bb816a1f49fb8507919668b938cb89f75eb7a8405029dda6e463332f6a78dca1

Analysis

max time kernel
92s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 21:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97a9fe4fc6d0c7561bc4d268ae410d56.exe
Size 212KB
Sample240212-1gkmpsec75
SHA256 bb816a1f49fb8507919668b938cb89f75eb7a8405029dda6e463332f6a78dca1
MD5 97a9fe4fc6d0c7561bc4d268ae410d56
SHA1 544d35e3007d318d87cdd385e7995a91392eb3f0
SHA512 708d54c4e50fb727a2f8bd2dcd10d5107007488f8766b03c61192a05f8b78c10093591ec21e559c8c164ef8cf96ded9629e3621623f0c5716be883d3f8a48a87
SSDEEP 6144:TNwSTnr+1YYzlnMiU1xDyqovw+WZQULxXeZscFevI8:KSTnfYzhMIvw3BL4Zsc0Z
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery upx

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\00004b99.SYS	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\00004b99.SYS	rundll32.exe
File created	C:\Windows\SysWOW64\drivers\i82440bx.sys	InstLNP.exe

Executes dropped EXE 3 IoCs

pid	Process
2056	InstLNP.exe
2420	ad_1453.exe
1036	AIS_1453_0.EXE

Loads dropped DLL 9 IoCs

pid	Process
1036	AIS_1453_0.EXE
4092	rundll32.exe
460	rundll32.exe
460	rundll32.exe
460	rundll32.exe
460	rundll32.exe
460	rundll32.exe
460	rundll32.exe
460	rundll32.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/436-0-0x0000000000400000-0x0000000000499000-memory.dmp	upx
behavioral2/files/0x0006000000023207-5.dat	upx
behavioral2/memory/2056-7-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/2056-12-0x0000000000400000-0x0000000000414000-memory.dmp	upx
behavioral2/memory/436-22-0x0000000000400000-0x0000000000499000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\lsanp.dll	InstLNP.exe
File created	C:\Windows\SysWOW64\ysmx.uni	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ysmx.uni	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\00004b99.DAT	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\00004b99.DAT	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ysmx.uni	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\p¡^	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	rundll32.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\uvft\tues.ini	AIS_1453_0.EXE
File opened for modification	C:\Program Files\Common Files\uvft\tues.ini	AIS_1453_0.EXE
File created	C:\Program Files\Common Files\uvft\efsd.dll	AIS_1453_0.EXE
File opened for modification	C:\Program Files\Common Files\uvft\pqao.ini	AIS_1453_0.EXE
File created	C:\Program Files\Common Files\uvft\jkxi.dll	AIS_1453_0.EXE
File opened for modification	C:\PROGRA~1\COMMON~1\uvft\vwjx.ini	rundll32.exe
File created	C:\Program Files\Common Files\uvft\cdqb.ini	AIS_1453_0.EXE
File created	C:\Program Files\Common Files\uvft\hivg.dll	AIS_1453_0.EXE
File created	C:\Program Files\Common Files\uvft\mnxl.dll	AIS_1453_0.EXE
File opened for modification	C:\PROGRA~1\COMMON~1\uvft\tues.ini	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\inf\68000.PNF	InstLNP.exe
File opened for modification	C:\Windows\inf\68000.PNF	InstLNP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
460	rundll32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 2056	436	97a9fe4fc6d0c7561bc4d268ae410d56.exe	85
PID 436 wrote to memory of 2056	436	97a9fe4fc6d0c7561bc4d268ae410d56.exe	85
PID 436 wrote to memory of 2056	436	97a9fe4fc6d0c7561bc4d268ae410d56.exe	85
PID 436 wrote to memory of 2420	436	97a9fe4fc6d0c7561bc4d268ae410d56.exe	86
PID 436 wrote to memory of 2420	436	97a9fe4fc6d0c7561bc4d268ae410d56.exe	86
PID 436 wrote to memory of 2420	436	97a9fe4fc6d0c7561bc4d268ae410d56.exe	86
PID 2420 wrote to memory of 1036	2420	ad_1453.exe	87
PID 2420 wrote to memory of 1036	2420	ad_1453.exe	87
PID 2420 wrote to memory of 1036	2420	ad_1453.exe	87
PID 1036 wrote to memory of 4092	1036	AIS_1453_0.EXE	88
PID 1036 wrote to memory of 4092	1036	AIS_1453_0.EXE	88
PID 1036 wrote to memory of 4092	1036	AIS_1453_0.EXE	88

