abfcaae1e6f7b625f4688110bf96be20f1d09817dc3cfb489bbba117705c229b

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

751fc385dcf3ad8c41c8d00215440661.exe
Size

194KB
MD5

751fc385dcf3ad8c41c8d00215440661
SHA1

7c33b6b9e3b4bccc9bc22cbe01872352d449b103
SHA256

abfcaae1e6f7b625f4688110bf96be20f1d09817dc3cfb489bbba117705c229b
SHA512

830a9d492570997746ad5b099d9e6f463829d1ae44eb6864620d2012d5429854542d75a42e56b295cd9022de8972d2091ffdf86db0ba0cf4fcd36daca340da76
SSDEEP

6144:eEJudAILVANvA/o/u549UGSiSbs4IEYRz5:eE0+QVovAYu5hbs4IBRF

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2144	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1060	ytpiwuh.exe

Loads dropped DLL 2 IoCs

pid	Process
1700	751fc385dcf3ad8c41c8d00215440661.exe
1700	751fc385dcf3ad8c41c8d00215440661.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1700-0-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/files/0x000b000000014a45-5.dat	upx
behavioral1/memory/1060-13-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\{44DC88C8-9F79-5318-49DF-3CA026CD9040} = "C:\\Users\\Admin\\AppData\\Roaming\\Omewefx\\ytpiwuh.exe"	ytpiwuh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Privacy	751fc385dcf3ad8c41c8d00215440661.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	751fc385dcf3ad8c41c8d00215440661.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\370E14CE-00000001.eml:OECustomProperty	WinMail.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe
1060	ytpiwuh.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1700	751fc385dcf3ad8c41c8d00215440661.exe
Token: SeSecurityPrivilege	1700	751fc385dcf3ad8c41c8d00215440661.exe
Token: SeSecurityPrivilege	1700	751fc385dcf3ad8c41c8d00215440661.exe
Token: SeManageVolumePrivilege	2004	WinMail.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	WinMail.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2004	WinMail.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	WinMail.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 1060	1700	751fc385dcf3ad8c41c8d00215440661.exe	28
PID 1700 wrote to memory of 1060	1700	751fc385dcf3ad8c41c8d00215440661.exe	28
PID 1700 wrote to memory of 1060	1700	751fc385dcf3ad8c41c8d00215440661.exe	28
PID 1700 wrote to memory of 1060	1700	751fc385dcf3ad8c41c8d00215440661.exe	28
PID 1060 wrote to memory of 1144	1060	ytpiwuh.exe	17
PID 1060 wrote to memory of 1144	1060	ytpiwuh.exe	17
PID 1060 wrote to memory of 1144	1060	ytpiwuh.exe	17
PID 1060 wrote to memory of 1144	1060	ytpiwuh.exe	17
PID 1060 wrote to memory of 1144	1060	ytpiwuh.exe	17
PID 1060 wrote to memory of 1220	1060	ytpiwuh.exe	16
PID 1060 wrote to memory of 1220	1060	ytpiwuh.exe	16
PID 1060 wrote to memory of 1220	1060	ytpiwuh.exe	16
PID 1060 wrote to memory of 1220	1060	ytpiwuh.exe	16
PID 1060 wrote to memory of 1220	1060	ytpiwuh.exe	16
PID 1060 wrote to memory of 1256	1060	ytpiwuh.exe	15
PID 1060 wrote to memory of 1256	1060	ytpiwuh.exe	15
PID 1060 wrote to memory of 1256	1060	ytpiwuh.exe	15
PID 1060 wrote to memory of 1256	1060	ytpiwuh.exe	15
PID 1060 wrote to memory of 1256	1060	ytpiwuh.exe	15
PID 1060 wrote to memory of 1132	1060	ytpiwuh.exe	14
PID 1060 wrote to memory of 1132	1060	ytpiwuh.exe	14
PID 1060 wrote to memory of 1132	1060	ytpiwuh.exe	14
PID 1060 wrote to memory of 1132	1060	ytpiwuh.exe	14
PID 1060 wrote to memory of 1132	1060	ytpiwuh.exe	14
PID 1060 wrote to memory of 1700	1060	ytpiwuh.exe	27
PID 1060 wrote to memory of 1700	1060	ytpiwuh.exe	27
PID 1060 wrote to memory of 1700	1060	ytpiwuh.exe	27
PID 1060 wrote to memory of 1700	1060	ytpiwuh.exe	27
PID 1060 wrote to memory of 1700	1060	ytpiwuh.exe	27
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1700 wrote to memory of 2144	1700	751fc385dcf3ad8c41c8d00215440661.exe	30
PID 1060 wrote to memory of 1524	1060	ytpiwuh.exe	31
PID 1060 wrote to memory of 1524	1060	ytpiwuh.exe	31
PID 1060 wrote to memory of 1524	1060	ytpiwuh.exe	31
PID 1060 wrote to memory of 1524	1060	ytpiwuh.exe	31
PID 1060 wrote to memory of 1524	1060	ytpiwuh.exe	31
PID 1060 wrote to memory of 2700	1060	ytpiwuh.exe	33
PID 1060 wrote to memory of 2700	1060	ytpiwuh.exe	33
PID 1060 wrote to memory of 2700	1060	ytpiwuh.exe	33
PID 1060 wrote to memory of 2700	1060	ytpiwuh.exe	33
PID 1060 wrote to memory of 2700	1060	ytpiwuh.exe	33
PID 1060 wrote to memory of 2708	1060	ytpiwuh.exe	34
PID 1060 wrote to memory of 2708	1060	ytpiwuh.exe	34
PID 1060 wrote to memory of 2708	1060	ytpiwuh.exe	34
PID 1060 wrote to memory of 2708	1060	ytpiwuh.exe	34
PID 1060 wrote to memory of 2708	1060	ytpiwuh.exe	34

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1132

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Users\Admin\AppData\Local\Temp\751fc385dcf3ad8c41c8d00215440661.exe
  "C:\Users\Admin\AppData\Local\Temp\751fc385dcf3ad8c41c8d00215440661.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Users\Admin\AppData\Roaming\Omewefx\ytpiwuh.exe
    "C:\Users\Admin\AppData\Roaming\Omewefx\ytpiwuh.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpfe68d2f1.bat"
    3⤵
    - Deletes itself
    PID:2144

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1220

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1144

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2004

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1524

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2700

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

Filesize
2.0MB

MD5
21ed508ffac6c559b590e0fadaa7b446

SHA1
0adfd57e5219a969eef415c7a423257b86c4cb7e

SHA256
026def5ec46acb55ddfeca12e3c80e89bf58441791892abbc967e3a6616fb7cb

SHA512
720f831b7c1de506048aa9f8c4aef8c418f36ded0c6974820116dfa480ce8aaeeeb5059775d63d8b3833150fa96b11682efd2637771faf21639f7a7b7f13577d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpfe68d2f1.bat

Filesize
243B

MD5
e458233b9430c8eae7d7e296bc014361

SHA1
a5751d5114d15a6c0eff86678821d292a1479d47

SHA256
5cb9956293529bd37e28c7d4d56b3a79e3fc4663a5aa1a8ae56883feddedc1ac

SHA512
810616082e7a9773cddaccf081d9d348ae13844c298ee2b50b2d7a8d0025864c3dfa773ae776628c3a1c8d7ffb276139aa1a61b92c6b8755b253b01a315fa6c8

Download Submit
C:\Users\Admin\AppData\Roaming\Eks\piyhze.mac

Filesize
366B

MD5
f93cbab54a0b827ed948744bdc0dffde

SHA1
bcdd643aceee1c23ec34b66c7dbe4e9183f5971d

SHA256
69c340296247b38e1bcaf987190d60eb1a727a0f17c7abd3b13d6756018216f5

SHA512
f03446de6599e6994d91d67382cc0332f63b9fb2ce44cdc6fb22752efe02c690a6ad5dae945f6bf7c4a1dd14f033c2d093f3e0188c97990bba31e254abe9bf41

