Analysis
-
max time kernel
161s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
8ab8bf8a5cf4147b3fab5b214db8454e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8ab8bf8a5cf4147b3fab5b214db8454e.exe
Resource
win10v2004-20231215-en
General
-
Target
8ab8bf8a5cf4147b3fab5b214db8454e.exe
-
Size
8.2MB
-
MD5
8ab8bf8a5cf4147b3fab5b214db8454e
-
SHA1
5f522220566a4363df48dc78c55f324e2fcabdf9
-
SHA256
68f90121aaa88d93dfd4cb25fb182d0445bbd9a5a8563b4fe14b3eb341188df6
-
SHA512
8c15182f61e053009eefa7a83dc9efa678ee1712885da8505ab4220a7e3aacd24a3eb51ce584ea453a71ee788521bb4010909f5c800c54962b154c59ebd77e4f
-
SSDEEP
196608:N7effIPEsy58doQaTzwZ8Jq3ELhf8cHpLG8doQpu8rVtxQuULG8doQal1Bf80bMI:N7effIPEsy58doQaTzwZ8Jq3ELhf8cHb
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 8ab8bf8a5cf4147b3fab5b214db8454e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe," 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\spools.exe 8ab8bf8a5cf4147b3fab5b214db8454e.exe File created C:\Windows\SysWOW64\drivers\spools.exe 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
ACProtect 1.3x - 1.4x DLL software 4 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000600000002315c-10.dat acprotect behavioral2/memory/2116-13-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/2116-14-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/2116-15-0x0000000010000000-0x000000001010B000-memory.dmp acprotect -
Loads dropped DLL 1 IoCs
pid Process 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
resource yara_rule behavioral2/files/0x000600000002315c-10.dat upx behavioral2/memory/2116-13-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/2116-14-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/2116-15-0x0000000010000000-0x000000001010B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 8ab8bf8a5cf4147b3fab5b214db8454e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 8ab8bf8a5cf4147b3fab5b214db8454e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 8ab8bf8a5cf4147b3fab5b214db8454e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\V: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\M: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\H: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\I: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\E: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\Q: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\L: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\O: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\I: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\I: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\P: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\T: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\X: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\Q: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\R: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\U: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\X: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\M: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\O: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\T: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\P: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\V: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\N: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\R: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\V: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\S: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\W: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\K: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\E: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\K: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\H: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\E: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\H: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\N: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\T: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\J: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\E: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\Q: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\M: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\J: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\X: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\K: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\P: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\U: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\S: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\U: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\I: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\M: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\P: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\V: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\X: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\K: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\G: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\T: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\N: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\W: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\L: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\G: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\L: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\W: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\H: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\G: 8ab8bf8a5cf4147b3fab5b214db8454e.exe File opened (read-only) \??\R: 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 4048 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 4048 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 4048 8ab8bf8a5cf4147b3fab5b214db8454e.exe 4048 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2116 wrote to memory of 4048 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 85 PID 2116 wrote to memory of 4048 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 85 PID 2116 wrote to memory of 4048 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 85 PID 2116 wrote to memory of 1148 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 87 PID 2116 wrote to memory of 1148 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 87 PID 2116 wrote to memory of 1148 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 87 PID 2116 wrote to memory of 2088 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 88 PID 2116 wrote to memory of 2088 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 88 PID 2116 wrote to memory of 2088 2116 8ab8bf8a5cf4147b3fab5b214db8454e.exe 88 PID 4048 wrote to memory of 1700 4048 8ab8bf8a5cf4147b3fab5b214db8454e.exe 90 PID 4048 wrote to memory of 1700 4048 8ab8bf8a5cf4147b3fab5b214db8454e.exe 90 PID 4048 wrote to memory of 1700 4048 8ab8bf8a5cf4147b3fab5b214db8454e.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ab8bf8a5cf4147b3fab5b214db8454e.exe"C:\Users\Admin\AppData\Local\Temp\8ab8bf8a5cf4147b3fab5b214db8454e.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\8ab8bf8a5cf4147b3fab5b214db8454e.exeC:\Users\Admin\AppData\Local\Temp\8ab8bf8a5cf4147b3fab5b214db8454e.exe2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\8ab8bf8a5cf4147b3fab5b214db8454e.exeC:\Users\Admin\AppData\Local\Temp\8ab8bf8a5cf4147b3fab5b214db8454e.exe3⤵
- Enumerates connected drives
PID:1700
-
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\8ab8bf8a5cf4147b3fab5b214db8454e.exeC:\Users\Admin\AppData\Local\Temp\8ab8bf8a5cf4147b3fab5b214db8454e.exe2⤵
- Enumerates connected drives
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.2MB
MD5894e01aaa1f501fa3c8930d535cf513f
SHA1a86e37782aef20f5f5cf6c3468727f8b8ea8e3e6
SHA2567676fab10ac3d7c697a6395d180d0ec24cd0f2f8684fcf899a8108fcda485b20
SHA5128703bded7c912e746e45fd461557eff32a4a100fabfd814abfc91aa3e24d0ac5cef41ba37d4ff3cad3901f4f0442edaa6bdaa3d0536a0f25a2582f9f4c51855e
-
Filesize
5KB
MD5d807aa04480d1d149f7a4cac22984188
SHA1ffd5be65fd10017e34c11cecd105ebf4aa6c0cd9
SHA256eddf092d901afe128322910c3ff41a3f242d33d6b4cdf91ece327076b324ccbb
SHA512875543583c20ab164f37a4fb2587d234ce0a15d649d22b0d1dae5933f0a7683db170578746ea4458c51fec26e2243c6ec00dc10db8d4289789e50d5800cf863e