C:\Users\Admin\AppData\Local\Temp\97a9fe4fc6d0c7561bc4d268ae410d56.exe
"C:\Users\Admin\AppData\Local\Temp\97a9fe4fc6d0c7561bc4d268ae410d56.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\ad_1453\InstLNP.exe
  C:\Users\Admin\AppData\Local\Temp\ad_1453\InstLNP.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2056
- C:\Users\Admin\AppData\Local\Temp\ad_1453\ad_1453.exe
  C:\Users\Admin\AppData\Local\Temp\ad_1453\ad_1453.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Users\Admin\AppData\Local\Temp\AIS_1453_0.EXE
    C:\Users\Admin\AppData\Local\Temp\AIS_1453_0.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\PROGRA~1\COMMON~1\uvft\efsd.dll,Service
      4⤵
      Drops file in Drivers directory
      Loads dropped DLL
      Drops file in System32 directory
      PID:4092

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\SysWOW64\rundll32.exe C:\PROGRA~1\COMMON~1\uvft\efsd.dll,Service -s
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hivg.dll

Path C:\PROGRA~1\COMMON~1\uvft\hivg.dll
Size 108KB
SHA256 7f981a4082d2f30c7e70c70abee127869f3a556f5ca10cbdcff5fc691268509e
MD5 4007191299623a4a5640dd12bf0250eb
SHA1 7f5efe50751fa260f910791453e25193eac160c7
SHA512 b3f225b41e28c653a81039d53706b3d120bb3e595251ba587fada3aeb25a4c198f5ef633b5f9180f43b57343961799cc1b5631dcebb6634f4fd537606da10ea6
SSDEEP 1536:qUrqteVYpl8tk3kq61WD2UiALVaZNVJnbJIoJ4jqW:qUr5VYp+tk3k11L3TNJ4jqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

jkxi.dll

Path C:\PROGRA~1\COMMON~1\uvft\jkxi.dll
Size 92KB
SHA256 c13833128341c9b389b7f7220b2b28a88be4b52dc8e9937c7ae115901b81fce8
MD5 ee84937381a5866d939795c893b15b0c
SHA1 579cbfb64543faed77052faac83983667b740b97
SHA512 555ac89711791fb2365a2a4bdf5598eeca25a5c0b64dd68d881169a53695de08f51d09a4b01478a8e1b5d2f64d4827aea5f28b8114bc7130ff547863f38bab01
SSDEEP 1536:1LAicYHVVYdTRfOO4jx76fr2U0HuuX4tO+LOSh95HJehwMsl:5V1SmO0x74GHuuXQN7HJehwMsl
MD5 SHA1 SHA512 SSDEEP

Submit Download

mnxl.dll

Path C:\PROGRA~1\COMMON~1\uvft\mnxl.dll
Size 80KB
SHA256 8b208a5a36188c56ec9d48e1c54ffa3cc9ddd261836f894305e5e0780c371034
MD5 f9c6a3ba11a759810c786cd5cd936ced
SHA1 3f6e3ce21880e47de4d12cb9c9fd04e7c7a46fd1
SHA512 5c63914b9da2d1b0dbb0ed191854792554c7d02ab5cb533200477024e04fc777b47876f69d11459739fc3c07f1ad8c7c0ad6bba5d46ca3d145e6a065af083cbc
SSDEEP 1536:ZaJZDmF+Je3Ls7UeO2UfHAaXYVJ0OSUiy:2ZDmFoe3LFBHAEQJ0OSU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

tues.ini

Path C:\PROGRA~1\COMMON~1\uvft\tues.ini
Size 99B
SHA256 32326afe9f9e371050321996c02ddf862116b9d3a01e918f189952391de0365f
MD5 4cb1134b6769a0c3d86702e50a8cc5ab
SHA1 100d7dcffb872ffe53fcc49d370ab33242ce1792
SHA512 72c7adbccc483b9a043f53c297dab9b748cd1c551902ecd1dd693cdb1bdf2c2e3f80b396be6064123b7507fa43b96f2e99bada88bb1a2ac6c25a0bde91e15acb
MD5 SHA1 SHA512

