563e813313dbf27a91c862046f293a6ab8bfa4120f372bc696c7a7bc79d8f948

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c2617b76536e87cd4674ef8d27eaf75e.exe
Size

17KB
MD5

c2617b76536e87cd4674ef8d27eaf75e
SHA1

d7eeb9060cbd6485ac5dbc93fe7264f839a826f7
SHA256

563e813313dbf27a91c862046f293a6ab8bfa4120f372bc696c7a7bc79d8f948
SHA512

cc24efd29adbf86b6ea04417f6b8065988405fd772541eba3545bd9f40f502fdd8f7ca4bd61ca1c399267417e85f07cf067b5fecc24dd1abc8a1da3a30b8eb4a
SSDEEP

384:QipFh5F21r+bacSGomWFUWWnB6P8syRSuQam:QipwiezpFUWq22SuQ

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\sfokhuqm.dll = "{71A78CD4-E470-4a18-8457-E0E0283DD507}"	c2617b76536e87cd4674ef8d27eaf75e.exe

Loads dropped DLL 1 IoCs

pid	Process
388	c2617b76536e87cd4674ef8d27eaf75e.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sfokhuqm.nls	c2617b76536e87cd4674ef8d27eaf75e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\sfokhuqm.tmp	c2617b76536e87cd4674ef8d27eaf75e.exe
File opened for modification	C:\Windows\system\sfokhuqm.tmp	c2617b76536e87cd4674ef8d27eaf75e.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507}\InProcServer32\ = "C:\\Windows\\SysWow64\\sfokhuqm.dll"	c2617b76536e87cd4674ef8d27eaf75e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507}\InProcServer32\ThreadingModel = "Apartment"	c2617b76536e87cd4674ef8d27eaf75e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507}	c2617b76536e87cd4674ef8d27eaf75e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507}\InProcServer32	c2617b76536e87cd4674ef8d27eaf75e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
388	c2617b76536e87cd4674ef8d27eaf75e.exe
388	c2617b76536e87cd4674ef8d27eaf75e.exe
388	c2617b76536e87cd4674ef8d27eaf75e.exe
388	c2617b76536e87cd4674ef8d27eaf75e.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
388	c2617b76536e87cd4674ef8d27eaf75e.exe
388	c2617b76536e87cd4674ef8d27eaf75e.exe
388	c2617b76536e87cd4674ef8d27eaf75e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 5052	388	c2617b76536e87cd4674ef8d27eaf75e.exe	99
PID 388 wrote to memory of 5052	388	c2617b76536e87cd4674ef8d27eaf75e.exe	99
PID 388 wrote to memory of 5052	388	c2617b76536e87cd4674ef8d27eaf75e.exe	99

C:\Users\Admin\AppData\Local\Temp\c2617b76536e87cd4674ef8d27eaf75e.exe
"C:\Users\Admin\AppData\Local\Temp\c2617b76536e87cd4674ef8d27eaf75e.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\F4A1.tmp.bat
  2⤵
  PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F4A1.tmp.bat

Filesize
179B

MD5
73015806b65ddd5e49d7b52b025b2501

SHA1
9051e65ee3bb8ba875a67a1c9c3536e2fec08c9c

SHA256
defab0de41134a7665a364f8ee55d6ec585f2cabe1149267bd4e48fcb6b9f033

SHA512
da2be1af525ea63aff99e624cff7ef2a2e1195f428ecc49cbcf19a1dbfb050126ac7b1fddb0cc5ce1b9d70fa4c28dca470cab835290f66801ae2e1e1e1646cc2

Download Submit
C:\Windows\SysWOW64\sfokhuqm.dll

Filesize
1.7MB

MD5
567940c2023fd41d5707c2c2ca6eec27

SHA1
c5d3091699fa5f15473e36774464b0d943e85c0a

SHA256
06c351b80a73379d465677c8f4e97320c9e96f99a703af4bd0458b832e45a380

SHA512
a3c34f5cf37160048a10394d001e47a68d6cd203b0cb5e32a85bb395ba944c211b99d56aa57ef9d227d3bf6e6a0bcb3773d4983c8d50a00521db2c2322cb7681

Download Submit
C:\Windows\SysWOW64\sfokhuqm.dll

Filesize
1.4MB

MD5
001138655e22e30837faa54bf95fcb43

SHA1
2b479131aac539a67cabf6054783e3779571311c

SHA256
2d3b91490b704194faab2ef8d4d5ff4bf50c522773f71808c4d1de0947873aec

SHA512
d0b2d2d493db629b2980f7bb3a36df43dc59df6ef9148b835d705942f62af28d130809a60b75fbe599ce9470396dbfe366d3f07e79dc218c06d3f471f049fe9f

Download Submit
memory/388-9-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/388-14-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download