184477c1255104df23974e459338c3b5c6364ff8fa70ebc81765a25762b39d19

Resubmissions

23-02-2024 12:12

240223-pdfnssga62 7

22-02-2024 20:44

240222-zjcjfafd56 7

22-02-2024 20:34

240222-zcklgafc76 10

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hatch-1.9.3.exe
Size

26.1MB
MD5

ee4299c7cd102c07e3e1995909a6e3d2
SHA1

06023c8802d2ea919228be2caac7de7604f29cc5
SHA256

184477c1255104df23974e459338c3b5c6364ff8fa70ebc81765a25762b39d19
SHA512

aed814dbb14833ae06915a44ebc3019f97eb7078a7583c1d1b2245170f672d70c8d411813b0ee1c73f0f32e2e54bba038f57cfbf60c95c46dceac669a30ef0ed
SSDEEP

786432:hqpXhwkzW6IivTQ3ZQj0zkhGxdgl2PHMeAB1i:gpXhLzW61vcGwxdgl2PH1M1i

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Hatch-1.9.3.exe

pid process

2020 Hatch-1.9.3.exe
Loads dropped DLL 2 IoCs

Processes:

Hatch-1.9.3.exeHatch-1.9.3.exe

pid process

2184 Hatch-1.9.3.exe
2020 Hatch-1.9.3.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

pid	process
2020	Hatch-1.9.3.exe

pid	process
2184	Hatch-1.9.3.exe
2020	Hatch-1.9.3.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Hatch-1.9.3.exe

description	pid	process	target process
PID 2184 wrote to memory of 2020	2184	Hatch-1.9.3.exe	Hatch-1.9.3.exe
PID 2184 wrote to memory of 2020	2184	Hatch-1.9.3.exe	Hatch-1.9.3.exe
PID 2184 wrote to memory of 2020	2184	Hatch-1.9.3.exe	Hatch-1.9.3.exe
PID 2184 wrote to memory of 2020	2184	Hatch-1.9.3.exe	Hatch-1.9.3.exe
PID 2184 wrote to memory of 2020	2184	Hatch-1.9.3.exe	Hatch-1.9.3.exe
PID 2184 wrote to memory of 2020	2184	Hatch-1.9.3.exe	Hatch-1.9.3.exe
PID 2184 wrote to memory of 2020	2184	Hatch-1.9.3.exe	Hatch-1.9.3.exe

C:\Windows\Temp\{2237CF93-68C8-4431-8391-54AE76ABCCF0}\.cr\Hatch-1.9.3.exe
"C:\Windows\Temp\{2237CF93-68C8-4431-8391-54AE76ABCCF0}\.cr\Hatch-1.9.3.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\Hatch-1.9.3.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020

C:\Users\Admin\AppData\Local\Temp\Hatch-1.9.3.exe
"C:\Users\Admin\AppData\Local\Temp\Hatch-1.9.3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\AddMerge.hta"
1⤵
- Modifies Internet Explorer settings
PID:2396

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Temp\{11800876-E4AC-4B15-A3EC-358B98901191}\.ba\logo.png
Filesize
852B

MD5
8346e21859a269dccf1e408dc7593cca

SHA1
239f10674bf6022854c1f1bf7c91955bde34d3e4

SHA256
cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b

SHA512
de9a54e7067fe4feade10f48d7c2bb4169f50efa0b06d3310421376690712af4d55dbc24dc5accc5013379b11abb59cc8c85896fe9f2a7c6a7ea2e28f6feac9f

Download Submit
C:\Windows\Temp\{2237CF93-68C8-4431-8391-54AE76ABCCF0}\.cr\Hatch-1.9.3.exe
Filesize
556KB

MD5
4c2345b8880621f4912275972806cb53

SHA1
44913a723080defd1f9d52ed4d367af0dd26460e

SHA256
9df0138713fb10843eb73e547f0aa91932396329a5fe3f8a3cf1f12eddef5bc3

SHA512
daa6172d9bd2076cd79402871b3e3b8c8dd2b62e1b54e386fec892a961a1afdd16222d003e8c2777c98bec4593fac385974d1e69f86f4bf0733bd97556415f7d

Download Submit
\Windows\Temp\{11800876-E4AC-4B15-A3EC-358B98901191}\.ba\wixstdba.dll
Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit