Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 21:16
Static task
static1
Behavioral task
behavioral1
Sample
a49e122b7a5ca135d7a259e24ceeafb6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a49e122b7a5ca135d7a259e24ceeafb6.exe
Resource
win10v2004-20240221-en
General
-
Target
a49e122b7a5ca135d7a259e24ceeafb6.exe
-
Size
368KB
-
MD5
a49e122b7a5ca135d7a259e24ceeafb6
-
SHA1
c852beaede55a861495bd6f17941d6ae1c04c7ff
-
SHA256
b7d7fee9e1b293c15587a4d32d7c19d125771837fb8aec3a3c4aa04d3db7f0f0
-
SHA512
37dbb8cabc6495d7ad3b66eadef546f7ef77dc8777c9ed361a0296d6bb3a6793a82a4c3af243e952c9ec5d4d2a76c5a3e4af5eaf684ac40b87a737f48a2eca19
-
SSDEEP
6144:z7OSgRuehAjP4WN52HTqjNDwdIUuqJx9fkmlX241fMZSJI8b16GuqHCy/stZq:bgRuehAjP4WN52HTqjNDwdIUuy9fkm2v
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\34ayhze5uss5.exe" a49e122b7a5ca135d7a259e24ceeafb6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\34ayhze5uss5.exe" a49e122b7a5ca135d7a259e24ceeafb6.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" a49e122b7a5ca135d7a259e24ceeafb6.exe -
Disables Task Manager via registry modification
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9UKOwAzW-jBnq-QIbC-nOZO-S5sWdSVf5j6j} a49e122b7a5ca135d7a259e24ceeafb6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{9UKOwAzW-jBnq-QIbC-nOZO-S5sWdSVf5j6j}\UPuaZWsHqCbSIKP = "\"C:\\Users\\Admin\\AppData\\Roaming\\34ayhze5uss5.exe\" /ActiveX" a49e122b7a5ca135d7a259e24ceeafb6.exe -
Loads dropped DLL 1 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exepid process 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe -
Processes:
resource yara_rule behavioral1/memory/1040-4-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-5-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-8-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-9-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-10-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-11-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-12-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-46-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-60-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-62-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-72-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-82-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-96-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-110-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-120-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-130-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-144-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-158-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-168-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-182-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-192-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/1040-202-0x0000000000400000-0x000000000049A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\UPuaZWsHqCbSIKP = "C:\\Users\\Admin\\AppData\\Roaming\\34ayhze5uss5.exe" a49e122b7a5ca135d7a259e24ceeafb6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UPuaZWsHqCbSIKP = "C:\\Users\\Admin\\AppData\\Roaming\\34ayhze5uss5.exe" a49e122b7a5ca135d7a259e24ceeafb6.exe -
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a49e122b7a5ca135d7a259e24ceeafb6.exe -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ a49e122b7a5ca135d7a259e24ceeafb6.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription pid process target process PID 2044 set thread context of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe -
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main a49e122b7a5ca135d7a259e24ceeafb6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exepid process 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exepid process 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exea49e122b7a5ca135d7a259e24ceeafb6.exepid process 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe 1040 a49e122b7a5ca135d7a259e24ceeafb6.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a49e122b7a5ca135d7a259e24ceeafb6.exedescription pid process target process PID 2044 wrote to memory of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe PID 2044 wrote to memory of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe PID 2044 wrote to memory of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe PID 2044 wrote to memory of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe PID 2044 wrote to memory of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe PID 2044 wrote to memory of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe PID 2044 wrote to memory of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe PID 2044 wrote to memory of 1040 2044 a49e122b7a5ca135d7a259e24ceeafb6.exe a49e122b7a5ca135d7a259e24ceeafb6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a49e122b7a5ca135d7a259e24ceeafb6.exe"C:\Users\Admin\AppData\Local\Temp\a49e122b7a5ca135d7a259e24ceeafb6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a49e122b7a5ca135d7a259e24ceeafb6.exeC:\Users\Admin\AppData\Local\Temp\a49e122b7a5ca135d7a259e24ceeafb6.exe2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\NewErrorPageTemplate[1]Filesize
1KB
MD5cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA18f12010dfaacdecad77b70a3e781c707cf328496
SHA256204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\errorPageStrings[2]Filesize
2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\httpErrorPagesScripts[1]Filesize
8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\dnserrordiagoff[1]Filesize
1KB
MD547f581b112d58eda23ea8b2e08cf0ff0
SHA16ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92
-
\Users\Admin\AppData\Local\Temp\dwlGina3.dllFilesize
93KB
MD51173123287198dce1eb831f04e28352c
SHA139d650f4297c990a7ffaa7dc3b6d0ef903c9bd14
SHA25665d4582e135c774d9c827ae08de8b77f199ee934f13d1a0537df4f5d18f590ba
SHA512e9fdb6e808b0f3ed850fb364d48609a9726fd41ad138594fc04f8d48d5672aec3aaa76af236f07c4263c053dc539f99009e74491adb03c885190dcce78f0cede
-
memory/1040-12-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-60-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-11-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-2-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-13-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1040-17-0x00000000002E0000-0x00000000002FC000-memory.dmpFilesize
112KB
-
memory/1040-9-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-47-0x00000000002E0000-0x00000000002FC000-memory.dmpFilesize
112KB
-
memory/1040-46-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-8-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-5-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1040-4-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-10-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-62-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-63-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1040-72-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-82-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-96-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-110-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-120-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-130-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-144-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-158-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-168-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-182-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-192-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/1040-202-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB