e1c1ddf6eb34c6be593f5a46848af10dedaaf5917f55023b26d918e61709e8bb

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/09/2022, 06:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a941e2b23eda1cae45fde198191086d.exe
Size 254KB
Sample220910-hmgtwsddfl
SHA256 e1c1ddf6eb34c6be593f5a46848af10dedaaf5917f55023b26d918e61709e8bb
MD5 3a941e2b23eda1cae45fde198191086d
SHA1 a92fc97678640aac45ba9b09b7dd542f7b1b7af6
SHA512 4601e10446b338e45463b55bfe5ea393cfc84d11614b5ce2a28226abcbfa12c48f5d7da0e0ff9f0656a76533fad2da9c364866f4cfa911f38e5631389b8949e9
SSDEEP 3072:ArYBjzEbd8wBiN+g3qfG81dS3S5+S2WeALvFdRZp0N41YlqXHK6xUAB5ZCTn9J:5BjzEb6wS+g3MGadCSzCynZ31x5cTr
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4704	810H4AGIGH16B80.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	3a941e2b23eda1cae45fde198191086d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdge = "C:\\Users\\Admin\\AppData\\Roaming\\MSEdge\\msedge.exe"	3a941e2b23eda1cae45fde198191086d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4704	810H4AGIGH16B80.exe
4704	810H4AGIGH16B80.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 1712 wrote to memory of 4824	1712	3a941e2b23eda1cae45fde198191086d.exe	83
PID 4824 wrote to memory of 4724	4824	3a941e2b23eda1cae45fde198191086d.exe	85
PID 4824 wrote to memory of 4724	4824	3a941e2b23eda1cae45fde198191086d.exe	85
PID 4824 wrote to memory of 4724	4824	3a941e2b23eda1cae45fde198191086d.exe	85
PID 4824 wrote to memory of 4704	4824	3a941e2b23eda1cae45fde198191086d.exe	88
PID 4824 wrote to memory of 4704	4824	3a941e2b23eda1cae45fde198191086d.exe	88

C:\Users\Admin\AppData\Local\Temp\3a941e2b23eda1cae45fde198191086d.exe
"C:\Users\Admin\AppData\Local\Temp\3a941e2b23eda1cae45fde198191086d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\3a941e2b23eda1cae45fde198191086d.exe
  "C:\Users\Admin\AppData\Local\Temp\3a941e2b23eda1cae45fde198191086d.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe
    3⤵
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\810H4AGIGH16B80.exe
    <!DOCTYPE HTML> <html lang="en-US"> <head> <meta charset="UTF-8" /> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta name="robots" content="noindex, nofollow" /> <meta name="keywords" content="joomla, Joomla, joomla 1.5, wordpress 2.5, Drupal" /> <meta name="description" content="Joomla!" /> <meta name="generator" content="Joomla! 1.5 - Open Source Content Management" /> <meta name="generator" content="WordPress 2.5" /> <meta http-equiv="Content-Type" content="text/html;charset=UTF-8" /> <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" /> <title>Waiting for the redirectiron...</title> <style type="text/css"> body {background-color: #ffffff; font-family: "Helvetica Neue", Helvetica,Arial,sans-serif;} html, body {width: 100%; height: 100%; margin: 0; padding: 0;} span {color: #878787; font-size: 12pt; text-align: center;} h1 {color: #878787; font-size: 18pt; text-align: center;} .link {margin-top: 40px;} .sk-circle {margin: 80px auto;width: 100px;height: 100px;position: relative;} .sk-circle .sk-child {width: 100%;height: 100%;position: absolute;left: 0;top: 0;} .sk-circle .sk-child:before {content: '';display: block;margin: 0 auto;width: 15%;height: 15%;background-color: #666666;border-radius: 100%;-webkit-animation: sk-circleBounceDelay 1.2s infinite ease-in-out both;animation: sk-circleBounceDelay 1.2s infinite ease-in-out both;} .sk-circle .sk-circle2 {-webkit-transform: rotate(30deg);-ms-transform: rotate(30deg);transform: rotate(30deg); } .sk-circle .sk-circle3 {-webkit-transform: rotate(60deg);-ms-transform: rotate(60deg);transform: rotate(60deg); } .sk-circle .sk-circle4 {-webkit-transform: rotate(90deg);-ms-transform: rotate(90deg);transform: rotate(90deg); } .sk-circle .sk-circle5 {-webkit-transform: rotate(120deg);-ms-transform: rotate(120deg);transform: rotate(120deg); } .sk-circle .sk-circle6 {-webkit-transform: rotate(150deg);-ms-transform: rotate(150deg);transform: rotate(150deg); } .sk-circle .sk-circle7 {-webkit-transform: rotate(180deg);-ms-transform: rotate(180deg);transform: rotate(180deg); } .sk-circle .sk-circle8 {-webkit-transform: rotate(210deg);-ms-transform: rotate(210deg);transform: rotate(210deg); } .sk-circle .sk-circle9 {-webkit-transform: rotate(240deg);-ms-transform: rotate(240deg);transform: rotate(240deg); } .sk-circle .sk-circle10 {-webkit-transform: rotate(270deg);-ms-transform: rotate(270deg);transform: rotate(270deg); } .sk-circle .sk-circle11 {-webkit-transform: rotate(300deg);-ms-transform: rotate(300deg);transform: rotate(300deg); } .sk-circle .sk-circle12 {-webkit-transform: rotate(330deg);-ms-transform: rotate(330deg);transform: rotate(330deg); } .sk-circle .sk-circle2:before {-webkit-animation-delay: -1.1s;animation-delay: -1.1s; } .sk-circle .sk-circle3:before {-webkit-animation-delay: -1s;animation-delay: -1s; } .sk-circle .sk-circle4:before {-webkit-animation-delay: -0.9s;animation-delay: -0.9s; } .sk-circle .sk-circle5:before {-webkit-animation-delay: -0.8s;animation-delay: -0.8s; } .sk-circle .sk-circle6:before {-webkit-animation-delay: -0.7s;animation-delay: -0.7s; } .sk-circle .sk-circle7:before {-webkit-animation-delay: -0.6s;animation-delay: -0.6s; } .sk-circle .sk-circle8:before {-webkit-animation-delay: -0.5s;animation-delay: -0.5s; } .sk-circle .sk-circle9:before {-webkit-animation-delay: -0.4s;animation-delay: -0.4s; } .sk-circle .sk-circle10:before {-webkit-animation-delay: -0.3s;animation-delay: -0.3s; } .sk-circle .sk-circle11:before {-webkit-animation-delay: -0.2s;animation-delay: -0.2s; } .sk-circle .sk-circle12:before {-webkit-animation-delay: -0.1s;animation-delay: -0.1s; } @-webkit-keyframes sk-circleBounceDelay {0%, 80%, 100% {-webkit-transform: scale(0);transform: scale(0);}40% {-webkit-transform: scale(1);transform: scale(1);}} @keyframes sk-circleBounceDelay {0%, 80%, 100% {-webkit-transform: scale(0);transform: scale(0);}40% {-webkit-transform: scale(1);transform: scale(1);}} </style> <script type="text/javascript"> //<![CDATA[ function startCountdown() { setInterval(function () { var $secondsElement = document.getElementById('seconds'); var seconds = parseInt($secondsElement.innerHTML); if (seconds > 0) { seconds--; $secondsElement.innerHTML = seconds; } }, 1000); } function browserIntegrityCheck() { w = window.innerWidth; h = window.innerHeight; arr = [w, h, Math.floor((Math.random() * 9) + 1)]; arr.push(arr[0] * arr[1] * arr[2]); d = new Date().getTime(); arr = []; b = navigator.appName; div1 = document.createElement('div'); div1.style.display = 'none'; div2 = document.createElement('div'); div2.style.display = 'none'; div3 = document.createElement('div'); div3.style.display = 'none'; c = document.getElementById('content'); c.appendChild(div1); div1.appendChild(div2); div2.appendChild(div3); div1.removeChild(div2); r = genRandString(); if (r.search('asd')) { r.replace('asd', 'bsd'); } } function redirect() { setTimeout(function () { f = document.getElementById('challenge-form'); f.submit(); }, 4000); } function genRandString() { var text = ""; var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; for (var i = 0; i < 5; i++) text += possible.charAt(Math.floor(Math.random() * possible.length)); return text; } (function () { var a = function () { try { return !!window.addEventListener } catch (e) { return !1 } }, b = function (b, c) { a() ? document.addEventListener("DOMContentLoaded", b, c) : document.attachEvent("onreadystatechange", b) }; b(function () { var a = document.getElementById('content').style.display = 'block'; setTimeout(startCountdown(), 0); setTimeout(browserIntegrityCheck(), 0); setTimeout(redirect(), 0); }, false); })(); //]]> </script> </head> <body> <table width="100%" height="100%" cellpadding="20"> <tr> <td align="center" valign="middle"> <div> <noscript> <h1 style="color:#990000;">Please, turn Javascript on in your browser then reload the page.</h1> </noscript> <div id="content" style="display:none"> <div class="sk-circle"> <div class="sk-circle1 sk-child"></div> <div class="sk-circle2 sk-child"></div> <div class="sk-circle3 sk-child"></div> <div class="sk-circle4 sk-child"></div> <div class="sk-circle5 sk-child"></div> <div class="sk-circle6 sk-child"></div> <div class="sk-circle7 sk-child"></div> <div class="sk-circle8 sk-child"></div> <div class="sk-circle9 sk-child"></div> <div class="sk-circle10 sk-child"></div> <div class="sk-circle11 sk-child"></div> <div class="sk-circle12 sk-child"></div> </div> <h1>Accessing /webArg10.txt securely￢ﾀﾦ</h1> <span>This is an automatic process. Your browser will redirect to your requested content in <span id="seconds">5</span> seconds.</span> </div> <form id="challenge-form" method="post"> <input type="hidden" name="hash" value="0f8990611a41daa2fd1249c6603deb8448dd29a0"/> <input type="hidden" name="origin_url" value="/webArg10.txt"/> </form> </div> <div class="link"> <a href="https://bitninja.io" target="_blank" style="font-size: 12px;">Security check by BitNinja.IO</a> </div> </td> </tr> </table> </body>   </html>
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

810H4AGIGH16B80.exe

Path C:\Users\Admin\AppData\Local\Temp\810H4AGIGH16B80.exe
Size 8KB
SHA256 6283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
MD5 8719ce641e7c777ac1b0eaec7b5fa7c7
SHA1 c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA512 7be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
SSDEEP 192:AkLW5zLaXFLSD5VzLT6VL3LKLiXpJdXfVrdWT:B6zLqFLiVzLT6VL3LKLaHJfVrdW
MD5 SHA1 SHA512 SSDEEP

Submit Download

810H4AGIGH16B80.exe

Path C:\Users\Admin\AppData\Local\Temp\810H4AGIGH16B80.exe
Size 8KB
SHA256 6283ac6ecbf4c4038cf44896dd221c7c11152bac77273709330409032c3e72ea
MD5 8719ce641e7c777ac1b0eaec7b5fa7c7
SHA1 c04de52cb511480cc7d00d67f1d9e17b02d6406b
SHA512 7be5bd6d2342dd02818f1979e7e74a6376658711ac82a59b2af1a67207cfd3c7416b657af01216473b15132e4aa5c6675f0eb8ee6343192c7dfc4a5249ccaa97
SSDEEP 192:AkLW5zLaXFLSD5VzLT6VL3LKLiXpJdXfVrdWT:B6zLqFLiVzLT6VL3LKLaHJfVrdW
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe
Size 274B
SHA256 ac869989ff77f6a527c31f7d07706ffa369f5c53b74ffb7a5d19d5337847ad57
MD5 bbc910ab550a47be271bda0b7688bbe9
SHA1 b7f7d7c3dd11adc670bed1a2099d01e07857bb41
SHA512 1beed0839b4d25ce4c20f0acbeee94f02e05f2e84681c71f509b621f894152366d96894becff8f583456001172f121a567daee98183ecfbfacc5d194d7722fe0
MD5 SHA1 SHA512

Submit Download

memory/1712-132-0x0000000000630000-0x0000000000674000-memory.dmp

Download

memory/4704-147-0x00000190D5470000-0x00000190D5476000-memory.dmp

Download

memory/4704-148-0x00007FFD09F90000-0x00007FFD0AA51000-memory.dmp

Download

memory/4704-150-0x00007FFD09F90000-0x00007FFD0AA51000-memory.dmp

Download

memory/4824-138-0x0000000000D00000-0x0000000000D36000-memory.dmp

Download

memory/4824-141-0x0000000000D00000-0x0000000000D36000-memory.dmp

Download

memory/4824-134-0x0000000000D00000-0x0000000000D36000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads