b0ec1c7d122a89d3a63908a592b62526f4fcf93672b57550ace10bdd0ac870fe

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f28d13c3ef806664ca602589226daa5.exe
Size

150KB
MD5

8f28d13c3ef806664ca602589226daa5
SHA1

6728f615477b8266ab952c75efd22c2cee3f6c0e
SHA256

b0ec1c7d122a89d3a63908a592b62526f4fcf93672b57550ace10bdd0ac870fe
SHA512

be5d4a2b32d93af5a791a8bb5dad555bdadd9c60a43bb69d45982182521a0053b80f8b4f6f18aae95758edf40a73b777eda3a18451587c3cd405ab2ad89119e0
SSDEEP

3072:79ELyQJ20T0hGgd5xD3Ls2kdMdV6LA4Rx6fBApS57i1ap/:79MJLTQD7sfdMdQA4R+Af1

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2792	Aqanea.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\OPLE7CLDO2 = "C:\\Windows\\Aqanea.exe"	Aqanea.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	8f28d13c3ef806664ca602589226daa5.exe
File opened for modification	C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job	8f28d13c3ef806664ca602589226daa5.exe
File created	C:\Windows\Aqanea.exe	8f28d13c3ef806664ca602589226daa5.exe
File opened for modification	C:\Windows\Aqanea.exe	8f28d13c3ef806664ca602589226daa5.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\International	Aqanea.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	Aqanea.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe
2792	Aqanea.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2068	8f28d13c3ef806664ca602589226daa5.exe
Token: SeBackupPrivilege	2068	8f28d13c3ef806664ca602589226daa5.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2792	2068	8f28d13c3ef806664ca602589226daa5.exe	28
PID 2068 wrote to memory of 2792	2068	8f28d13c3ef806664ca602589226daa5.exe	28
PID 2068 wrote to memory of 2792	2068	8f28d13c3ef806664ca602589226daa5.exe	28
PID 2068 wrote to memory of 2792	2068	8f28d13c3ef806664ca602589226daa5.exe	28
PID 2068 wrote to memory of 2792	2068	8f28d13c3ef806664ca602589226daa5.exe	28
PID 2068 wrote to memory of 2792	2068	8f28d13c3ef806664ca602589226daa5.exe	28
PID 2068 wrote to memory of 2792	2068	8f28d13c3ef806664ca602589226daa5.exe	28

C:\Users\Admin\AppData\Local\Temp\8f28d13c3ef806664ca602589226daa5.exe
"C:\Users\Admin\AppData\Local\Temp\8f28d13c3ef806664ca602589226daa5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\Aqanea.exe
  C:\Windows\Aqanea.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Aqanea.exe

Filesize
150KB

MD5
8f28d13c3ef806664ca602589226daa5

SHA1
6728f615477b8266ab952c75efd22c2cee3f6c0e

SHA256
b0ec1c7d122a89d3a63908a592b62526f4fcf93672b57550ace10bdd0ac870fe

SHA512
be5d4a2b32d93af5a791a8bb5dad555bdadd9c60a43bb69d45982182521a0053b80f8b4f6f18aae95758edf40a73b777eda3a18451587c3cd405ab2ad89119e0

Download Submit
C:\Windows\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job

Filesize
344B

MD5
a48abeccd7b89ba24cec341357876221

SHA1
9339835bf49855a17ce7c6e509611e9571f2d1a9

SHA256
80626b90b34511b5f6555d2724ff6017e7a69990dd2f2a09a111f592514de08f

SHA512
a72f1b6021ed88ac0fcbcc5a03cb3ca4b23d7bb89f10b947bc8ab19f76287f0d3e4023dc0a386f7436e4fe7ac4ea614ccabdfc37522272434c4fb8412a31cdae

Download Submit
memory/2068-35675-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2068-1-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2068-0-0x0000000000290000-0x00000000002BA000-memory.dmp

Filesize
168KB

Download
memory/2068-14130-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-44766-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-24681-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-49938-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-49939-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-49940-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-49941-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-49943-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-49944-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2792-49948-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download