ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b

Analysis

max time kernel
111s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe
Size

47KB
MD5

007571abcd265d67293cc06d10cd666a
SHA1

9e8d1d34bb49bbd017f35780ca6f293fafacd87c
SHA256

ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b
SHA512

5b5caf8a832015945debf285af92a44621e3601bbe2bcd20dabda343202bc0b3c7f4c45a4a0b6a3ab6703e0bc77db97dfdd68383f7e0c92fb51871f7bed55d5b
SSDEEP

768:EEyjLs/pQL8kP6tX6WzP6T/PdJbiv5Z6I0ig3hcxAebWUPWBnpBrO57BV:CLMQL8kTWGT7evmIamW1m5n

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4788-139-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Loads dropped DLL 7 IoCs

pid	Process
4652	rundll32.exe
2100	rundll32.exe
4652	rundll32.exe
4652	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe
1040	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\whhfd028.ocx	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\whh14030.ocx	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe
File opened for modification	C:\Program Files\Common Files\whh14030.ocx	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe
File created	C:\Program Files\Common Files\0E56B23Ece.dll	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe
File opened for modification	C:\Program Files\Common Files\0E56B23Ece.dll	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2100	rundll32.exe
2100	rundll32.exe
2100	rundll32.exe
2100	rundll32.exe
2100	rundll32.exe
2100	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4652	rundll32.exe
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4652	rundll32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 1040	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	82
PID 4788 wrote to memory of 1040	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	82
PID 4788 wrote to memory of 1040	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	82
PID 4788 wrote to memory of 4652	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	83
PID 4788 wrote to memory of 4652	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	83
PID 4788 wrote to memory of 4652	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	83
PID 4788 wrote to memory of 2100	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	84
PID 4788 wrote to memory of 2100	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	84
PID 4788 wrote to memory of 2100	4788	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe	84

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe

C:\Users\Admin\AppData\Local\Temp\ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe
"C:\Users\Admin\AppData\Local\Temp\ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe"
1⤵
- UAC bypass
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4788
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\whhfd028.ocx" InstallSvr0
  2⤵
  - Loads dropped DLL
  PID:1040
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\0E56B23Ece.dll" InstallSvr3
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Program Files\Common Files\whh14030.ocx" InstallSvr1 C:\Users\Admin\AppData\Local\Temp\ab7b697ebddfc91e550a644c41ebc5ebcb2708fd098f9a833297789a67c7be5b.exe
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\0E56B23Ece.dll

Filesize
6KB

MD5
6fb92d25078bfff1c215229067b5beaa

SHA1
3d9a6f564f492b30981359bbcee5f9e02536e3be

SHA256
5ce7c2eb8860f172dd5b68cd94307b6665f6785b207d936577bbaab196b61f33

SHA512
9cf0b61f7e618df406104685158cf877ca892e7847a3c2efed3ea4a2fb08384cc0bc492cb1ea366d1b181f79a6014fe7b95ba7ed2c15744317187be080f77b24

Download Submit
C:\Program Files\Common Files\0E56B23Ece.dll

Filesize
6KB

MD5
6fb92d25078bfff1c215229067b5beaa

SHA1
3d9a6f564f492b30981359bbcee5f9e02536e3be

SHA256
5ce7c2eb8860f172dd5b68cd94307b6665f6785b207d936577bbaab196b61f33

SHA512
9cf0b61f7e618df406104685158cf877ca892e7847a3c2efed3ea4a2fb08384cc0bc492cb1ea366d1b181f79a6014fe7b95ba7ed2c15744317187be080f77b24

Download Submit
C:\Program Files\Common Files\whh14030.ocx

Filesize
55KB

MD5
4f3fc801c8c40c44ae36def690c17d5e

SHA1
feeadb47ff28df08cd197750ca7cd3b8dd5567b9

SHA256
0006370ebe37a89858736a40ce4ea0b0b037ef9727fba289a800db0b2d52fcf0

SHA512
5dd244bed5444b9afb7f92b7961e55a4620b4bd3f5b7028de75f8cdff8c91e94ceee94914cf68c119abc733abc17e000f33799ffbf273f8e330e080c9efe333d

Download Submit
C:\Program Files\Common Files\whh14030.ocx

Filesize
55KB

MD5
4f3fc801c8c40c44ae36def690c17d5e

SHA1
feeadb47ff28df08cd197750ca7cd3b8dd5567b9

SHA256
0006370ebe37a89858736a40ce4ea0b0b037ef9727fba289a800db0b2d52fcf0

SHA512
5dd244bed5444b9afb7f92b7961e55a4620b4bd3f5b7028de75f8cdff8c91e94ceee94914cf68c119abc733abc17e000f33799ffbf273f8e330e080c9efe333d

Download Submit
C:\Program Files\Common Files\whh14030.ocx

Filesize
55KB

MD5
4f3fc801c8c40c44ae36def690c17d5e

SHA1
feeadb47ff28df08cd197750ca7cd3b8dd5567b9

SHA256
0006370ebe37a89858736a40ce4ea0b0b037ef9727fba289a800db0b2d52fcf0

SHA512
5dd244bed5444b9afb7f92b7961e55a4620b4bd3f5b7028de75f8cdff8c91e94ceee94914cf68c119abc733abc17e000f33799ffbf273f8e330e080c9efe333d

Download Submit
C:\Program Files\Common Files\whh14030.ocx

Filesize
55KB

MD5
4f3fc801c8c40c44ae36def690c17d5e

SHA1
feeadb47ff28df08cd197750ca7cd3b8dd5567b9

SHA256
0006370ebe37a89858736a40ce4ea0b0b037ef9727fba289a800db0b2d52fcf0

SHA512
5dd244bed5444b9afb7f92b7961e55a4620b4bd3f5b7028de75f8cdff8c91e94ceee94914cf68c119abc733abc17e000f33799ffbf273f8e330e080c9efe333d

Download Submit
C:\Program Files\Common Files\whh14030.ocx

Filesize
55KB

MD5
4f3fc801c8c40c44ae36def690c17d5e

SHA1
feeadb47ff28df08cd197750ca7cd3b8dd5567b9

SHA256
0006370ebe37a89858736a40ce4ea0b0b037ef9727fba289a800db0b2d52fcf0

SHA512
5dd244bed5444b9afb7f92b7961e55a4620b4bd3f5b7028de75f8cdff8c91e94ceee94914cf68c119abc733abc17e000f33799ffbf273f8e330e080c9efe333d

Download Submit
C:\Program Files\Common Files\whh14030.ocx

Filesize
55KB

MD5
4f3fc801c8c40c44ae36def690c17d5e

SHA1
feeadb47ff28df08cd197750ca7cd3b8dd5567b9

SHA256
0006370ebe37a89858736a40ce4ea0b0b037ef9727fba289a800db0b2d52fcf0

SHA512
5dd244bed5444b9afb7f92b7961e55a4620b4bd3f5b7028de75f8cdff8c91e94ceee94914cf68c119abc733abc17e000f33799ffbf273f8e330e080c9efe333d

Download Submit
C:\Windows\SysWOW64\whhfd028.ocx

Filesize
11KB

MD5
6b51354fb017488210e58687462ee83e

SHA1
d3623503867948285e9d4741f058d693decd1c17

SHA256
5707e445eeca460f2e7f320d5c99eaf7840fd94632638d48e65d66a66a4ba715

SHA512
ddcbdbd7728899eaa93d3773e600b79248e1af266a27721e6018c28430482ceb1116779416bb04983f5a8730b2a981f08db32e405a6da635500a9b2a78701406

Download Submit
C:\Windows\SysWOW64\whhfd028.ocx

Filesize
11KB

MD5
6b51354fb017488210e58687462ee83e

SHA1
d3623503867948285e9d4741f058d693decd1c17

SHA256
5707e445eeca460f2e7f320d5c99eaf7840fd94632638d48e65d66a66a4ba715

SHA512
ddcbdbd7728899eaa93d3773e600b79248e1af266a27721e6018c28430482ceb1116779416bb04983f5a8730b2a981f08db32e405a6da635500a9b2a78701406

Download Submit
memory/1040-152-0x00000000021C0000-0x00000000021D3000-memory.dmp

Filesize
76KB

Download
memory/1040-150-0x0000000010000000-0x0000000010007000-memory.dmp

Filesize
28KB

Download
memory/1040-147-0x00000000021C0000-0x00000000021D3000-memory.dmp

Filesize
76KB

Download
memory/2100-148-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/4652-149-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/4652-143-0x00000000011B0000-0x00000000011C3000-memory.dmp

Filesize
76KB

Download
memory/4652-151-0x00000000011B0000-0x00000000011C3000-memory.dmp

Filesize
76KB

Download
memory/4788-139-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download