Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 15:35

General

  • Target

    d67add1de2a10c7e5f9eb64ed143005e.exe

  • Size

    512KB

  • MD5

    d67add1de2a10c7e5f9eb64ed143005e

  • SHA1

    c13cba438d4c6def213d16b348f8066a9568f44d

  • SHA256

    a96605e0b5c535b2aa7fe9c530a7b75c2b9f2ff5fcac7cbe1a3f5337631f68a2

  • SHA512

    a109a3dc77727269ba8c8c6c9036a8c835ce0f2896886b9efa3c18e86e28174678cdeb8ef3739131175167f306f0300e6575b7972837aabe647dc73e01173223

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6v:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5+

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 6 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • AutoIT Executable 12 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 19 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 20 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d67add1de2a10c7e5f9eb64ed143005e.exe
    "C:\Users\Admin\AppData\Local\Temp\d67add1de2a10c7e5f9eb64ed143005e.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2856
    • C:\Windows\SysWOW64\tghrucstxp.exe
      tghrucstxp.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\SysWOW64\amgavrdb.exe
        C:\Windows\system32\amgavrdb.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1604
    • C:\Windows\SysWOW64\jwxpzirotkqwwep.exe
      jwxpzirotkqwwep.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:996
    • C:\Windows\SysWOW64\amgavrdb.exe
      amgavrdb.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2696
    • C:\Windows\SysWOW64\hvooeomzgychc.exe
      hvooeomzgychc.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3024
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
      2⤵
      • Drops file in Windows directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe

    Filesize

    512KB

    MD5

    cf172eae18161bd0d8be76d0a0780e0a

    SHA1

    23666458bdfacddaa6885ea0899a04b0e66f1309

    SHA256

    560e48e7c12da3e33721d5cc8f5e012a06f15baddd70ccc16db309a99c6e0599

    SHA512

    28bf4212035062ac062304d420e43616a6b1b5cf49d949af123866208b4df17d87bd65c8e86b4eebd279fe9f8c312b7caf64d72d098da42615dc1e0b7dcd2d92

  • C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe

    Filesize

    512KB

    MD5

    f3fd48333c6c2350a067971bb5ed033e

    SHA1

    adeaab5019eb90df7826847ea60f1d05e098d37e

    SHA256

    d9185b4c1fd1a8d3d57f32cdd6460e1886b4bfd63f88e4cb44a94b7c561b4024

    SHA512

    0a2a52367033c40f5f18ab3bc6917c7cb7b73a5eb895da8ab688063c26e3ccba13c7222ce771c78387d4d63b35d6588ef6dcc510e256ce45bebe22f42e02ec40

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    239B

    MD5

    60e7e2e6832bca3c3a1520b0ee5fa568

    SHA1

    34804685947303527a3d344e593654da8e949bcb

    SHA256

    5f58a2c0e82be8abd8810ada1a12b022d8fad21e02ab0b8d755b47858241f776

    SHA512

    f2ba4896c6cac6bf997b298bdc230b4ddc6b89f8a2ea0a1f55822f046bf93edda957cbe5b4139244d2aad944ce2b21d36c8973246215f4140ce787a3bd60c3f5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    3f251e63b589d0dac998dd00fa6b7634

    SHA1

    2b42d8113dada673ba5e1a05749f248e10628337

    SHA256

    2472438cd2157e77d56aba8f78aa69ec2ef7205c6e45eeb214b1eb84bbca8c79

    SHA512

    c7c082ccc516bffeffe6dc92ed963b47e81c4be30e4116f03d73419a5061c315ab5c84a2a4d83431fa375f509333d60e90264cebcd61f2533ec6e8e93609c801

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms~RFe577937.TMP

    Filesize

    3KB

    MD5

    e94d6e201397b28c88de797fb1d178d9

    SHA1

    dceb7e3f893b19c8c5bf6f58b168dfa6a4e40164

    SHA256

    ee956657a68f7724b01ab1fd039b21fb9cc319c482ced0823b5ee9be7f8605f6

    SHA512

    1fc96bb5978252719d91d22d99fc5d03f0084fe83405e6918c5687d1209eea48da7811d5d697d9fdea1a8d6cea5a981e3a518a241ee10902bd7638bb86211f55

  • C:\Users\Admin\Documents\DisableBackup.doc.exe

    Filesize

    512KB

    MD5

    b1de24085655680782cd59ef1c3629ac

    SHA1

    5fa817b58d571db4be4adf6ed8a584ce83bbc2c2

    SHA256

    ff5f937f587cbd48f2e2063326015a3d45800d4c228b4824f90b13abb55c77f2

    SHA512

    2f477673015f86e66016b436781d02586fe4591d47445b578ac82295a33e5ff989205a862155b555b1af7a9c4e8c7941eb36e5e5ae7441e2c0cc3916b5dec9ec

  • C:\Users\Admin\Downloads\InvokeAdd.doc.exe

    Filesize

    512KB

    MD5

    4c9dbd64485c70fc424daae03df03dd7

    SHA1

    ce7e6ce3924907e82bd77863e2ae988db3e9f1bc

    SHA256

    927b845bc44b2599d0ed65ba6320536ebd54625a0c81bd31fba4980b2ea868b1

    SHA512

    46c1a2d68865399deebcdaef139215712d84eb3fbb8f3d08e4f7fe784d9057aee09ac298766e161072cf18181bf2430135ed3de36eaf1149f8ddc8ce2403058d