Submit Download

efsd.dll

Path C:\Program Files\Common Files\uvft\efsd.dll
Size 188KB
SHA256 9c265a4d362afeaea171a123070d59a6f99a1a194d96b219d6f32171ee3f934f
MD5 f3489c4b9199f6b089825b931511635c
SHA1 21b30f0602da5e1cd31f25583243de8124962f3d
SHA512 1fce34c4b757c916b8bbe6b6b1cbd2d05cd2dec089203848baae7c922de92419065d8d63841f3eb9321acb292a4b4a1431075f7f44dfd719090cea7f45bddeb4
SSDEEP 3072:gFsb7pSKMBkRUalxUBY1voPjZQJamGEispwFqiq:ssx6uQPtTmGE7wFqiq
MD5 SHA1 SHA512 SSDEEP

Submit Download

AIS_1453_0.EXE

Path C:\Users\Admin\AppData\Local\Temp\AIS_1453_0.EXE
Size 652KB
SHA256 2c46e208be7a4a21e3363738d08956d5c72ef5a60669564889a361b46bc3ebd3
MD5 25f0fe62d3faf964a9dacaece7360f4e
SHA1 49cf37ff88b4fff4cab385114a5ebd2b68f23e0e
SHA512 8327094d0600a305bdc45c04f3fa39c7bc6d04f4dbb6c6ed5d10e2d6bf8569232b6ed309edb8188c037a90604704f485c4c1e59330738e7509f679727eb7851a
SSDEEP 12288:y1LH8vgcosx6rAGYwFgSKCqN3x679lQZy9V0o2q:y84cNsaVNwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

InstLNP.exe

Path C:\Users\Admin\AppData\Local\Temp\ad_1453\InstLNP.exe
Size 25KB
SHA256 ee5c21b7e295f9abb1cf3463e1003610325b0fdd62928a10bfb154dcbf91767c
MD5 d253fbe3e63f5c9767d49f04f7f57d15
SHA1 dd364c6e52b5ac0d22ad83de455e723b8332b5c6
SHA512 f5cacf9fdc76cbaaf2b56d94d803a6733d6062724ed139a904d5dd8109b127c62478dbe350acfea59c00f19199107eefb0e3206b3885810d5b5fbbff3845ab49
SSDEEP 384:PgtXUBOVZuaokh0gvXuh6mRHOas+V+H3jtxjatvkRRaOqtrT10A4jmInXDOMf5:YtE6uaxh0fh6mJk+GtUtMEomITOMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ad_1453.exe

Path C:\Users\Admin\AppData\Local\Temp\ad_1453\ad_1453.exe
Size 179KB
SHA256 59cdca396ae017b631462ce81400b2a94130e53f82a8348fce3f10caf2476ec6
MD5 bb418327a2cb6c2816bde4412667df8f
SHA1 fc1fbf5337bcf630cd7fe49766b54324d16b9b54
SHA512 613ed06865d93c1c8355d555d991c0d75155be9f1a4e9c720de97d53917f90171cf806f7f747a865d499d7a83a61d66c73ae8ddf35666f24a572f1690e213180
SSDEEP 3072:gS4nzIl9UkJDxcX0SIFLKfFX+aOLd/rTWNtgSIMbKOHzG4k2TKV3VWNqjZQu7R1p:CXexcWGFXarSNtgS5+OK4k2TKV3VYqFH
MD5 SHA1 SHA512 SSDEEP

Submit Download

init.txt

Path C:\Users\Admin\AppData\Local\Temp\ad_1453\init.txt
Size 24B
SHA256 e44b1e4a3f118025e12654e6e7edc8a2d2f53a35f2aca12cb3ed118b54f19186
MD5 62d8780ede0a3b970cb0f122ba1a861b
SHA1 fed184b34f2dce150fc800ab2e1912ff6a902237
SHA512 7068a61bf0c4ed55ae1642fc8e7f65d41879e27de8f72a9924a9c89abc807e7f2385645cf6ba2e1f5a8caa4d0035d39666a042af9ab0d508cf0c14a3eecdccbe
MD5 SHA1 SHA512

Submit Download

ysmx.uni

Path C:\Windows\SysWOW64\ysmx.uni
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

memory/436-0-0x0000000000400000-0x0000000000499000-memory.dmp

Download

memory/436-22-0x0000000000400000-0x0000000000499000-memory.dmp

Download

memory/460-53-0x0000000002500000-0x000000000251C000-memory.dmp

Download

memory/460-57-0x0000000002520000-0x0000000002537000-memory.dmp

Download

memory/460-61-0x0000000002540000-0x0000000002558000-memory.dmp

Download

memory/2056-12-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2056-7-0x0000000000400000-0x0000000000414000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads