62d20fdc2a6c018b6a25cbb3882290d1ea6ea207517e0af717a46254e321f16f

Analysis

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14/07/2023, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

hmpalert3 pre-patched.exe
Size

5.1MB
MD5

f464b6682a1a1fdf145a63b866ac203c
SHA1

622ab6cf9a0a7087796204151e327f93fd7955ba
SHA256

62d20fdc2a6c018b6a25cbb3882290d1ea6ea207517e0af717a46254e321f16f
SHA512

9d18540b545d4dcdb8bea83f88aa52d205338fd831ea37e90caca07087a768e83241952cf887ed372e53f8dcddce8c53f53e97d369fb5710656db4fb1a4605d7
SSDEEP

98304:BOpFgn78Y6ZdzlDr8gBhvioUxJtJKnjyLJ79AZBeqFYe:BOpNblDkoeYu1JMeO

Score

8^/10

discovery persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\hmpalert.sys	hmpalert3 pre-patched.exe

Loads dropped DLL 1 IoCs

pid	Process
2832	hmpalert3 pre-patched.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FAC02B7-77D6-418B-AC11-962C65CDE8DD}\InprocServer32	hmpalert3 pre-patched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FAC02B7-77D6-418B-AC11-962C65CDE8DD}\InprocServer32\ = "%SystemRoot%\\system32\\hmpshell.dll"	hmpalert3 pre-patched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FAC02B7-77D6-418B-AC11-962C65CDE8DD}\InprocServer32\ThreadingModel = "Apartment"	hmpalert3 pre-patched.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hmpalert.dll	hmpalert3 pre-patched.exe
File created	C:\Windows\system32\hmpalert.dll	hmpalert3 pre-patched.exe
File created	C:\Windows\system32\hmpshell.dll	hmpalert3 pre-patched.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe	hmpalert3 pre-patched.exe
File opened for modification	C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe	hmpalert3 pre-patched.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FAC02B7-77D6-418B-AC11-962C65CDE8DD}\ = "HitmanPro.Alert Icon Overlay Handler"	hmpalert3 pre-patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FAC02B7-77D6-418B-AC11-962C65CDE8DD}\InprocServer32	hmpalert3 pre-patched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FAC02B7-77D6-418B-AC11-962C65CDE8DD}\InprocServer32\ = "%SystemRoot%\\system32\\hmpshell.dll"	hmpalert3 pre-patched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FAC02B7-77D6-418B-AC11-962C65CDE8DD}\InprocServer32\ThreadingModel = "Apartment"	hmpalert3 pre-patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FAC02B7-77D6-418B-AC11-962C65CDE8DD}	hmpalert3 pre-patched.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

C:\Users\Admin\AppData\Local\Temp\hmpalert3 pre-patched.exe
"C:\Users\Admin\AppData\Local\Temp\hmpalert3 pre-patched.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\HitmanPro.Alert\hmpalert.exe

Filesize
5.1MB

MD5
f464b6682a1a1fdf145a63b866ac203c

SHA1
622ab6cf9a0a7087796204151e327f93fd7955ba

SHA256
62d20fdc2a6c018b6a25cbb3882290d1ea6ea207517e0af717a46254e321f16f

SHA512
9d18540b545d4dcdb8bea83f88aa52d205338fd831ea37e90caca07087a768e83241952cf887ed372e53f8dcddce8c53f53e97d369fb5710656db4fb1a4605d7

Download Submit