d020c7b38ea630149ff0aece22bded120b6fd07d5782507cc68ea943c96699b5

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b89fea1873e1fc6bc11b89fda8a1971a.exe
Size

1.4MB
MD5

b89fea1873e1fc6bc11b89fda8a1971a
SHA1

8813f7b73f2bbf370657dad6f060619dfe1d6f5d
SHA256

d020c7b38ea630149ff0aece22bded120b6fd07d5782507cc68ea943c96699b5
SHA512

e3b3ef8f4a787e602d0315f44e8c95537f42469e4bd596d2650e7c6f8cbba1e4172339fcae0dd6120aaaead4fca84b6f111c9f2f0aee46d76002ca58af97ccce
SSDEEP

24576:vV7Xiu5YDTpF2paldsjTRG2dS4zb0fivWMj8kjdLCSMQ7d8mD3daENfZeFM:vtXiu5YHDAayVGmS0bSivDjZgSM6+mD0

Score

8^/10

persistence upx

Malware Config

Signatures

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a000000	b89fea1873e1fc6bc11b89fda8a1971a.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1752-0-0x0000000000400000-0x0000000001335000-memory.dmp	upx
behavioral2/memory/1752-15-0x0000000000400000-0x0000000001335000-memory.dmp	upx
behavioral2/memory/1752-25-0x0000000000400000-0x0000000001335000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GlobalFlagimglog = "C:\\Windows\\system32\\imglog.exe"	b89fea1873e1fc6bc11b89fda8a1971a.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\imglog.exe	b89fea1873e1fc6bc11b89fda8a1971a.exe
File opened for modification	C:\Windows\SysWOW64\imglog.exe	b89fea1873e1fc6bc11b89fda8a1971a.exe
File created	C:\Windows\SysWOW64\MEGATRON.ini	b89fea1873e1fc6bc11b89fda8a1971a.exe
File opened for modification	C:\Windows\SysWOW64\MEGATRON.ini	b89fea1873e1fc6bc11b89fda8a1971a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ponto.DLL	b89fea1873e1fc6bc11b89fda8a1971a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Internet Explorer\TypedURLs	b89fea1873e1fc6bc11b89fda8a1971a.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1752	b89fea1873e1fc6bc11b89fda8a1971a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1752	b89fea1873e1fc6bc11b89fda8a1971a.exe
1752	b89fea1873e1fc6bc11b89fda8a1971a.exe

C:\Users\Admin\AppData\Local\Temp\b89fea1873e1fc6bc11b89fda8a1971a.exe
"C:\Users\Admin\AppData\Local\Temp\b89fea1873e1fc6bc11b89fda8a1971a.exe"
1⤵
- Uses Session Manager for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ponto.DLL

Filesize
399B

MD5
f0161328b321dfcba81d4516524b2781

SHA1
c65bdb62b67f4150f94d75fa64788d8f05b13859

SHA256
f37e10ca84be6e476d1164eca5b1d104f5dac890f02f5de701c61b86f19a1eae

SHA512
273f3bcd6cf80020ac85227184c05d4c901c07e3782e741ee5b8abb63f89171c632725de68f4b015ca902fec4268eaa1101ab8d9b7f592721e08b94a329ff672

Download Submit
memory/1752-0-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/1752-1-0x0000000001950000-0x0000000001951000-memory.dmp

Filesize
4KB

Download
memory/1752-2-0x0000000005950000-0x0000000005951000-memory.dmp

Filesize
4KB

Download
memory/1752-15-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/1752-25-0x0000000000400000-0x0000000001335000-memory.dmp

Filesize
15.2MB

Download
memory/1752-29-0x0000000001950000-0x0000000001951000-memory.dmp

Filesize
4KB

Download
memory/1752-32-0x0000000005950000-0x0000000005951000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads