Overview

overview

10

Static

static

5

e032fc2737...6e.exe

windows7-x64

10

e032fc2737...6e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    153s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2024, 22:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    e032fc27371740acb0348e7de839806e.exe

  • Size

    512KB

  • MD5

    e032fc27371740acb0348e7de839806e

  • SHA1

    a9b4a36618e13761d80cafbc2033e9cae2cad360

  • SHA256

    575d055b459b5f22753c0386dfcb455c975048247da47d1115ac088bc9699f77

  • SHA512

    e61131f2b56975a42a79cb8e58f4fd5e92bbf233a67ccedd67341937409e8e37bc9eb2cd4357231c0eac4d7bee17e0104cfd1a14f3e5c608b51a90f666df7834

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6a:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5R

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 9 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e032fc27371740acb0348e7de839806e.exe
    "C:\Users\Admin\AppData\Local\Temp\e032fc27371740acb0348e7de839806e.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\SysWOW64\ffdclgaurq.exe
      ffdclgaurq.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Windows\SysWOW64\otewwspz.exe
        C:\Windows\system32\otewwspz.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2516
    • C:\Windows\SysWOW64\sbatgmslfbggmly.exe
      sbatgmslfbggmly.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2584
    • C:\Windows\SysWOW64\otewwspz.exe
      otewwspz.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2764
    • C:\Windows\SysWOW64\dsmydcjignivw.exe
      dsmydcjignivw.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2384
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1068

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe
            Filesize

            512KB

            MD5

            f9d13a3fc481dcf8851cdfc7dd17f62b

            SHA1

            9561dcb0ebd0cab333dafac5f481610d43deebfe

            SHA256

            8f673cbe98029c8f1cf3f6ddc05853e6f39e0c753671573b1f301b3275344d29

            SHA512

            31dc0427fc7438ca7f53fc7c5e346be7de7a95d699803d3afa58c976a93290a69a043d7f51c75ad85c6e9c0373d7babf71334f25520e5d8be3dcc7adcbed3bd2

            Download Submit

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            ca855503e4b10f31929c5d51cd13fed0

            SHA1

            205e97aced82ea353360b8a40601429c8a046385

            SHA256

            76dfb1681b70754510e369c129210d11d11192791c9c1a7e342cbda50c85fb7e

            SHA512

            e8500002f17e4b475726564d9b481dc960b2414600b46dea8e797c9078bfb6d26a3297cf00c5d3b60b8807e0e12ba39c0343e9f42bd7956746d2ffc19b864098

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            75cbc0698bd7688e191d7601583bdd97

            SHA1

            9be735705a210ddb9a06c6276145beed064051f2

            SHA256

            307b4f709e8bf6ec8b73861e7a0baf020345055baad73d5e69052d92909c99e9

            SHA512

            b607d9d5b89482034a405a33c043bdd8cb8bcc3b7ed58715e6ef74a4637e03bc5b918fab2fc22d608396d6f10a2929f234839e8af4d699006990f899ee6ec7fe

            Download Submit

          • C:\Windows\SysWOW64\dsmydcjignivw.exe
            Filesize

            512KB

            MD5

            63c7814242f665f711a86afdbce10c8f

            SHA1

            e6fb167dc84d7b7700098134e99972ced4df3522

            SHA256

            1597f85f8fa963aff9050283323e403a464d03b9d2d52dbe869c65c6fee6e371

            SHA512

            1f7dba5296491325fa353fcd4e19105471ab5f43ff541e1b9a4249560e7f05badfbddb7eef8fa9c82be6a4fd5065b6f59445c26466f8d50ed2a26e0a2cc9d298

            Download Submit

          • C:\Windows\SysWOW64\otewwspz.exe
            Filesize

            64KB

            MD5

            d76d22b81130bc9206c7c947d7a9ea5e

            SHA1

            5956e88a6ec7949ce5a350e21703307d855f34b1

            SHA256

            b96acd28ea28c51de470bf63ebbc33a346440fe63e236ab9f092e0cb3035b870

            SHA512

            112f4f23127929556f27e12a7979ebd1536af790c92f8ff7870a5b39470bd02d83fbf1697e7ab3eccebd71c44ae7bfbd1dac9c39fefa6e15a488baf840b8aaf1

            Download Submit

          • C:\Windows\SysWOW64\otewwspz.exe
            Filesize

            512KB

            MD5

            0f012a6436bd645ed2382487e4cd0ad3

            SHA1

            873953be67b7819d016ac0c50a30e6b5cf49ba1f

            SHA256

            f9968db9131a63332f00bdf32425fa13b4a3d4d600a2a616c2db9e1833c334a5

            SHA512

            050b08f8562de46013d2d1f4bf1e97936cd765db60b619bca969b7e0fdd999b8b119b511534efb0b005fd6bcb7cf52e38b23d8ca7f396025da3324587beab43c

            Download Submit

          • C:\Windows\SysWOW64\sbatgmslfbggmly.exe
            Filesize

            512KB

            MD5

            5421cb1cbba708b4ea0c07a64e19ffed

            SHA1

            9667419b526c83905b2456a5cc3b17cb320ba48c

            SHA256

            d3ff18b4c4808393aaed293e30733cb03eab694e34439d82e77b5cc9e9c16cad

            SHA512

            f89a18405de14bb7d0da267798935e952f29d6161e007c7f298976e9099ab72217eeca283032818d8cf764efe4bc1c9e86c722b1c192e5050fff5e1f8e1d075d

            Download Submit

          • C:\Windows\SysWOW64\sbatgmslfbggmly.exe
            Filesize

            512KB

            MD5

            340d37afdc9754e7cb49622ab395d041

            SHA1

            b91db3b29413a6a708ac4b8b37e1e19a4bd6197b

            SHA256

            2383083f2c14d77fcab7525d2fe58e452a38738a20458bb3dd43eee511bcf090

            SHA512

            1f9e64f9b45b940fbec0e8e8d9011a8a715d4cfe8fcfbf72fe408ba1dbabc9ec7a902623be61b27853e15399efea5bd170eafca472005b933dbeb27bdc31d701

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\ffdclgaurq.exe
            Filesize

            512KB

            MD5

            a49da01fb663d1f8ca5b24b3ac2b2068

            SHA1

            056f0863094d1e1f794f4480d7654e24417bb53e

            SHA256

            c813ed378c40a75c3733bf5085628f6ba712b5e1e8c05b743d42d6e27016823c

            SHA512

            6b8b2daa4bcf09c3f01dff362a2ab110bd51c94338559c8418977d08169d01fd5789c1fac182a1c4a870c653e667e9f1a793dd4d38090d0bc96a2d2fbc49f299

            Download Submit

          • memory/2040-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download

          • memory/2884-45-0x000000002F8C1000-0x000000002F8C2000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2884-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2884-47-0x0000000070C2D000-0x0000000070C38000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2884-74-0x0000000070C2D000-0x0000000070C38000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2884-95-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download