Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2023, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
PO FILE87965345 exl.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PO FILE87965345 exl.exe
Resource
win10v2004-20230221-en
General
-
Target
PO FILE87965345 exl.exe
-
Size
1.8MB
-
MD5
26fa36b587e07bde2d99f329ba553e9c
-
SHA1
5d2b42a954666f85fcf91475c3ec361c4c254764
-
SHA256
511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730
-
SHA512
413bf79332518b6af56cc23c162d2b981a94744e463b1a01ab8f3699c681cad077d177e3213132d1791969810bc7065667b331deb4f51570a31c96a625b4c694
-
SSDEEP
12288:9d7uix2TBXVnBGw4I/6QTdp7lRpIlfMer5iiTvdyEp8NMXzp4J2cT3RnnrgYs3aF:98MXzCYqBrfGadT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\htv.exe," reg.exe -
Executes dropped EXE 1 IoCs
pid Process 1172 htv.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 5028 PING.EXE 3464 PING.EXE 4124 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe 4376 PO FILE87965345 exl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4376 PO FILE87965345 exl.exe Token: SeDebugPrivilege 1172 htv.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4376 wrote to memory of 1960 4376 PO FILE87965345 exl.exe 85 PID 4376 wrote to memory of 1960 4376 PO FILE87965345 exl.exe 85 PID 4376 wrote to memory of 1960 4376 PO FILE87965345 exl.exe 85 PID 1960 wrote to memory of 5028 1960 cmd.exe 87 PID 1960 wrote to memory of 5028 1960 cmd.exe 87 PID 1960 wrote to memory of 5028 1960 cmd.exe 87 PID 4376 wrote to memory of 1512 4376 PO FILE87965345 exl.exe 88 PID 4376 wrote to memory of 1512 4376 PO FILE87965345 exl.exe 88 PID 4376 wrote to memory of 1512 4376 PO FILE87965345 exl.exe 88 PID 1512 wrote to memory of 3464 1512 cmd.exe 90 PID 1512 wrote to memory of 3464 1512 cmd.exe 90 PID 1512 wrote to memory of 3464 1512 cmd.exe 90 PID 1960 wrote to memory of 1436 1960 cmd.exe 91 PID 1960 wrote to memory of 1436 1960 cmd.exe 91 PID 1960 wrote to memory of 1436 1960 cmd.exe 91 PID 1512 wrote to memory of 4124 1512 cmd.exe 92 PID 1512 wrote to memory of 4124 1512 cmd.exe 92 PID 1512 wrote to memory of 4124 1512 cmd.exe 92 PID 1512 wrote to memory of 1172 1512 cmd.exe 93 PID 1512 wrote to memory of 1172 1512 cmd.exe 93 PID 1512 wrote to memory of 1172 1512 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe"C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\htv.exe,"2⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 393⤵
- Runs ping.exe
PID:5028
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\htv.exe,"3⤵
- Modifies WinLogon for persistence
PID:1436
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 48 > nul && copy "C:\Users\Admin\AppData\Local\Temp\PO FILE87965345 exl.exe" "C:\Users\Admin\AppData\Local\htv.exe" && ping 127.0.0.1 -n 48 > nul && "C:\Users\Admin\AppData\Local\htv.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 483⤵
- Runs ping.exe
PID:3464
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 483⤵
- Runs ping.exe
PID:4124
-
-
C:\Users\Admin\AppData\Local\htv.exe"C:\Users\Admin\AppData\Local\htv.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD526fa36b587e07bde2d99f329ba553e9c
SHA15d2b42a954666f85fcf91475c3ec361c4c254764
SHA256511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730
SHA512413bf79332518b6af56cc23c162d2b981a94744e463b1a01ab8f3699c681cad077d177e3213132d1791969810bc7065667b331deb4f51570a31c96a625b4c694
-
Filesize
1.8MB
MD526fa36b587e07bde2d99f329ba553e9c
SHA15d2b42a954666f85fcf91475c3ec361c4c254764
SHA256511bd4f1051444242dda8ae6df80720106a6b4d60eab89658baffb142affe730
SHA512413bf79332518b6af56cc23c162d2b981a94744e463b1a01ab8f3699c681cad077d177e3213132d1791969810bc7065667b331deb4f51570a31c96a625b4c694