cb843b0a4337e466fd959275b92550f8eda1d0378f9f79f56ed1bf7ee5d785b5

Analysis

max time kernel
138s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 22:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0585e54a304b58a7a2ced021d8176fb6.exe
Size

22KB
MD5

0585e54a304b58a7a2ced021d8176fb6
SHA1

6b1d4685fe3eb8e496febb99f80d8a1715937449
SHA256

cb843b0a4337e466fd959275b92550f8eda1d0378f9f79f56ed1bf7ee5d785b5
SHA512

92b4a6600c3152650d99c6e509d5d37b416d983ea4adedacb570266024c727984ba4f9a08b450882bb7bf5234efa1c3545a74a70ce49c4ca678c2f02e1f3bc2b
SSDEEP

384:SLfSFSAyc+IYElnoj0LbKuS+s6KIKzXSDfX3UAeJWFdUE2gCykSfWJOII4xx4ism:SWFlychlNHKrj6KIKzXyPEArUZyXucIB

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1740	0585e54a304b58a7a2ced021d8176fb6.exe
1740	0585e54a304b58a7a2ced021d8176fb6.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mtewdh.dll.LoG	0585e54a304b58a7a2ced021d8176fb6.exe
File created	C:\Windows\SysWOW64\mtewdh.dll	0585e54a304b58a7a2ced021d8176fb6.exe
File created	C:\Windows\SysWOW64\tf0	0585e54a304b58a7a2ced021d8176fb6.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER	0585e54a304b58a7a2ced021d8176fb6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}\InProcServer32	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	0585e54a304b58a7a2ced021d8176fb6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}\ = "MICROSOFT"	0585e54a304b58a7a2ced021d8176fb6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}\InProcServer32\ = "C:\\Windows\\SysWow64\\mtewdh.dll"	0585e54a304b58a7a2ced021d8176fb6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{189F087F-4378-405F-85FA-37D955AD7A8C}\InProcServer32\ThreadingModel = "Apartment"	0585e54a304b58a7a2ced021d8176fb6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS	0585e54a304b58a7a2ced021d8176fb6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1740	0585e54a304b58a7a2ced021d8176fb6.exe
1740	0585e54a304b58a7a2ced021d8176fb6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1740	0585e54a304b58a7a2ced021d8176fb6.exe
Token: SeRestorePrivilege	1740	0585e54a304b58a7a2ced021d8176fb6.exe
Token: SeBackupPrivilege	1740	0585e54a304b58a7a2ced021d8176fb6.exe
Token: SeRestorePrivilege	1740	0585e54a304b58a7a2ced021d8176fb6.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1740	0585e54a304b58a7a2ced021d8176fb6.exe
1740	0585e54a304b58a7a2ced021d8176fb6.exe
1740	0585e54a304b58a7a2ced021d8176fb6.exe

C:\Users\Admin\AppData\Local\Temp\0585e54a304b58a7a2ced021d8176fb6.exe
"C:\Users\Admin\AppData\Local\Temp\0585e54a304b58a7a2ced021d8176fb6.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mtewdh.dll

Filesize
273KB

MD5
9af4560ec67f5811a276eeda1b97be43

SHA1
dc406aff2cd3a7aea049154e4e03caeb92f47350

SHA256
785cc1bd51e86983dc8bd1a2e6947d8984ddf86abf95944361265e2aa61dd42a

SHA512
6144beeb34a85deb1836b6148253b86b032fe75b82b028aeb27d50251c6bf2abf345b81cba2c1997ff572e72f34fdab6b0170e58cf1242acdaa2e966f28df34d

Download Submit
memory/1740-4-0x00000000025C0000-0x00000000025D1000-memory.dmp

Filesize
68KB

Download
memory/1740-8-0x00000000025C0000-0x00000000025D1000-memory.dmp

Filesize
68KB

Download