Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
21-01-2024 11:56
Static task
static1
Behavioral task
behavioral1
Sample
6d3fe2ce99e8e3026722408de85de279.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6d3fe2ce99e8e3026722408de85de279.exe
Resource
win10v2004-20231222-en
General
-
Target
6d3fe2ce99e8e3026722408de85de279.exe
-
Size
1.2MB
-
MD5
6d3fe2ce99e8e3026722408de85de279
-
SHA1
f1a45deab537675c7d640a89eb62993fb751464f
-
SHA256
68e69915f8982a6434cdde031aa9ec143f1fd2c59e6143e83351d58df5af1ba0
-
SHA512
654c4cc894347bf627e64bc261484df30f513478030ce0d6e63d74fe6cfe58b88b91a123d3459ededeab542140baabcfb3e6346a5b0b7a3cf9be10e712aeb9e2
-
SSDEEP
24576:bnhOVrZDxZV2xvqCeGUZmxZ9IVxJAWDyEoLfKLAkFao6ijVTBow:DhoVaCvGUZmtwxJAqGXkF4WVT7
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\UQIFYW\HVY.exe family_ardamax -
Executes dropped EXE 1 IoCs
Processes:
HVY.exepid process 2524 HVY.exe -
Loads dropped DLL 2 IoCs
Processes:
6d3fe2ce99e8e3026722408de85de279.exeHVY.exepid process 2676 6d3fe2ce99e8e3026722408de85de279.exe 2524 HVY.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HVY.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HVY Start = "C:\\Windows\\SysWOW64\\UQIFYW\\HVY.exe" HVY.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
HVY.exe6d3fe2ce99e8e3026722408de85de279.exedescription ioc process File opened for modification C:\Windows\SysWOW64\UQIFYW\ HVY.exe File created C:\Windows\SysWOW64\UQIFYW\HVY.004 6d3fe2ce99e8e3026722408de85de279.exe File created C:\Windows\SysWOW64\UQIFYW\HVY.001 6d3fe2ce99e8e3026722408de85de279.exe File created C:\Windows\SysWOW64\UQIFYW\HVY.002 6d3fe2ce99e8e3026722408de85de279.exe File created C:\Windows\SysWOW64\UQIFYW\AKV.exe 6d3fe2ce99e8e3026722408de85de279.exe File created C:\Windows\SysWOW64\UQIFYW\HVY.exe 6d3fe2ce99e8e3026722408de85de279.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6d3fe2ce99e8e3026722408de85de279.exedescription pid process target process PID 1732 set thread context of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
HVY.exedescription pid process Token: 33 2524 HVY.exe Token: SeIncBasePriorityPrivilege 2524 HVY.exe Token: SeIncBasePriorityPrivilege 2524 HVY.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
6d3fe2ce99e8e3026722408de85de279.exeHVY.exepid process 1732 6d3fe2ce99e8e3026722408de85de279.exe 2524 HVY.exe 2524 HVY.exe 2524 HVY.exe 2524 HVY.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
6d3fe2ce99e8e3026722408de85de279.exe6d3fe2ce99e8e3026722408de85de279.exeHVY.exedescription pid process target process PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 1732 wrote to memory of 2676 1732 6d3fe2ce99e8e3026722408de85de279.exe 6d3fe2ce99e8e3026722408de85de279.exe PID 2676 wrote to memory of 2524 2676 6d3fe2ce99e8e3026722408de85de279.exe HVY.exe PID 2676 wrote to memory of 2524 2676 6d3fe2ce99e8e3026722408de85de279.exe HVY.exe PID 2676 wrote to memory of 2524 2676 6d3fe2ce99e8e3026722408de85de279.exe HVY.exe PID 2676 wrote to memory of 2524 2676 6d3fe2ce99e8e3026722408de85de279.exe HVY.exe PID 2524 wrote to memory of 1200 2524 HVY.exe cmd.exe PID 2524 wrote to memory of 1200 2524 HVY.exe cmd.exe PID 2524 wrote to memory of 1200 2524 HVY.exe cmd.exe PID 2524 wrote to memory of 1200 2524 HVY.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d3fe2ce99e8e3026722408de85de279.exe"C:\Users\Admin\AppData\Local\Temp\6d3fe2ce99e8e3026722408de85de279.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\6d3fe2ce99e8e3026722408de85de279.exeC:\Users\Admin\AppData\Local\Temp\6d3fe2ce99e8e3026722408de85de279.exe2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\UQIFYW\HVY.exe"C:\Windows\system32\UQIFYW\HVY.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\UQIFYW\HVY.exe > nul4⤵PID:1200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
456KB
MD551507d91d43683b9c4b8fafeb4d888f8
SHA1ead2f68338da7af4720378cd46133589fc9405ba
SHA25671b3aecefd36e4855a369019ac5871c544d39f8889d23cd455466a24cdecce6b
SHA512a5a7ff3f8ffb72719b7e2c9dc2719c99ea32bd68994918ea027c0d7d54cfe0c80bfd34486dd8d3cdd390376bc4c8d1f7d97de4b98b7d39a3e10c3e2682c07d1c
-
Filesize
43KB
MD593df156c4bd9d7341f4c4a4847616a69
SHA1c7663b32c3c8e247bc16b51aff87b45484652dc1
SHA256e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e
SHA512ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35
-
Filesize
1KB
MD5fbb16ac078d82071059ed73ebf83316f
SHA1c4c6506f888c069ee2b8300d2c8df69eeb76ec98
SHA256d6cdcc50e7f948afa7f542ef320520fbc6f505c2139683e2b70018909af9ac26
SHA512634027b9a6741dca601d39a72d241ffa8a2c57c3649beab707b208b1bb64b19f8c181e4c04d32f723cb52cd9723158b22e6baf993dcf7f866d100794d414ab78
-
Filesize
61KB
MD5383d5f5d4240d590e7dec3f7312a4ac7
SHA1f6bcade8d37afb80cf52a89b3e84683f4643fbce
SHA2567e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422
SHA512e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a
-
Filesize
1.7MB
MD53cd29c0df98a7aeb69a9692843ca3edb
SHA17c86aea093f1979d18901bd1b89a2b02a60ac3e2
SHA2565a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32
SHA512e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9