Overview
overview
10Static
static
10Endermanch...is.exe
windows7-x64
1Endermanch...is.exe
windows10-2004-x64
Endermanch...ug.exe
windows7-x64
6Endermanch...ug.exe
windows10-2004-x64
6Endermanch...ck.exe
windows7-x64
7Endermanch...ck.exe
windows10-2004-x64
7Endermanch...om.exe
windows7-x64
1Endermanch...om.exe
windows10-2004-x64
1Endermanch...le.exe
windows7-x64
1Endermanch...le.exe
windows10-2004-x64
1Endermanch...er.exe
windows7-x64
7Endermanch...er.exe
windows10-2004-x64
7Endermanch...er.exe
windows7-x64
7Endermanch...er.exe
windows10-2004-x64
7Endermanch...er.exe
windows7-x64
Endermanch...er.exe
windows10-2004-x64
Endermanch...us.exe
windows7-x64
1Endermanch...us.exe
windows10-2004-x64
1Endermanch....C.exe
windows7-x64
10Endermanch....C.exe
windows10-2004-x64
10Endermanch...rd.exe
windows7-x64
10Endermanch...rd.exe
windows10-2004-x64
9Endermanch...a2.exe
windows7-x64
1Endermanch...a2.exe
windows10-2004-x64
1Endermanch...19.exe
windows7-x64
7Endermanch...19.exe
windows10-2004-x64
7Endermanch...eg.exe
windows7-x64
7Endermanch...eg.exe
windows10-2004-x64
3Endermanch...1).exe
windows7-x64
3Endermanch...1).exe
windows10-2004-x64
3Endermanch...ld.exe
windows7-x64
3Endermanch...ld.exe
windows10-2004-x64
3Resubmissions
10-05-2024 16:25
240510-tw1h5shh47 1024-08-2023 11:16
230824-nda8msdf8z 1005-08-2023 22:52
230805-2tn2bsfa82 1024-07-2023 06:25
230724-g6s6laag35 1022-07-2023 15:57
230722-tee6wabg5w 1020-07-2023 23:19
230720-3bb5gsbf5v 1020-07-2023 23:06
230720-23f23sba63 1003-02-2021 11:43
210203-6bgge2nfan 1022-11-2020 06:42
201122-6x1at779dj 10Analysis
-
max time kernel
158s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
24-07-2023 06:25
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@CleanThis.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Endermanch@CleanThis.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
Endermanch@ColorBug.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
Endermanch@ColorBug.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
Endermanch@DeriaLock.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
Endermanch@DeriaLock.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
Endermanch@Deskbottom.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
Endermanch@Deskbottom.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
Endermanch@DesktopPuzzle.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
Endermanch@DesktopPuzzle.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
Endermanch@FakeAdwCleaner.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
Endermanch@FreeYoutubeDownloader.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
Endermanch@HMBlocker.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
Endermanch@HMBlocker.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
Endermanch@HappyAntivirus.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
Endermanch@HappyAntivirus.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
Endermanch@Illerka.C.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
Endermanch@Illerka.C.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
Endermanch@InternetSecurityGuard.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
Endermanch@Koteyka2.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
Endermanch@Koteyka2.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
Endermanch@LPS2019.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
Endermanch@LPS2019.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
Endermanch@Movie.mpeg.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
Endermanch@Movie.mpeg.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
Endermanch@NavaShield(1).exe
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
Endermanch@NavaShield(1).exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
Endermanch@NavaShield.exe
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
Endermanch@NavaShield.exe
Resource
win10v2004-20230703-en
General
-
Target
Endermanch@Movie.mpeg.exe
-
Size
414KB
-
MD5
d0deb2644c9435ea701e88537787ea6e
-
SHA1
866e47ecd80da89c4f56557659027a3aee897132
-
SHA256
ad6cd46f373aadad85fab5ecdb4cb4ad7ebd0cbe44c84db5d2a2ee1b54eb5ec3
-
SHA512
6faac2e1003290bb3a0613ee84d5c76d3c48a4524e97975e9174d6fcfb5a6a48d6648b06ed5a4c10c3349f70efffc6a08a185fdeb0824250ae044b96ef39fcdf
-
SSDEEP
6144:BCoFAtv2DDWANPG4F0vwDsl6JEFiGUHzAB4lTa7tKzWNYRbvhLWxsqgyn:koOv2D60PLyvaJTT9Za7kziYD69g
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2908 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
hhxfjqvwg.exepid process 2992 hhxfjqvwg.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exehhxfjqvwg.exepid process 2908 cmd.exe 2908 cmd.exe 2992 hhxfjqvwg.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Endermanch@Movie.mpeg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce Endermanch@Movie.mpeg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2904 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
