Overview

overview

10

Static

static

5

c902ff8027...2b.exe

windows7-x64

10

c902ff8027...2b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14-03-2024 15:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c902ff8027889f117546949b5102d22b.exe

  • Size

    512KB

  • MD5

    c902ff8027889f117546949b5102d22b

  • SHA1

    fd9d982a21e17c18da8031b2cd1be24a3b88dd76

  • SHA256

    9cea96e68569d6680bd98f0ca1b537063925b24088486931a496651340f2c0ff

  • SHA512

    b01290f8165257d2ef4f857870a2a41dc10fe09adcb11ec0273e290f3cda80d00f79f2aa27a834d84e7acb0bb5ee8bc032acb007f265e280653d0abf210bdf1a

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6B:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5O

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c902ff8027889f117546949b5102d22b.exe
    "C:\Users\Admin\AppData\Local\Temp\c902ff8027889f117546949b5102d22b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Windows\SysWOW64\ohzjppdaou.exe
      ohzjppdaou.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2576
      • C:\Windows\SysWOW64\yevdckuu.exe
        C:\Windows\system32\yevdckuu.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2544
    • C:\Windows\SysWOW64\vfeexfrhauqkecx.exe
      vfeexfrhauqkecx.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2836
    • C:\Windows\SysWOW64\yevdckuu.exe
      yevdckuu.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2380
    • C:\Windows\SysWOW64\kixtygcvrpron.exe
      kixtygcvrpron.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2740
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1348

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      044bdd7feabb3b7dc0c14699c643ac2b

      SHA1

      fe8597011fb7bcdbd34532336768b22de7ead376

      SHA256

      2ae53e20c2c57b7e59fc81f4f617c19a23422a6414afc5c994b9302dfb903676

      SHA512

      33d84dc04680dfc98790b17829b1cfb7c01a2ef4e3453b3b70c45ab9cc5996461ae8ae0c6d9c7e5b6acfabda1b00266d1c4802d6b7417f33ea9500e68a0ffa86

      Download Submit

    • C:\Users\Admin\Documents\ConvertToSplit.doc.exe
      Filesize

      512KB

      MD5

      a143616567b7d0503392edca633d3ccf

      SHA1

      be93290dd1dabb673b1fa6cb5a2cb18bae7afffc

      SHA256

      f8bb970541d9453b83f02e342c9f2a34b86a16636db391e3a5adf6a7cb3d6450

      SHA512

      fe311766ef5bdd2ebcbc6b424caeaaf4242f34531390d375987be5644a4bb99944b5a414530daf31890817cf86567dbd81e96fc740403eaa604743be21db5fd0

      Download Submit

    • C:\Windows\SysWOW64\kixtygcvrpron.exe
      Filesize

      512KB

      MD5

      16c8aafcdf9055ebe21931903081e5da

      SHA1

      0a99f957ede43d3ecbac3e14961b66cff589ec54

      SHA256

      2a0a963778d3a2617944a989064241fd43b76e3c344280798044aefc546bf222

      SHA512

      6cd8ca8fd92e24679ad0255a77d0a5424ba11a642d152cb6b13439d54ad0541fade741f7ad41ede31d75d072fbbc4fd8ca7ad15d145e99b8b1dd2a34bda261e9

      Download Submit

    • C:\Windows\SysWOW64\vfeexfrhauqkecx.exe
      Filesize

      512KB

      MD5

      08ca2e629fa0c2853bde9293fd777549

      SHA1

      b3185fd75153a23e1b7cafb176d926c4ec96edf0

      SHA256

      ed4ad0707d67bc6c2b36cefda4a71722dd29d4f20c3b1be18fc1a83a1d7023be

      SHA512

      92b720b9fd275ca80b023794c375a2867f9eead406c9b5897d1594300906b7bfe94f39cc4957cd6c8c9acfbaf6bbc14aaad87f17286d9feb3e175005821b7f5c

      Download Submit

    • C:\Windows\SysWOW64\yevdckuu.exe
      Filesize

      512KB

      MD5

      9a3144b10cccc5e9355d0c2d06584fa5

      SHA1

      d3fdd2226558f7f1202809e9eb51078b39475cfd

      SHA256

      acefd8a3f45b662c83d372a1a490e6b63d4b61007c296d6dd163f2377a8fc065

      SHA512

      29556d61fcc85e5138835f38273c1337eefcea2d7cbc9bd537a11883e1ca2b03668f1193984b66501d2f4ff507f69c45e010246192f95627f6297ad30f069de3

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
      Filesize

      512KB

      MD5

      b6ce2a2f9b2b7564886a1f0729beaef4

      SHA1

      0991409fe1099ae2f1f08a2a4da62291754cc1f0

      SHA256

      69c9944b91c44e68fffcc6a466e4260856172617496ce79f0d2bb08af7c2e9c7

      SHA512

      90f54bea00a498da4114437071f829d53100a5321816504354da16491a584321fff3e404327e5ec0149fd7a45c248196f0913d9ae0931741500d2632969a2299

      Download Submit

    • \Windows\SysWOW64\ohzjppdaou.exe
      Filesize

      512KB

      MD5

      1943f44a3d43dd252e171c526ef185e1

      SHA1

      c6a64f8a2f0eec63d32bba97bb004f2096f99589

      SHA256

      7b8d36212dbbf0186326943ad3661c0e1a58768fe12af275cd3a42e9dddf4f1d

      SHA512

      a77c9c215a07a3aa93d384febba748a1aab5da1e15883da5425fcd287630160d11e5e4e8899dd6a0042386dccab2554a3ead2366066ec905010bc942174ff5f8

      Download Submit

    • memory/1816-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2444-47-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2444-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2444-45-0x000000002F5B1000-0x000000002F5B2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2444-80-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2444-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download