ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403

Analysis

max time kernel
156s
max time network
163s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 22:13

Target

ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe
Size

157KB
MD5

cc024bc0e1e40bc2f478f43a370a826e
SHA1

ebff2addc105c708460b5a054a5841a7c935dd29
SHA256

ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403
SHA512

ae72a269bfa92757c9674b3e436dcdf8194852b7cca2cd197a83fb58168b7de5281e97ef635e094909b4d4b8e1b2cb983cf4d5c48e9c89289c9b8eb79fd4c47e
SSDEEP

3072:zpCjtzxD3F0DcmcIn+STVR8fNdUfZKcsgzG9tniBh5NJ3l:6zAcdIVxmzGZ1FzGPnet

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1792	Aluxoa.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Aluxoa.exe	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe
File opened for modification	C:\Windows\Aluxoa.exe	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe
File created	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	Aluxoa.exe
File opened for modification	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	Aluxoa.exe
File created	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe
File opened for modification	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\International	Aluxoa.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	Aluxoa.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1592	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe
1792	Aluxoa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 1792	1592	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe	27
PID 1592 wrote to memory of 1792	1592	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe	27
PID 1592 wrote to memory of 1792	1592	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe	27
PID 1592 wrote to memory of 1792	1592	ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403.exe	27

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Windows\Aluxoa.exe

Filesize
157KB

MD5
cc024bc0e1e40bc2f478f43a370a826e

SHA1
ebff2addc105c708460b5a054a5841a7c935dd29

SHA256
ce33e82a3b0bc751046c52c3db336aee0c3166a85e514fa9b3dc3c9478326403

SHA512
ae72a269bfa92757c9674b3e436dcdf8194852b7cca2cd197a83fb58168b7de5281e97ef635e094909b4d4b8e1b2cb983cf4d5c48e9c89289c9b8eb79fd4c47e

Download Submit
C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job

Filesize
408B

MD5
f80a2085a333d64dc1d0de7c1675e099

SHA1
70ca77a24bc743472f1a086784b5a4881f970a66

SHA256
d844a56de67af1085e8061f977a00e95fc34a76be538f329709a86e754bfad81

SHA512
c114468254d1daa570bf1eb0e3ae41b1ba62cdb72614ab0e629f3fc943a96e7525de9e93a3ce0e24e1928bcfb67aaf17588fa4616dc0044cc8aeb6800bc40323

Download Submit
memory/1592-54-0x0000000074FB1000-0x0000000074FB3000-memory.dmp

Filesize
8KB

Download
memory/1592-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1592-56-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1592-57-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1592-62-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1592-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1792-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1792-65-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download