ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623

Analysis

max time kernel
226s
max time network
309s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe
Size

416KB
MD5

c6396bde5cff6957fc4a92f93439a548
SHA1

c13dc8354751753e3747a3e00210da05a0bcddb2
SHA256

ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623
SHA512

b7171022003a4b26b104e32ab396fc163790df0888c51411cf9443cd4ce6c92c8dddd6725def5f27cf5afafc25237cfee0665543779326fd504829178355ca1e
SSDEEP

6144:L6MMXUsbMG0XKnmSwzOzxUiXXPU++6b26jFNuo2PeUTLwfYdRVlAtg+C82FR:i/MfKmNzYbXM++6b26R5o1dRVwY

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
468	afaki.exe

Deletes itself 1 IoCs

pid	Process
1412	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe
1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\Currentversion\Run	afaki.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\{E8A35E48-3774-AD4D-52EE-D422474DF73F} = "C:\\Users\\Admin\\AppData\\Roaming\\Uruq\\afaki.exe"	afaki.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Privacy	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe
468	afaki.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe
468	afaki.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 468	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	28
PID 1260 wrote to memory of 468	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	28
PID 1260 wrote to memory of 468	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	28
PID 1260 wrote to memory of 468	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	28
PID 468 wrote to memory of 1124	468	afaki.exe	13
PID 468 wrote to memory of 1124	468	afaki.exe	13
PID 468 wrote to memory of 1124	468	afaki.exe	13
PID 468 wrote to memory of 1124	468	afaki.exe	13
PID 468 wrote to memory of 1124	468	afaki.exe	13
PID 468 wrote to memory of 1192	468	afaki.exe	12
PID 468 wrote to memory of 1192	468	afaki.exe	12
PID 468 wrote to memory of 1192	468	afaki.exe	12
PID 468 wrote to memory of 1192	468	afaki.exe	12
PID 468 wrote to memory of 1192	468	afaki.exe	12
PID 468 wrote to memory of 1228	468	afaki.exe	11
PID 468 wrote to memory of 1228	468	afaki.exe	11
PID 468 wrote to memory of 1228	468	afaki.exe	11
PID 468 wrote to memory of 1228	468	afaki.exe	11
PID 468 wrote to memory of 1228	468	afaki.exe	11
PID 468 wrote to memory of 1260	468	afaki.exe	10
PID 468 wrote to memory of 1260	468	afaki.exe	10
PID 468 wrote to memory of 1260	468	afaki.exe	10
PID 468 wrote to memory of 1260	468	afaki.exe	10
PID 468 wrote to memory of 1260	468	afaki.exe	10
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 1260 wrote to memory of 1412	1260	ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe	29
PID 468 wrote to memory of 1476	468	afaki.exe	30
PID 468 wrote to memory of 1476	468	afaki.exe	30
PID 468 wrote to memory of 1476	468	afaki.exe	30
PID 468 wrote to memory of 1476	468	afaki.exe	30
PID 468 wrote to memory of 1476	468	afaki.exe	30

C:\Users\Admin\AppData\Local\Temp\ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe
"C:\Users\Admin\AppData\Local\Temp\ea8a5b489a1f6971243ae549dffcf8495a807b735ebc7509e7c5e9552ff6e623.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Roaming\Uruq\afaki.exe
  "C:\Users\Admin\AppData\Roaming\Uruq\afaki.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpf769432b.bat"
  2⤵
  - Deletes itself
  PID:1412

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1228

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1192

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "708725119177871769-1147132788-17670117041827569752102856477-186287368861643224"
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\ykgux.nyl

Filesize
466B

MD5
e21f16740416382e0bfecea74513c6ec

SHA1
01fb6ff850f894c596387689ae42945a4a0eeea4

SHA256
6421f2fde50149806fd88eefe2df0a29ba5d68ec74adc0b7684f33f1a6438e27

SHA512
893bfce742c60c2349781bc4647db76f235ae2c83e90d96ae8197533569d198b422c225354d78b7a5e04096d052e67b794eaa06c1d53e215c63aea7456c600b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpf769432b.bat

Filesize
307B

MD5
a2e17e6bb12b5115023adbcbaec4791f

SHA1
5d30b3bd15a9e9bd5600b7c399c0a7fe815054f3

SHA256
0706ca273f4532b02cd51e39e567573bacca3d85b8e5880cefba02c880592376

SHA512
efc1af3be586ea6d476f6dcec6f3f484fb3517da0c4383781f512755263eea1ecd748634fefbcbd30b5c4bd49c464bdad1f13a67c2116ab6eab3c9c3d0bdd168

Download Submit
C:\Users\Admin\AppData\Roaming\Uruq\afaki.exe

Filesize
416KB

MD5
21ae6ef0b0de1e1969d07d52a98e11a0

SHA1
1f47e37e21b36c98e09d2935c3169e6930b723c9

SHA256
b7e5f0558ae7c6e7b6ac22e6c621f3c26c34c2693683c62d4bf44f9b8c45dd86

SHA512
a7da4d1faeb4e1db293f1bcb198732b3857fb55deb19ec35d973766dd47da9e74abd8eb726971114b0dc6447446b56fc0c78c4e13cf7cb69fd0d79e68ec0ade7

Download Submit
C:\Users\Admin\AppData\Roaming\Uruq\afaki.exe

Filesize
416KB

MD5
21ae6ef0b0de1e1969d07d52a98e11a0

SHA1
1f47e37e21b36c98e09d2935c3169e6930b723c9

SHA256
b7e5f0558ae7c6e7b6ac22e6c621f3c26c34c2693683c62d4bf44f9b8c45dd86

SHA512
a7da4d1faeb4e1db293f1bcb198732b3857fb55deb19ec35d973766dd47da9e74abd8eb726971114b0dc6447446b56fc0c78c4e13cf7cb69fd0d79e68ec0ade7

Download Submit
\Users\Admin\AppData\Roaming\Uruq\afaki.exe

Filesize
416KB

MD5
21ae6ef0b0de1e1969d07d52a98e11a0

SHA1
1f47e37e21b36c98e09d2935c3169e6930b723c9

SHA256
b7e5f0558ae7c6e7b6ac22e6c621f3c26c34c2693683c62d4bf44f9b8c45dd86

SHA512
a7da4d1faeb4e1db293f1bcb198732b3857fb55deb19ec35d973766dd47da9e74abd8eb726971114b0dc6447446b56fc0c78c4e13cf7cb69fd0d79e68ec0ade7

Download Submit
\Users\Admin\AppData\Roaming\Uruq\afaki.exe

Filesize
416KB

MD5
21ae6ef0b0de1e1969d07d52a98e11a0

SHA1
1f47e37e21b36c98e09d2935c3169e6930b723c9

SHA256
b7e5f0558ae7c6e7b6ac22e6c621f3c26c34c2693683c62d4bf44f9b8c45dd86

SHA512
a7da4d1faeb4e1db293f1bcb198732b3857fb55deb19ec35d973766dd47da9e74abd8eb726971114b0dc6447446b56fc0c78c4e13cf7cb69fd0d79e68ec0ade7

Download Submit
memory/468-77-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/468-73-0x0000000000280000-0x00000000002C4000-memory.dmp

Filesize
272KB

Download
memory/468-74-0x0000000000360000-0x00000000003BF000-memory.dmp

Filesize
380KB

Download
memory/1124-71-0x0000000001E20000-0x0000000001E64000-memory.dmp

Filesize
272KB

Download
memory/1124-66-0x0000000001E20000-0x0000000001E64000-memory.dmp

Filesize
272KB

Download
memory/1124-68-0x0000000001E20000-0x0000000001E64000-memory.dmp

Filesize
272KB

Download
memory/1124-69-0x0000000001E20000-0x0000000001E64000-memory.dmp

Filesize
272KB

Download
memory/1124-70-0x0000000001E20000-0x0000000001E64000-memory.dmp

Filesize
272KB

Download
memory/1192-80-0x0000000000120000-0x0000000000164000-memory.dmp

Filesize
272KB

Download
memory/1192-76-0x0000000000120000-0x0000000000164000-memory.dmp

Filesize
272KB

Download
memory/1192-78-0x0000000000120000-0x0000000000164000-memory.dmp

Filesize
272KB

Download
memory/1192-79-0x0000000000120000-0x0000000000164000-memory.dmp

Filesize
272KB

Download
memory/1228-83-0x00000000029D0000-0x0000000002A14000-memory.dmp

Filesize
272KB

Download
memory/1228-86-0x00000000029D0000-0x0000000002A14000-memory.dmp

Filesize
272KB

Download
memory/1228-85-0x00000000029D0000-0x0000000002A14000-memory.dmp

Filesize
272KB

Download
memory/1228-84-0x00000000029D0000-0x0000000002A14000-memory.dmp

Filesize
272KB

Download
memory/1260-89-0x00000000022F0000-0x0000000002334000-memory.dmp

Filesize
272KB

Download
memory/1260-104-0x00000000022F0000-0x0000000002334000-memory.dmp

Filesize
272KB

Download
memory/1260-58-0x0000000000500000-0x000000000055F000-memory.dmp

Filesize
380KB

Download
memory/1260-59-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1260-90-0x00000000022F0000-0x0000000002334000-memory.dmp

Filesize
272KB

Download
memory/1260-91-0x00000000022F0000-0x0000000002334000-memory.dmp

Filesize
272KB

Download
memory/1260-92-0x00000000022F0000-0x0000000002334000-memory.dmp

Filesize
272KB

Download
memory/1260-57-0x00000000004B0000-0x00000000004F4000-memory.dmp

Filesize
272KB

Download
memory/1260-93-0x00000000022F0000-0x000000000234F000-memory.dmp

Filesize
380KB

Download
memory/1260-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1260-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1260-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1260-103-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1260-101-0x00000000022F0000-0x000000000234F000-memory.dmp

Filesize
380KB

Download
memory/1412-100-0x00000000000A0000-0x00000000000E4000-memory.dmp

Filesize
272KB

Download
memory/1412-99-0x00000000000A0000-0x00000000000E4000-memory.dmp

Filesize
272KB

Download
memory/1412-98-0x00000000000A0000-0x00000000000E4000-memory.dmp

Filesize
272KB

Download
memory/1412-113-0x00000000000A0000-0x00000000000E4000-memory.dmp

Filesize
272KB

Download
memory/1412-96-0x00000000000A0000-0x00000000000E4000-memory.dmp

Filesize
272KB

Download
memory/1476-109-0x0000000001B80000-0x0000000001BC4000-memory.dmp

Filesize
272KB

Download
memory/1476-110-0x0000000001B80000-0x0000000001BC4000-memory.dmp

Filesize
272KB

Download
memory/1476-111-0x0000000001B80000-0x0000000001BC4000-memory.dmp

Filesize
272KB

Download
memory/1476-112-0x0000000001B80000-0x0000000001BC4000-memory.dmp

Filesize
272KB

Download