f26aee4f11e5484158c0cbd2a23f7b363a45295260bbdac9c09aaa7d80e227b3

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 10:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

534f684e3b261d5504864800eb60d5c6.exe
Size

22KB
MD5

534f684e3b261d5504864800eb60d5c6
SHA1

ab391e06f1df53c32d81597f356724e2bf0de3ec
SHA256

f26aee4f11e5484158c0cbd2a23f7b363a45295260bbdac9c09aaa7d80e227b3
SHA512

cbbec42ab2aef158b3d497feeed3eaa77d65851bc84c76ab3da75b00be7752b24caa7cec809e0d3f1ae294eeca74e4711ca0e1a4041ab9b48b1d54d461be67fc
SSDEEP

384:IlL9Z567RQUwQmpwzsGWKHQE2izONZ9l4OqWX13hyA8+VkDFPvOidG8FdhKvybW0:ebM7BwQCGWBniSNZobWlRymg1X/hKa7

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2180	Kernelmh.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	Kernelmh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kernelmh = "C:\\Windows\\Kernelmh.exe"	Kernelmh.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Kernelmh.exe	534f684e3b261d5504864800eb60d5c6.exe
File opened for modification	C:\Windows\Kernelmh.exe	534f684e3b261d5504864800eb60d5c6.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	2176	534f684e3b261d5504864800eb60d5c6.exe
Token: SeSystemtimePrivilege	2180	Kernelmh.exe
Token: SeSystemtimePrivilege	2180	Kernelmh.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	Kernelmh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2180	2176	534f684e3b261d5504864800eb60d5c6.exe	28
PID 2176 wrote to memory of 2180	2176	534f684e3b261d5504864800eb60d5c6.exe	28
PID 2176 wrote to memory of 2180	2176	534f684e3b261d5504864800eb60d5c6.exe	28
PID 2176 wrote to memory of 2180	2176	534f684e3b261d5504864800eb60d5c6.exe	28

C:\Users\Admin\AppData\Local\Temp\534f684e3b261d5504864800eb60d5c6.exe
"C:\Users\Admin\AppData\Local\Temp\534f684e3b261d5504864800eb60d5c6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\Kernelmh.exe
  C:\Windows\Kernelmh.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Kernelmh.exe

Filesize
22KB

MD5
534f684e3b261d5504864800eb60d5c6

SHA1
ab391e06f1df53c32d81597f356724e2bf0de3ec

SHA256
f26aee4f11e5484158c0cbd2a23f7b363a45295260bbdac9c09aaa7d80e227b3

SHA512
cbbec42ab2aef158b3d497feeed3eaa77d65851bc84c76ab3da75b00be7752b24caa7cec809e0d3f1ae294eeca74e4711ca0e1a4041ab9b48b1d54d461be67fc

Download Submit
\Users\Admin\AppData\Local\Temp\~Tm9D77.tmp.rom

Filesize
15KB

MD5
d63e593c22e47bd56de6c5f61e3e2814

SHA1
e931f273b19564651537d87a943076296f598a4b

SHA256
43312aba944bb4f978590d6c2132f58ac8e63510d05131a9d89ef57b3e2f7c4f

SHA512
f3f5474f93d90aeb3035e4da71b423964956f988bf41254a55cc5fa978577235d6e03c292b0c22acf86a2cab0692238bd43f2d512337fd3a96134a168cdb92cd

Download Submit
memory/2176-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2176-6-0x0000000000360000-0x000000000037B000-memory.dmp

Filesize
108KB

Download
memory/2176-9-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2180-8-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2180-14-0x00000000001F0000-0x0000000000208000-memory.dmp

Filesize
96KB

Download
memory/2180-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2180-16-0x00000000001F0000-0x0000000000208000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads