e91d389bcd7dbcd63860b1bbe09fbc006880616e113630acb2dff1d5a41efb6a

General

Target

HUHE34ED34U.exe
Size

718KB
MD5

e0f4226c8a03a6033b1ea0075056ad9a
SHA1

910d11dae17bdd87040236e5be2eac30abb04471
SHA256

e91d389bcd7dbcd63860b1bbe09fbc006880616e113630acb2dff1d5a41efb6a
SHA512

4374798b697ebd65ee84fe923d1acdc6a85aaa398bb798817abd55f8ee4e25a6a47a0ac9782e5595a13238b5161b37c669ad9544255bdb5eec76c6e35b2a1b17
SSDEEP

12288:da5WzrnDaFW0bfPdbef4XqXwK9Wfz+XTKg2Uzy9HOotXHisN:3fnDaFW0bfPo4XqXw8A9h9nL

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2792 schtasks.exe

pid	process
2792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

HUHE34ED34U.exepowershell.exepowershell.exe

pid	process
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2028	HUHE34ED34U.exe
2804	powershell.exe
2536	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

HUHE34ED34U.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2028 HUHE34ED34U.exe
Token: SeDebugPrivilege 2804 powershell.exe
Token: SeDebugPrivilege 2536 powershell.exe

description	pid	process
Token: SeDebugPrivilege	2028	HUHE34ED34U.exe
Token: SeDebugPrivilege	2804	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

HUHE34ED34U.exe

description	pid	process	target process
PID 2028 wrote to memory of 2536	2028	HUHE34ED34U.exe	powershell.exe
PID 2028 wrote to memory of 2536	2028	HUHE34ED34U.exe	powershell.exe
PID 2028 wrote to memory of 2536	2028	HUHE34ED34U.exe	powershell.exe
PID 2028 wrote to memory of 2536	2028	HUHE34ED34U.exe	powershell.exe
PID 2028 wrote to memory of 2804	2028	HUHE34ED34U.exe	powershell.exe
PID 2028 wrote to memory of 2804	2028	HUHE34ED34U.exe	powershell.exe
PID 2028 wrote to memory of 2804	2028	HUHE34ED34U.exe	powershell.exe
PID 2028 wrote to memory of 2804	2028	HUHE34ED34U.exe	powershell.exe
PID 2028 wrote to memory of 2792	2028	HUHE34ED34U.exe	schtasks.exe
PID 2028 wrote to memory of 2792	2028	HUHE34ED34U.exe	schtasks.exe
PID 2028 wrote to memory of 2792	2028	HUHE34ED34U.exe	schtasks.exe
PID 2028 wrote to memory of 2792	2028	HUHE34ED34U.exe	schtasks.exe
PID 2028 wrote to memory of 2460	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2460	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2460	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2460	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2324	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2324	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2324	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2324	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2408	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2408	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2408	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2408	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2416	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2416	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2416	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2416	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2424	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2424	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2424	2028	HUHE34ED34U.exe	HUHE34ED34U.exe
PID 2028 wrote to memory of 2424	2028	HUHE34ED34U.exe	HUHE34ED34U.exe

C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe
"C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bhLUNIgOPx.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bhLUNIgOPx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp87C6.tmp"
2⤵
- Creates scheduled task(s)
PID:2792

C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe
"C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe"
2⤵
PID:2460

C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe
"C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe"
2⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe
"C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe"
2⤵
PID:2408

C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe
"C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe"
2⤵
PID:2416

C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe
"C:\Users\Admin\AppData\Local\Temp\HUHE34ED34U.exe"
2⤵
PID:2424

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp87C6.tmp
Filesize
1KB

MD5
454a95ced80f8f3d0215d340da3699dd

SHA1
bd08a8418d2f41710537ba5cfca61b2396a40aef

SHA256
96f7b2e8cd0d11c63d94cf7e01fb665fa1506fec3394672c2a038b7428c48d3c

SHA512
c794e8d5f73218b64200d80247003b47552eb9354d25a13c03abddc16598a19adcbd73407a6cc5b1ce2c3282a3be5da0661aa017388ab4752e4405854bc1f20f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
a492061b48e21dfae907697f7edb429f

SHA1
12157fc040c73e50a36b94cb93a2ca89c3793f1e

SHA256
1e9fe84d1ba0f2ec17b6a568bd4fcff26e9a237b97995e39432d3406a1a94ab0

SHA512
f4672ae5beb8aeb1134b034f5909cf6cca4bbac5be2616e774cd0f4b8ea7edc247067ab8323c7fadb4d7526dc73a22824a25101d23f28cf347a03d3b308a9ea0

Download Submit
memory/2028-18-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2028-1-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2028-2-0x0000000000470000-0x00000000004B0000-memory.dmp

Filesize
256KB

Download
memory/2028-3-0x0000000000380000-0x0000000000392000-memory.dmp

Filesize
72KB

Download
memory/2028-4-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download
memory/2028-5-0x0000000005CF0000-0x0000000005D72000-memory.dmp

Filesize
520KB

Download
memory/2028-0-0x00000000003B0000-0x0000000000468000-memory.dmp

Filesize
736KB

Download
memory/2536-22-0x000000006F6B0000-0x000000006FC5B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-20-0x000000006F6B0000-0x000000006FC5B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-26-0x0000000002430000-0x0000000002470000-memory.dmp

Filesize
256KB

Download
memory/2536-27-0x000000006F6B0000-0x000000006FC5B000-memory.dmp

Filesize
5.7MB

Download
memory/2804-21-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/2804-19-0x000000006F6B0000-0x000000006FC5B000-memory.dmp

Filesize
5.7MB

Download
memory/2804-23-0x000000006F6B0000-0x000000006FC5B000-memory.dmp

Filesize
5.7MB

Download
memory/2804-25-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/2804-24-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/2804-28-0x000000006F6B0000-0x000000006FC5B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads