a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b

Analysis

max time kernel
150s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Size

76KB
MD5

1ab861c18a6da7c284976efdd2074262
SHA1

14177f15beb8c34836ae09fa340174c6b0fbcca3
SHA256

a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b
SHA512

87862fc66efe33c757cde48d87bc476fc43dde9331e8e6b245131ecae7604d1b85d1b63e4a76fe192759cbcb0d879c4989caaf231528ed05cf0eda03a054b43a
SSDEEP

768:9ZVy+DZ4mV+RMO2rhgFwuqCbxTGy/BBGg4NKhLU4dhbDW2+Kv00dX0vN0TlT+Xya:/amlu3hbBGy3G8nhMpDz

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	hama.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hama.exe

Executes dropped EXE 1 IoCs

pid	Process
940	hama.exe

Loads dropped DLL 2 IoCs

pid	Process
1368	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
1368	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	hama.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	hama.exe
File opened (read-only)	\??\U:	hama.exe
File opened (read-only)	\??\X:	hama.exe
File opened (read-only)	\??\Z:	hama.exe
File opened (read-only)	\??\B:	hama.exe
File opened (read-only)	\??\F:	hama.exe
File opened (read-only)	\??\H:	hama.exe
File opened (read-only)	\??\J:	hama.exe
File opened (read-only)	\??\S:	hama.exe
File opened (read-only)	\??\T:	hama.exe
File opened (read-only)	\??\W:	hama.exe
File opened (read-only)	\??\Y:	hama.exe
File opened (read-only)	\??\V:	hama.exe
File opened (read-only)	\??\I:	hama.exe
File opened (read-only)	\??\M:	hama.exe
File opened (read-only)	\??\N:	hama.exe
File opened (read-only)	\??\Q:	hama.exe
File opened (read-only)	\??\P:	hama.exe
File opened (read-only)	\??\R:	hama.exe
File opened (read-only)	\??\E:	hama.exe
File opened (read-only)	\??\G:	hama.exe
File opened (read-only)	\??\L:	hama.exe
File opened (read-only)	\??\O:	hama.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\maxtrox.txt	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	hama.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	hama.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	hama.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	hama.exe

Drops file in Program Files directory 34 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	hama.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPDMC.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	hama.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MpCmdRun.exe	hama.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpenc.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	hama.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	hama.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Defender\MSASCui.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wab.exe	hama.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	hama.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	hama.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	hama.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Journal\PDIALOG.exe	hama.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\sidebar.exe	hama.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	hama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	hama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	hama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	hama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	hama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	hama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	hama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	hama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	hama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
940	hama.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 940	1368	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe	27
PID 1368 wrote to memory of 940	1368	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe	27
PID 1368 wrote to memory of 940	1368	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe	27
PID 1368 wrote to memory of 940	1368	a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe	27

C:\Users\Admin\AppData\Local\Temp\a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe
"C:\Users\Admin\AppData\Local\Temp\a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b.exe"
1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\hama.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\hama.exe" a21e1d6867a6a5b99a771f6f87dd3a089b217897f12f591965ab4fe1dabe4f5b
  2⤵
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\hama.exe

Filesize
76KB

MD5
a2eb1efeb1dfc8509f729945d6c44792

SHA1
cda721a6bab48b3188771b817a33fa17a9eea20c

SHA256
13a932d5b31fcc9ee3d5de18abfd6bb8d44a7935ac1c5d23cff836cb26730b0e

SHA512
4c0e5ffb704145437caaae40d8a9dae709673953168109bf5d05f4b9b31cf9cd678fa7480d906db07b630b90248cb1677c0013808302e519c231b2bed5ce050e

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\hama.exe

Filesize
76KB

MD5
a2eb1efeb1dfc8509f729945d6c44792

SHA1
cda721a6bab48b3188771b817a33fa17a9eea20c

SHA256
13a932d5b31fcc9ee3d5de18abfd6bb8d44a7935ac1c5d23cff836cb26730b0e

SHA512
4c0e5ffb704145437caaae40d8a9dae709673953168109bf5d05f4b9b31cf9cd678fa7480d906db07b630b90248cb1677c0013808302e519c231b2bed5ce050e

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\hama.exe

Filesize
76KB

MD5
a2eb1efeb1dfc8509f729945d6c44792

SHA1
cda721a6bab48b3188771b817a33fa17a9eea20c

SHA256
13a932d5b31fcc9ee3d5de18abfd6bb8d44a7935ac1c5d23cff836cb26730b0e

SHA512
4c0e5ffb704145437caaae40d8a9dae709673953168109bf5d05f4b9b31cf9cd678fa7480d906db07b630b90248cb1677c0013808302e519c231b2bed5ce050e

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\hama.exe

Filesize
76KB

MD5
a2eb1efeb1dfc8509f729945d6c44792

SHA1
cda721a6bab48b3188771b817a33fa17a9eea20c

SHA256
13a932d5b31fcc9ee3d5de18abfd6bb8d44a7935ac1c5d23cff836cb26730b0e

SHA512
4c0e5ffb704145437caaae40d8a9dae709673953168109bf5d05f4b9b31cf9cd678fa7480d906db07b630b90248cb1677c0013808302e519c231b2bed5ce050e

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads