cb843b0a4337e466fd959275b92550f8eda1d0378f9f79f56ed1bf7ee5d785b5

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0585e54a304b58a7a2ced021d8176fb6.exe
Size

22KB
MD5

0585e54a304b58a7a2ced021d8176fb6
SHA1

6b1d4685fe3eb8e496febb99f80d8a1715937449
SHA256

cb843b0a4337e466fd959275b92550f8eda1d0378f9f79f56ed1bf7ee5d785b5
SHA512

92b4a6600c3152650d99c6e509d5d37b416d983ea4adedacb570266024c727984ba4f9a08b450882bb7bf5234efa1c3545a74a70ce49c4ca678c2f02e1f3bc2b
SSDEEP

384:SLfSFSAyc+IYElnoj0LbKuS+s6KIKzXSDfX3UAeJWFdUE2gCykSfWJOII4xx4ism:SWFlychlNHKrj6KIKzXyPEArUZyXucIB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2372	0585e54a304b58a7a2ced021d8176fb6.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mtewdh.dll	0585e54a304b58a7a2ced021d8176fb6.exe
File created	C:\Windows\SysWOW64\tf0	0585e54a304b58a7a2ced021d8176fb6.exe
File opened for modification	C:\Windows\SysWOW64\mtewdh.dll.LoG	0585e54a304b58a7a2ced021d8176fb6.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}\InProcServer32\ThreadingModel = "Apartment"	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	0585e54a304b58a7a2ced021d8176fb6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\	0585e54a304b58a7a2ced021d8176fb6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}\ = "MICROSOFT"	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}\InProcServer32	0585e54a304b58a7a2ced021d8176fb6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}\InProcServer32\ = "C:\\Windows\\SysWow64\\mtewdh.dll"	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT	0585e54a304b58a7a2ced021d8176fb6.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2372	0585e54a304b58a7a2ced021d8176fb6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2372	0585e54a304b58a7a2ced021d8176fb6.exe
Token: SeRestorePrivilege	2372	0585e54a304b58a7a2ced021d8176fb6.exe
Token: SeBackupPrivilege	2372	0585e54a304b58a7a2ced021d8176fb6.exe
Token: SeRestorePrivilege	2372	0585e54a304b58a7a2ced021d8176fb6.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2372	0585e54a304b58a7a2ced021d8176fb6.exe
2372	0585e54a304b58a7a2ced021d8176fb6.exe
2372	0585e54a304b58a7a2ced021d8176fb6.exe

C:\Users\Admin\AppData\Local\Temp\0585e54a304b58a7a2ced021d8176fb6.exe
"C:\Users\Admin\AppData\Local\Temp\0585e54a304b58a7a2ced021d8176fb6.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\mtewdh.dll

Filesize
4KB

MD5
6172aefb879361340de28518a6c50b2e

SHA1
e5edb29466011d9ba51bfc7335eb69577322c991

SHA256
10c407ec000920fab7e8651880656eaae66a9f8f1927f5be2cf63664b2e99b12

SHA512
e9e79a9843e462fd1fb6dc6a5c7e366a2f8162dc4a39fcc5fcaffd12af2898b4b5a67fbd68cf449029832d980e3ae8563845e41ed071626ace39c13b707f1db1

Download Submit
memory/2372-2-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/2372-5-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download