Download Submit
\Users\Admin\AppData\Roaming\Omewefx\ytpiwuh.exe

Filesize
194KB

MD5
1a22d08fb4e622f82bbe45f3c1b1eb2b

SHA1
c6190c0d7409650d4c28dcd411b5b5bbca278f13

SHA256
088466cc22a067bed625d012e88d0abfb4ab55da67f1c2928f4fd53018c56e88

SHA512
c25f10d69944ae9891c16360e8fc2fea1fb5f85076b370f178796537f01fb39c91a8012f5f75d10f98448c628c619aab49baba9a2527a439430a9f7761183e6e

Download Submit
memory/1060-325-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1060-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1132-43-0x0000000001B50000-0x0000000001B77000-memory.dmp

Filesize
156KB

Download
memory/1132-45-0x0000000001B50000-0x0000000001B77000-memory.dmp

Filesize
156KB

Download
memory/1132-44-0x0000000001B50000-0x0000000001B77000-memory.dmp

Filesize
156KB

Download
memory/1132-42-0x0000000001B50000-0x0000000001B77000-memory.dmp

Filesize
156KB

Download
memory/1144-18-0x0000000001E50000-0x0000000001E77000-memory.dmp

Filesize
156KB

Download
memory/1144-22-0x0000000001E50000-0x0000000001E77000-memory.dmp

Filesize
156KB

Download
memory/1144-24-0x0000000001E50000-0x0000000001E77000-memory.dmp

Filesize
156KB

Download
memory/1144-20-0x0000000001E50000-0x0000000001E77000-memory.dmp

Filesize
156KB

Download
memory/1144-16-0x0000000001E50000-0x0000000001E77000-memory.dmp

Filesize
156KB

Download
memory/1220-34-0x00000000001A0000-0x00000000001C7000-memory.dmp

Filesize
156KB

Download
memory/1220-28-0x00000000001A0000-0x00000000001C7000-memory.dmp

Filesize
156KB

Download
memory/1220-30-0x00000000001A0000-0x00000000001C7000-memory.dmp

Filesize
156KB

Download
memory/1220-32-0x00000000001A0000-0x00000000001C7000-memory.dmp

Filesize
156KB

Download
memory/1256-38-0x0000000002990000-0x00000000029B7000-memory.dmp

Filesize
156KB

Download
memory/1256-40-0x0000000002990000-0x00000000029B7000-memory.dmp

Filesize
156KB

Download
memory/1256-39-0x0000000002990000-0x00000000029B7000-memory.dmp

Filesize
156KB

Download
memory/1256-37-0x0000000002990000-0x00000000029B7000-memory.dmp

Filesize
156KB

Download
memory/1700-72-0x0000000077760000-0x0000000077761000-memory.dmp

Filesize
4KB

Download
memory/1700-2-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1700-53-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/1700-55-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/1700-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1700-56-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-58-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-60-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-62-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-64-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-66-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-68-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-51-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/1700-70-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-47-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/1700-75-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-77-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-143-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1700-49-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/1700-11-0x0000000002240000-0x0000000002283000-memory.dmp

Filesize
268KB

Download
memory/1700-230-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1700-1-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/1700-73-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2144-248-0x0000000077760000-0x0000000077761000-memory.dmp

Filesize
4KB

Download
memory/2144-326-0x0000000000050000-0x0000000000077000-memory.dmp

Filesize
156KB

Download
memory/2144-327-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download
memory/2144-232-0x0000000000050000-0x0000000000077000-memory.dmp

Filesize
156KB

Download
memory/2144-351-0x00000000000F0000-0x00000000000F1000-memory.dmp

Filesize
4KB

Download