hhxfjqvwg.exepid process 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2904 taskkill.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
hhxfjqvwg.exepid process 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
hhxfjqvwg.exepid process 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe 2992 hhxfjqvwg.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Endermanch@Movie.mpeg.execmd.exedescription pid process target process PID 2464 wrote to memory of 2908 2464 Endermanch@Movie.mpeg.exe cmd.exe PID 2464 wrote to memory of 2908 2464 Endermanch@Movie.mpeg.exe cmd.exe PID 2464 wrote to memory of 2908 2464 Endermanch@Movie.mpeg.exe cmd.exe PID 2464 wrote to memory of 2908 2464 Endermanch@Movie.mpeg.exe cmd.exe PID 2908 wrote to memory of 2904 2908 cmd.exe taskkill.exe PID 2908 wrote to memory of 2904 2908 cmd.exe taskkill.exe PID 2908 wrote to memory of 2904 2908 cmd.exe taskkill.exe PID 2908 wrote to memory of 2904 2908 cmd.exe taskkill.exe PID 2908 wrote to memory of 3008 2908 cmd.exe PING.EXE PID 2908 wrote to memory of 3008 2908 cmd.exe PING.EXE PID 2908 wrote to memory of 3008 2908 cmd.exe PING.EXE PID 2908 wrote to memory of 3008 2908 cmd.exe PING.EXE PID 2908 wrote to memory of 2992 2908 cmd.exe hhxfjqvwg.exe PID 2908 wrote to memory of 2992 2908 cmd.exe hhxfjqvwg.exe PID 2908 wrote to memory of 2992 2908 cmd.exe hhxfjqvwg.exe PID 2908 wrote to memory of 2992 2908 cmd.exe hhxfjqvwg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@Movie.mpeg.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@Movie.mpeg.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid 2464 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Endermanch@Movie.mpeg.exe" & start C:\Users\Admin\AppData\Local\HHXFJQ~1.EXE -f2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 24643⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\hhxfjqvwg.exeC:\Users\Admin\AppData\Local\HHXFJQ~1.EXE -f3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\hhxfjqvwg.exeFilesize
414KB
MD5d0deb2644c9435ea701e88537787ea6e
SHA1866e47ecd80da89c4f56557659027a3aee897132
SHA256ad6cd46f373aadad85fab5ecdb4cb4ad7ebd0cbe44c84db5d2a2ee1b54eb5ec3
SHA5126faac2e1003290bb3a0613ee84d5c76d3c48a4524e97975e9174d6fcfb5a6a48d6648b06ed5a4c10c3349f70efffc6a08a185fdeb0824250ae044b96ef39fcdf
-
C:\Users\Admin\AppData\Local\hhxfjqvwg.exeFilesize
414KB
MD5d0deb2644c9435ea701e88537787ea6e
SHA1866e47ecd80da89c4f56557659027a3aee897132
SHA256ad6cd46f373aadad85fab5ecdb4cb4ad7ebd0cbe44c84db5d2a2ee1b54eb5ec3
SHA5126faac2e1003290bb3a0613ee84d5c76d3c48a4524e97975e9174d6fcfb5a6a48d6648b06ed5a4c10c3349f70efffc6a08a185fdeb0824250ae044b96ef39fcdf
-
\Users\Admin\AppData\Local\hhxfjqvwg.exeFilesize
414KB
MD5d0deb2644c9435ea701e88537787ea6e
SHA1866e47ecd80da89c4f56557659027a3aee897132
SHA256ad6cd46f373aadad85fab5ecdb4cb4ad7ebd0cbe44c84db5d2a2ee1b54eb5ec3
SHA5126faac2e1003290bb3a0613ee84d5c76d3c48a4524e97975e9174d6fcfb5a6a48d6648b06ed5a4c10c3349f70efffc6a08a185fdeb0824250ae044b96ef39fcdf
-
\Users\Admin\AppData\Local\hhxfjqvwg.exeFilesize
414KB
MD5d0deb2644c9435ea701e88537787ea6e
SHA1866e47ecd80da89c4f56557659027a3aee897132
SHA256ad6cd46f373aadad85fab5ecdb4cb4ad7ebd0cbe44c84db5d2a2ee1b54eb5ec3
SHA5126faac2e1003290bb3a0613ee84d5c76d3c48a4524e97975e9174d6fcfb5a6a48d6648b06ed5a4c10c3349f70efffc6a08a185fdeb0824250ae044b96ef39fcdf
-
\Users\Admin\AppData\Local\hhxfjqvwg.exeFilesize
414KB
MD5d0deb2644c9435ea701e88537787ea6e
SHA1866e47ecd80da89c4f56557659027a3aee897132
SHA256ad6cd46f373aadad85fab5ecdb4cb4ad7ebd0cbe44c84db5d2a2ee1b54eb5ec3
SHA5126faac2e1003290bb3a0613ee84d5c76d3c48a4524e97975e9174d6fcfb5a6a48d6648b06ed5a4c10c3349f70efffc6a08a185fdeb0824250ae044b96ef39fcdf
-
memory/2464-54-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2464-56-0x00000000002D0000-0x00000000002D2000-memory.dmpFilesize
8KB
-
memory/2464-55-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2464-58-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-66-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-64-0x00000000002C0000-0x00000000002C2000-memory.dmpFilesize
8KB
-
memory/2992-63-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-67-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-68-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-69-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-70-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-71-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-72-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-73-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB
-
memory/2992-74-0x0000000001000000-0x00000000010CE000-memory.dmpFilesize
824KB