Analysis
-
max time kernel
146s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 03:49
Static task
static1
Behavioral task
behavioral1
Sample
c2617b76536e87cd4674ef8d27eaf75e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c2617b76536e87cd4674ef8d27eaf75e.exe
Resource
win10v2004-20240226-en
General
-
Target
c2617b76536e87cd4674ef8d27eaf75e.exe
-
Size
17KB
-
MD5
c2617b76536e87cd4674ef8d27eaf75e
-
SHA1
d7eeb9060cbd6485ac5dbc93fe7264f839a826f7
-
SHA256
563e813313dbf27a91c862046f293a6ab8bfa4120f372bc696c7a7bc79d8f948
-
SHA512
cc24efd29adbf86b6ea04417f6b8065988405fd772541eba3545bd9f40f502fdd8f7ca4bd61ca1c399267417e85f07cf067b5fecc24dd1abc8a1da3a30b8eb4a
-
SSDEEP
384:QipFh5F21r+bacSGomWFUWWnB6P8syRSuQam:QipwiezpFUWq22SuQ
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\sfokhuqm.dll = "{71A78CD4-E470-4a18-8457-E0E0283DD507}" c2617b76536e87cd4674ef8d27eaf75e.exe -
Loads dropped DLL 1 IoCs
pid Process 388 c2617b76536e87cd4674ef8d27eaf75e.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\sfokhuqm.nls c2617b76536e87cd4674ef8d27eaf75e.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\system\sfokhuqm.tmp c2617b76536e87cd4674ef8d27eaf75e.exe File opened for modification C:\Windows\system\sfokhuqm.tmp c2617b76536e87cd4674ef8d27eaf75e.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507}\InProcServer32\ = "C:\\Windows\\SysWow64\\sfokhuqm.dll" c2617b76536e87cd4674ef8d27eaf75e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507}\InProcServer32\ThreadingModel = "Apartment" c2617b76536e87cd4674ef8d27eaf75e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507} c2617b76536e87cd4674ef8d27eaf75e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{71A78CD4-E470-4a18-8457-E0E0283DD507}\InProcServer32 c2617b76536e87cd4674ef8d27eaf75e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 388 c2617b76536e87cd4674ef8d27eaf75e.exe 388 c2617b76536e87cd4674ef8d27eaf75e.exe 388 c2617b76536e87cd4674ef8d27eaf75e.exe 388 c2617b76536e87cd4674ef8d27eaf75e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 388 c2617b76536e87cd4674ef8d27eaf75e.exe 388 c2617b76536e87cd4674ef8d27eaf75e.exe 388 c2617b76536e87cd4674ef8d27eaf75e.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 388 wrote to memory of 5052 388 c2617b76536e87cd4674ef8d27eaf75e.exe 99 PID 388 wrote to memory of 5052 388 c2617b76536e87cd4674ef8d27eaf75e.exe 99 PID 388 wrote to memory of 5052 388 c2617b76536e87cd4674ef8d27eaf75e.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2617b76536e87cd4674ef8d27eaf75e.exe"C:\Users\Admin\AppData\Local\Temp\c2617b76536e87cd4674ef8d27eaf75e.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\F4A1.tmp.bat2⤵PID:5052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD573015806b65ddd5e49d7b52b025b2501
SHA19051e65ee3bb8ba875a67a1c9c3536e2fec08c9c
SHA256defab0de41134a7665a364f8ee55d6ec585f2cabe1149267bd4e48fcb6b9f033
SHA512da2be1af525ea63aff99e624cff7ef2a2e1195f428ecc49cbcf19a1dbfb050126ac7b1fddb0cc5ce1b9d70fa4c28dca470cab835290f66801ae2e1e1e1646cc2
-
Filesize
1.7MB
MD5567940c2023fd41d5707c2c2ca6eec27
SHA1c5d3091699fa5f15473e36774464b0d943e85c0a
SHA25606c351b80a73379d465677c8f4e97320c9e96f99a703af4bd0458b832e45a380
SHA512a3c34f5cf37160048a10394d001e47a68d6cd203b0cb5e32a85bb395ba944c211b99d56aa57ef9d227d3bf6e6a0bcb3773d4983c8d50a00521db2c2322cb7681
-
Filesize
1.4MB
MD5001138655e22e30837faa54bf95fcb43
SHA12b479131aac539a67cabf6054783e3779571311c
SHA2562d3b91490b704194faab2ef8d4d5ff4bf50c522773f71808c4d1de0947873aec
SHA512d0b2d2d493db629b2980f7bb3a36df43dc59df6ef9148b835d705942f62af28d130809a60b75fbe599ce9470396dbfe366d3f07e79dc218c06d3f471f049fe9f