Overview

overview

10

Static

static

5

c6cea8c5fc...34.exe

windows7-x64

10

c6cea8c5fc...34.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    13-03-2024 20:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c6cea8c5fc22b62adf8d3cad5cbcff34.exe

  • Size

    512KB

  • MD5

    c6cea8c5fc22b62adf8d3cad5cbcff34

  • SHA1

    64ca2d17f6d75ff821cf87dbfd1a118e10c2df70

  • SHA256

    f3f6751c377ee0ec3a76f282a08ac553dcdd8c7d1f95894a5ce5d6a4d6e4ca63

  • SHA512

    6cef436c832177d918032d4843165f1ff76be3502f854ac789f2a8a3dea5ae0cb020f73c1f9e723c41a7b6c0643a843f809e5f9eeb3976b84d956a5c64c417a6

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6n:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5o

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 34 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\c6cea8c5fc22b62adf8d3cad5cbcff34.exe
    "C:\Users\Admin\AppData\Local\Temp\c6cea8c5fc22b62adf8d3cad5cbcff34.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Windows\SysWOW64\gicoknuzrw.exe
      gicoknuzrw.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Windows\SysWOW64\whmozoty.exe
        C:\Windows\system32\whmozoty.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:2800
    • C:\Windows\SysWOW64\ebbdflppfqxtbux.exe
      ebbdflppfqxtbux.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3060
    • C:\Windows\SysWOW64\whmozoty.exe
      whmozoty.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2664
    • C:\Windows\SysWOW64\txmuatpspliaq.exe
      txmuatpspliaq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2652
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
    Filesize

    512KB

    MD5

    7ea8de0abdca3337f22d8e2d9937a4d8

    SHA1

    616ef701812d0b8f3f90e2def78187de47aaeeba

    SHA256

    5f0865f34c199fec5c10008144aa627ea49b6c735a99f0a2dda06afd22a49283

    SHA512

    49bbcf1f9de50d995b0a628da2bd4c0d5ae414956c25ef86c542411e99bffe80907702113c5f537bc81460f86831ffc53d3b6c89d2a255224266eecb0e37ad3a

    Download Submit

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
    Filesize

    512KB

    MD5

    8983585c11247a38705042efed211d59

    SHA1

    76eecb5665ae84b6d840cf6e13ccc18e0c20f873

    SHA256

    f2b3fc520641043b38f1575cb88eddb87d1ed85c960defac665cc9dff655d53c

    SHA512

    3b0019b415b32e65151c8c185b862478e73df38152f115ffcb564b586235dbc5762e69c39ddb2d4d6dd3a5e4c68978b28f985f458cf9d1f9a906c8ee522824c6

    Download Submit

  • C:\Windows\SysWOW64\ebbdflppfqxtbux.exe
    Filesize

    512KB

    MD5

    3984c8215432839f50861afdac7958ec

    SHA1

    2e53ac1f7c29f46b84aeef66600b2cb27f6a7fd3

    SHA256

    4ce3d92836075ab342bbe6f0a48f1853481b6b8aefdad67d0c6f65eb63e8be99

    SHA512

    7ca9132bed5141d07825528cd5d31717fc7bcf47cc0b297b9f0aae112758040d6ea730c894b831f3855b35e47999a76d4d65dec4850bcdcba7d6320a71e4bce3

    Download Submit

  • C:\Windows\SysWOW64\txmuatpspliaq.exe
    Filesize

    512KB

    MD5

    78e40402a751f2eb134f8d6ecb075ab1

    SHA1

    1678ff74785af8a930413c1c4131ded0759a4d6e

    SHA256

    d8583bd88fe7621c1231481dbe307e44b958b63c56228dedea7ce3482b75b0bd

    SHA512

    feb7c1167679baae84c4f9c205eb27f65d508aa7164c733c231d7c14b7441c6a27399139133c0ebe5ecac2eba04d3aaa354bd7a48fa03c4628ba4fda1887354d

    Download Submit

  • C:\Windows\SysWOW64\whmozoty.exe
    Filesize

    512KB

    MD5

    4c6bfad1b009c8651c3258771c206dce

    SHA1

    a934ebc3ec2a63e988e37f696d375c1771523b03

    SHA256

    1739549cc76c85c19e07ff39f21f70825d3e25f25bad5998c60080173d1fc248

    SHA512

    9b1cfb07aa7d5b764aeb2ff741e0abd7d2ece9b6de667c8f0776a83fd9ec29224a2cfadadea1c38c662d0a6b394e528f0f1896adde870aef39dd9b470ca975d5

    Download Submit

  • C:\Windows\mydoc.rtf
    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

    Download Submit

  • \Windows\SysWOW64\gicoknuzrw.exe
    Filesize

    512KB

    MD5

    f2147329495a267deda9f3d646fbfe8d

    SHA1

    0edc25673885902a76901d122ce7d5158b570208

    SHA256

    560962b510c700eaf3540b0699c697204cca1dd485e96db24a5dc2cff7fe4b89

    SHA512

    19eb327a207fb9a8b4cde466743dd283a5cb1bfefe36f0894a7f938ce5739fefd1722d1a7197947e49485c3f9051bc729501a326cb9cd21f48fbb2bc11fdc9b7

    Download Submit

  • memory/384-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB

    Download

  • memory/1528-71-0x0000000004260000-0x0000000004261000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1528-74-0x0000000004260000-0x0000000004261000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1528-79-0x0000000003CB0000-0x0000000003CC0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2624-45-0x000000002F991000-0x000000002F992000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2624-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2624-47-0x000000007178D000-0x0000000071798000-memory.dmp

    Filesize

    44KB

    Download

  • memory/2624-72-0x000000007178D000-0x0000000071798000-memory.dmp

    Filesize

    44KB

    Download