bf8fce159b7c185cf633472c516855ac2bc1157e703c759442e345d8c56620d8

Analysis

max time kernel
28s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2023, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

exe.win-amd64-3.11/Hakuna_setup.exe
Size

16KB
MD5

936ce978fff0afa81a54a17dc25febf1
SHA1

c0683a8c1bba6dbd9663dc253c3bd07457fe8c46
SHA256

b877350a9ecec78915e644ae800dd65a805f58e0cdb21ce33e822258000584b9
SHA512

0a88e5c871da79b2f665d45d9bba8276a99773fb39316c401992928e81e79cb6cf6a8079b0313acbc3684f52f5cb337648e243183588bf599b45b6e5c2cfed2a
SSDEEP

192:FUfcKr+kAUtQYkNwEBWevhvzCoLHt8WQKgr81eThEqcNG6cO5tfwp:FookAhYkNqMhWkKRT+d3c/

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	api.ipify.org
31	api.ipify.org

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1964	Hakuna_setup.exe
1964	Hakuna_setup.exe
1964	Hakuna_setup.exe
1964	Hakuna_setup.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	Hakuna_setup.exe
Token: SeIncreaseQuotaPrivilege	5016	WMIC.exe
Token: SeSecurityPrivilege	5016	WMIC.exe
Token: SeTakeOwnershipPrivilege	5016	WMIC.exe
Token: SeLoadDriverPrivilege	5016	WMIC.exe
Token: SeSystemProfilePrivilege	5016	WMIC.exe
Token: SeSystemtimePrivilege	5016	WMIC.exe
Token: SeProfSingleProcessPrivilege	5016	WMIC.exe
Token: SeIncBasePriorityPrivilege	5016	WMIC.exe
Token: SeCreatePagefilePrivilege	5016	WMIC.exe
Token: SeBackupPrivilege	5016	WMIC.exe
Token: SeRestorePrivilege	5016	WMIC.exe
Token: SeShutdownPrivilege	5016	WMIC.exe
Token: SeDebugPrivilege	5016	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5016	WMIC.exe
Token: SeRemoteShutdownPrivilege	5016	WMIC.exe
Token: SeUndockPrivilege	5016	WMIC.exe
Token: SeManageVolumePrivilege	5016	WMIC.exe
Token: 33	5016	WMIC.exe
Token: 34	5016	WMIC.exe
Token: 35	5016	WMIC.exe
Token: 36	5016	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5016	WMIC.exe
Token: SeSecurityPrivilege	5016	WMIC.exe
Token: SeTakeOwnershipPrivilege	5016	WMIC.exe
Token: SeLoadDriverPrivilege	5016	WMIC.exe
Token: SeSystemProfilePrivilege	5016	WMIC.exe
Token: SeSystemtimePrivilege	5016	WMIC.exe
Token: SeProfSingleProcessPrivilege	5016	WMIC.exe
Token: SeIncBasePriorityPrivilege	5016	WMIC.exe
Token: SeCreatePagefilePrivilege	5016	WMIC.exe
Token: SeBackupPrivilege	5016	WMIC.exe
Token: SeRestorePrivilege	5016	WMIC.exe
Token: SeShutdownPrivilege	5016	WMIC.exe
Token: SeDebugPrivilege	5016	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5016	WMIC.exe
Token: SeRemoteShutdownPrivilege	5016	WMIC.exe
Token: SeUndockPrivilege	5016	WMIC.exe
Token: SeManageVolumePrivilege	5016	WMIC.exe
Token: 33	5016	WMIC.exe
Token: 34	5016	WMIC.exe
Token: 35	5016	WMIC.exe
Token: 36	5016	WMIC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1632	1964	Hakuna_setup.exe	91
PID 1964 wrote to memory of 1632	1964	Hakuna_setup.exe	91
PID 1632 wrote to memory of 5016	1632	cmd.exe	93
PID 1632 wrote to memory of 5016	1632	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\exe.win-amd64-3.11\Hakuna_setup.exe
"C:\Users\Admin\AppData\Local\Temp\exe.win-amd64-3.11\Hakuna_setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\System32\wbem\WMIC.exe
    C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5016

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads