Overview

overview

10

Static

static

5

b6f0f81ecb...ee.exe

windows7-x64

10

b6f0f81ecb...ee.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    24-05-2024 20:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b6f0f81ecbef63b78f96402aea3b00e8443acaa76c130d9ba685c517cdae21ee.exe

  • Size

    512KB

  • MD5

    6f91d104958a5ca488ef235eec0c5cb4

  • SHA1

    da2b08f41effa470dc52346de414c245ecd7a464

  • SHA256

    b6f0f81ecbef63b78f96402aea3b00e8443acaa76c130d9ba685c517cdae21ee

  • SHA512

    d267842ff5fd158fe1700cfa7be1c6b086e9cb12a86f836e068adddc1574793a5a08f1b8d299c188ca597a036bd191612df3f32c0a9f360a99eb3f183be6527d

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6z:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5G

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6f0f81ecbef63b78f96402aea3b00e8443acaa76c130d9ba685c517cdae21ee.exe
    "C:\Users\Admin\AppData\Local\Temp\b6f0f81ecbef63b78f96402aea3b00e8443acaa76c130d9ba685c517cdae21ee.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\SysWOW64\kyismztmvx.exe
      kyismztmvx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Windows\SysWOW64\aeojygxf.exe
        C:\Windows\system32\aeojygxf.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2652
    • C:\Windows\SysWOW64\pgnzxgnvnyckzxc.exe
      pgnzxgnvnyckzxc.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2544
    • C:\Windows\SysWOW64\aeojygxf.exe
      aeojygxf.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2636
    • C:\Windows\SysWOW64\gcbtpvyrcucnd.exe
      gcbtpvyrcucnd.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2740
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2416
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1684

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      af2849d3a20c640a3f7f774baed42943

      SHA1

      8fd0e835564b7613a4cc13d168cf47dca94cc6fe

      SHA256

      1468d28e2b03ea0dcb4bb816f47765a22ea654bd1853215e736606fbe02eb97b

      SHA512

      541bf826903e4139646160ae2c7856a67846a9bd65efce79c8645e8beda86d077c964d4c17d4ff2f0f512eb59cb686b2b7750c456dc808fe33d9929fc99f93e2

      Download Submit

    • C:\Windows\SysWOW64\pgnzxgnvnyckzxc.exe
      Filesize

      512KB

      MD5

      951f65f1b2580bed8ae8f874fe8bf5e2

      SHA1

      cbf6d015a0c01491192a0cc6ee2ece17948eae82

      SHA256

      714d1f136db7549b310944ffea37e80e99923105981b097dc1849dedbe8d6c50

      SHA512

      99902e666d5b2eeb6ffb6c7cad82c1b7bacb674a553e68b95857e39d0db5ac80429a04848e0c6dfbf3243ddb98c4ef1168454e7c6221ecbfcb232dfd51c8ee81

      Download Submit

    • C:\Windows\mydoc.rtf
      Filesize

      223B

      MD5

      06604e5941c126e2e7be02c5cd9f62ec

      SHA1

      4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

      SHA256

      85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

      SHA512

      803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

      Download Submit

    • \Windows\SysWOW64\aeojygxf.exe
      Filesize

      512KB

      MD5

      216b1a5e938097c2fc1882d17094d0d6

      SHA1

      2f30e439a26fb25add663138d22e32dadd8a3b79

      SHA256

      26b6edebc787ad8167d677a873210c00f5afda9ef8ff750367ff9ef9acba6d13

      SHA512

      4440b8f9608153afb2d1de93f282f037786335f9743332d19f845d239d00b78b96eeafad521b5a34eb31e04038d05c16b391b136a84f0f8eb2069a6a2a6a61d4

      Download Submit

    • \Windows\SysWOW64\gcbtpvyrcucnd.exe
      Filesize

      512KB

      MD5

      da7e491890e713708554bed448f2e346

      SHA1

      9bec822f2f775d895ea6bf96285241c0fc7e0905

      SHA256

      819cf2544ab22696c7e30c5534977454432e55feff2f138b67c9f5f2706e8491

      SHA512

      522d644092f4c8e01e39c17ee71cb7c59030ce1276bceba13d39ae0eec79cc1d89a28993eff6b7018a43328cf39faa8e07f0ed31bde7fcfcc1fb884c1abfde55

      Download Submit

    • \Windows\SysWOW64\kyismztmvx.exe
      Filesize

      512KB

      MD5

      a5378a7e3fdddc40ebf10378d5f1e048

      SHA1

      b39f2186491d8cec37d9c9716dd2e530fa1b9361

      SHA256

      84ea60b02224af785c43082853880bc563a1e682ad6557106999594eaf66b0da

      SHA512

      7c683f56ffc6aff27d1e3ce80e025307ecf2cade26de712f91e0966c11df50296f06b17b46da6d96bd642cce4b3b2e657e5d4f59f622744b16e37dd575992bab

      Download Submit

    • memory/1268-0-0x0000000000400000-0x0000000000496000-memory.dmp

      Filesize

      600KB

      Download

    • memory/2416-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2416-92-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download