Analysis
-
max time kernel
124s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
03a1c0a48b775155a1f2372062f0b8b4.exe
Resource
win7-20231129-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
03a1c0a48b775155a1f2372062f0b8b4.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
03a1c0a48b775155a1f2372062f0b8b4.exe
-
Size
208KB
-
MD5
03a1c0a48b775155a1f2372062f0b8b4
-
SHA1
0ffbbe626b00979d83a60665f9d278e3841d63d2
-
SHA256
17b87fce32751a394e089fe10e93166a85f5f12f4f2db60be781f9c3e3ffb63d
-
SHA512
17e68fb89df460d00fe950f5581873c754a2319c0b68a0e358cc0c698685e4a7d39f98e316e888691369d991e24efbc794e462cc62907a4ca1e9fe9090ee1c40
-
SSDEEP
6144:hSEq4PqPtCIURHmEJpmnk8DkPkkMkd7xIWaBR3:hSEG1CnRHmEJpmnk8Dk8kxIWK
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 03a1c0a48b775155a1f2372062f0b8b4.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" fakax.exe -
Executes dropped EXE 1 IoCs
pid Process 2368 fakax.exe -
Loads dropped DLL 2 IoCs
pid Process 2416 03a1c0a48b775155a1f2372062f0b8b4.exe 2416 03a1c0a48b775155a1f2372062f0b8b4.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /x" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /p" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /s" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /o" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /r" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /f" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /y" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /l" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /a" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /k" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /k" 03a1c0a48b775155a1f2372062f0b8b4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /i" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /w" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /t" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /e" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /c" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /u" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /j" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /g" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /d" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /q" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /h" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /b" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /v" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /z" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /m" fakax.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\fakax = "C:\\Users\\Admin\\fakax.exe /n" fakax.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 03a1c0a48b775155a1f2372062f0b8b4.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 03a1c0a48b775155a1f2372062f0b8b4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum fakax.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 fakax.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 03a1c0a48b775155a1f2372062f0b8b4.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe 2368 fakax.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2416 03a1c0a48b775155a1f2372062f0b8b4.exe 2368 fakax.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2368 2416 03a1c0a48b775155a1f2372062f0b8b4.exe 28 PID 2416 wrote to memory of 2368 2416 03a1c0a48b775155a1f2372062f0b8b4.exe 28 PID 2416 wrote to memory of 2368 2416 03a1c0a48b775155a1f2372062f0b8b4.exe 28 PID 2416 wrote to memory of 2368 2416 03a1c0a48b775155a1f2372062f0b8b4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\03a1c0a48b775155a1f2372062f0b8b4.exe"C:\Users\Admin\AppData\Local\Temp\03a1c0a48b775155a1f2372062f0b8b4.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\fakax.exe"C:\Users\Admin\fakax.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD503a1c0a48b775155a1f2372062f0b8b4
SHA10ffbbe626b00979d83a60665f9d278e3841d63d2
SHA25617b87fce32751a394e089fe10e93166a85f5f12f4f2db60be781f9c3e3ffb63d
SHA51217e68fb89df460d00fe950f5581873c754a2319c0b68a0e358cc0c698685e4a7d39f98e316e888691369d991e24efbc794e462cc62907a4ca1e9fe9090ee1c40