  • C:\Windows\SysWOW64\amgavrdb.exe

    Filesize

    512KB

    MD5

    e967ddecf44957e7ac199a8da11395d7

    SHA1

    5037338b64c9bcd04da8db7d3f8d946af28423a7

    SHA256

    26fbf31a04a7d2ff0a41fe03e851bd4868b91280b7b9fe02b52b6f09da09f03f

    SHA512

    7a547ff3f2c3a889111c30b08b92b7716078024a41cff83945d68be573617f65983f7fdf497f3c825d1d72b6b2f52bcf1859e1c4afde7aaab9e5e64416de7a86

  • C:\Windows\SysWOW64\amgavrdb.exe

    Filesize

    128KB

    MD5

    33be84de0fa03c6883fec2ead970e3ba

    SHA1

    dbe35ed4343779aa93200c24966ccb805e18f223

    SHA256

    ef0f2733bf476c4dc632a27627cb24681d552719aafcc969eec5db1a90996887

    SHA512

    3e93ab8677009d404503e243038ae323b1bc55af56c8c53bd3d44f5313ed4383c987ccb1f1f0e86111fc36db67c7b1b76de4eb4b1c6742baadffd70d7dc6c093

  • C:\Windows\SysWOW64\hvooeomzgychc.exe

    Filesize

    512KB

    MD5

    cb8db18f3216edc034ff9d12bcc36d8b

    SHA1

    b7ece4e5cfe51c479a313d9a1eaf3ec36dc94563

    SHA256

    c9651a6235bb7caaf7d4ac006452f0818c626aea2b1e78bd087fbafdb53db5ed

    SHA512

    c0019882073a943b6341b1a3e3d0bd7cb695dbd5514e27a11e420505cf343a65760f12a8ec450bace5590e22ba617a2ca05c9e8484c7a832876d49c76be2e189

  • C:\Windows\SysWOW64\jwxpzirotkqwwep.exe

    Filesize

    512KB

    MD5

    e1f8dae56527bd0abbd8858b3d12a79a

    SHA1

    be43cbe11ab346a1004e2a4003a1ffc26fbe1753

    SHA256

    c1bb9afa62c5144c1122fc36b31d7c6273df9baaa86f354bbb91620b31f02ce2

    SHA512

    32c3cc5b6b0192b07148b5a3509a124f50e60612fd95ddcb64dde81f0258fbafc90a732165e490b22df80ed9b2ed30eff6d55d71c736adce3a983a000c4dba02

  • C:\Windows\SysWOW64\tghrucstxp.exe

    Filesize

    512KB

    MD5

    718abde1cedb14a60626372e12aaed4a

    SHA1

    f1d192af917d493b2b226c157c7c3725a377614d

    SHA256

    f76e065f23f0dba86582d0bc5febc92d65d9b0a0b9531b42c80579afb329ad23

    SHA512

    1e6db094f9ff24a9b8779854d2d1e0b4aa143ce2bf70f02695058c3ffb71c6f4a4edefbd508c7f7e76a89807f6304d92c75ef12b78d00d0cfbe2c31d4abea3d5

  • C:\Windows\mydoc.rtf

    Filesize

    223B

    MD5

    06604e5941c126e2e7be02c5cd9f62ec

    SHA1

    4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

    SHA256

    85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

    SHA512

    803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    80394739cc2512e53c8f856240ad1e8b

    SHA1

    afbef618245398b672047cbe6ff5ece06e36f91d

    SHA256

    79b0600e68a6a182031dc8e53f08aad1d612d0eb6eba0615fa6aeb1712b353e9

    SHA512

    d3d9b26852a8a14dfac759f36e3e1c5650100463a289d0f4a292cad47501f508f44f2a0492e5a1b28e887eea9a7b6eff52ad247a54b106f2a87ffae9c420ae2a

  • \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe

    Filesize

    512KB

    MD5

    12c59ea897a013a0ffe6b05d2943a8d5

    SHA1

    4241aea3ada0b6a6aa77a7663b57deba445fdd22

    SHA256

    3ccde3a0ebe68d1ae8b35fe7840dab9a8d3f42e4974713b988499efae2cc3fb2

    SHA512

    e0bbe0e21a692e1c301d87a2352d66a241aeb0f39f1c7aa9253e702033728baaddc7c48b84bb2584a6b061dafe0db0225d63daaf5e4ca266207e6f3618d8a8c2

  • memory/2632-41-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-126-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-45-0x00007FFB0B2B0000-0x00007FFB0B2C0000-memory.dmp

    Filesize

    64KB

  • memory/2632-50-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-52-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-51-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-54-0x00007FFB0B2B0000-0x00007FFB0B2C0000-memory.dmp

    Filesize

    64KB

  • memory/2632-55-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-53-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-46-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-56-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-57-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-44-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-42-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-43-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-154-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-40-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-39-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-37-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-38-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-36-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-35-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-47-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-148-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-149-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-150-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-151-0x00007FFB0D310000-0x00007FFB0D320000-memory.dmp

    Filesize

    64KB

  • memory/2632-152-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2632-153-0x00007FFB4D290000-0x00007FFB4D485000-memory.dmp

    Filesize

    2.0MB

  • memory/2856-0-0x0000000000400000-0x0000000000496000-memory.dmp

    Filesize

    600KB