12d5fbff1e80dd9734832239666db3e54ee5f07f03d4c285a04ce69067b96d69

Analysis

max time kernel
116s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 18:43 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Backdoor.Win32.Hupigon.exe
Size

613KB
MD5

03c4dbf772380a46f0d71795e1ce6bf2
SHA1

8366bc0858d21f07573b08de57d662a2a1a24c51
SHA256

ed125acd9eaf97bc0fd455dd4eb257cfa662c4b96024d03678ddb35db035373b
SHA512

251343fd85a4538aee24628a84662badd0d61bf38ffa8d239e21b74043805b18e5ebfd6a71070f8dcb7242ad1bb5456b2f7f50a1ca585e8a308656f88c9e2351
SSDEEP

12288:jKFa0zkNhGNnoOx7Tz98HtoIUAtF3Z4mxxnDqVTVOCkEXW:jKjkN4iqXzyOmQmX2VTzkn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1788	twunk_64.exe

Deletes itself 1 IoCs

pid	Process
1704	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\twunk_64.exe	Backdoor.Win32.Hupigon.exe
File created	C:\Windows\Delete.bat	Backdoor.Win32.Hupigon.exe
File created	C:\Windows\twunk_64.exe	Backdoor.Win32.Hupigon.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	twunk_64.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	twunk_64.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	twunk_64.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	twunk_64.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	twunk_64.exe
Key created	\REGISTRY\USER\.DEFAULT\System	twunk_64.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	twunk_64.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	twunk_64.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	twunk_64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1788	twunk_64.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1720	1788	twunk_64.exe	28
PID 1788 wrote to memory of 1720	1788	twunk_64.exe	28
PID 1788 wrote to memory of 1720	1788	twunk_64.exe	28
PID 1788 wrote to memory of 1720	1788	twunk_64.exe	28
PID 1060 wrote to memory of 1704	1060	Backdoor.Win32.Hupigon.exe	29
PID 1060 wrote to memory of 1704	1060	Backdoor.Win32.Hupigon.exe	29
PID 1060 wrote to memory of 1704	1060	Backdoor.Win32.Hupigon.exe	29
PID 1060 wrote to memory of 1704	1060	Backdoor.Win32.Hupigon.exe	29

C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Hupigon.exe
"C:\Users\Admin\AppData\Local\Temp\Backdoor.Win32.Hupigon.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:1704

C:\Windows\twunk_64.exe
C:\Windows\twunk_64.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c
1⤵
PID:1496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
166B

MD5
48b3de545aa164eacb2eb266c381deab

SHA1
aeae04d954b94fcc90c432d3ed00116d846e420e

SHA256
6abee46232fe488bca9dc7f2162bb54b1001fd63f5e19c4cd6ec5ca0591134aa

SHA512
625fd497f9f110f23f1599630a2d372bfd460b46f8d09421a14b0bf03c2648bf126a0c11eb9d3829b2ea04c9e42df2cbf1609875778a7481028d7fdda0728d55

Download Submit
C:\Windows\twunk_64.exe

Filesize
613KB

MD5
03c4dbf772380a46f0d71795e1ce6bf2

SHA1
8366bc0858d21f07573b08de57d662a2a1a24c51

SHA256
ed125acd9eaf97bc0fd455dd4eb257cfa662c4b96024d03678ddb35db035373b

SHA512
251343fd85a4538aee24628a84662badd0d61bf38ffa8d239e21b74043805b18e5ebfd6a71070f8dcb7242ad1bb5456b2f7f50a1ca585e8a308656f88c9e2351

Download Submit
C:\Windows\twunk_64.exe

Filesize
613KB

MD5
03c4dbf772380a46f0d71795e1ce6bf2

SHA1
8366bc0858d21f07573b08de57d662a2a1a24c51

SHA256
ed125acd9eaf97bc0fd455dd4eb257cfa662c4b96024d03678ddb35db035373b

SHA512
251343fd85a4538aee24628a84662badd0d61bf38ffa8d239e21b74043805b18e5ebfd6a71070f8dcb7242ad1bb5456b2f7f50a1ca585e8a308656f88c9e2351

Download Submit
memory/1060-55-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1060-58-0x0000000003280000-0x0000000003285000-memory.dmp

Filesize
20KB

Download
memory/1060-57-0x0000000003290000-0x0000000003390000-memory.dmp

Filesize
1024KB

Download
memory/1060-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1060-63-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1060-56-0x0000000000380000-0x00000000003D4000-memory.dmp

Filesize
336KB

Download
memory/1788-65-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/1788-66-0x0000000001D60000-0x0000000001DB4000-memory.dmp

Filesize
336KB

Download
memory/1788-67-0x0000000003160000-0x0000000003165000-memory.dmp

Filesize
20KB

Download
memory/1788-68-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download