afc8dda56e5720f3fea15fa3a039b8a4a315386d89d39fb695e4d5469847a3330

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            2c87fc8c26a8047ecaa984a9593d832f

            SHA1

            03d84c61eac50fc41a53dbc121fb97e9c11f59c7

            SHA256

            7c5f39904c70d74ffaea621966da5f792891bd11cf37a81e3acb615c8de2fce7

            SHA512

            f5bbf4c138ba7a0b3ef50f9b8934053e66a880cd63a790b592b18fee8d5f6f1c6736ef1ebd626099daddaf1ad7612c7c22684b01a2758cf334f2ef0b0791bba1

            Download Submit

          • C:\Users\Admin\Downloads\SelectSkip.doc.exe
            Filesize

            512KB

            MD5

            cac3564fae2097bdd13167d01f0cb73d

            SHA1

            8789d3e05041a9f0eadda77af8149890bcfdcc59

            SHA256

            3546572b0197da37d78b8b1146ae2bda1d2d75975c7b95b26d73f115f5f4ae3b

            SHA512

            fd79ccd470ea501e5a5091dfff299e9a0397827d82a0fe7c359c41c7c47b4466d7802932a6a9bd8d92c0da8d319f1c6efc9f32b9b177f13ec1dc099fa27886e5

            Download Submit

          • C:\Windows\SysWOW64\akxnywnjzsxsvtv.exe
            Filesize

            512KB

            MD5

            5a73d400cd29ec4e648b674b085c22a8

            SHA1

            a4a805e1b0194d81a00c0cd91952c2e6627911bc

            SHA256

            c9da3d52fd534ac8c3211fa97c9a85f4fa003853770ea199d2eb4a6472a14e38

            SHA512

            edd2401488fd9b68cecff77b3443b9224d962e37328b9bbf33157884619da9e68b8bd973ee0d9694ebb4eb7e8b71c5997b2438ee80327b217a38103b47271c7a

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\pyqalfjp.exe
            Filesize

            512KB

            MD5

            7fd938d4c105dd6e13dc5cbdda4ddedd

            SHA1

            5cc059a64892d90aadaa06930d074fe3e5b4416d

            SHA256

            bf481288d8f6ae2d34f355ac4dc2b8c463f4d7c224e7c98af4b2b39cc648f45b

            SHA512

            47be32f0736fa1b552107edb95f77c2dc001bb9d075f42323010bbf211d70ec6fa7a9a78664bbd5a5bdddd92b3fefa3cb904add3e1b3a7f34043c3695c153ac9

            Download Submit

          • \Windows\SysWOW64\xtxrsytvmmjpj.exe
            Filesize

            512KB

            MD5

            f6af29dc085862e8614847e4c56ec8f0

            SHA1

            79298a90f3db95b48eb0676fa4e28329b465708a

            SHA256

            f797dbbc96ef360518dc4ec4eabf6173599b328380913cc2ef508bc05a3d6d2c

            SHA512

            75970c025481e8d86e337fd8198472a6339c2de8f8f603f5cc07b209d2e11731a52cce989671b87c95ba988f9a2f09909641ddc90333426ae9c4c8529b5bc30c

            Download Submit

          • \Windows\SysWOW64\yljkgisdry.exe
            Filesize

            512KB

            MD5

            5e9ba4f02982ac5b335c3bf303f95c12

            SHA1

            f6580e282309e8898244eea1db819f64fcf35be9

            SHA256

            3b5df8bf3a048918934e52afd639c91b1d47e77a447fb7fa5e771ddd689329d2

            SHA512

            88abfb80126da395ffd488d21b1b0f5f1d19c09c55c407d53f998c18399db44aeeb612f7f989b59c07dc54d3516834dc41d4d67f61b8e96f50b0e317b14e3a0a

            Download Submit

          • memory/676-47-0x0000000071B2D000-0x0000000071B38000-memory.dmp

            Filesize

            44KB

            Download

          • memory/676-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/676-45-0x000000002F411000-0x000000002F412000-memory.dmp

            Filesize

            4KB

            Download

          • memory/676-84-0x0000000071B2D000-0x0000000071B38000-memory.dmp

            Filesize

            44KB

            Download

          • memory/676-105-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2236-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download