Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe
-
Size
68KB
-
MD5
1c13a1d62a411a1cd02a1f4c2b22e3d7
-
SHA1
bf805fb92a2292765e190c963692d193de143f1d
-
SHA256
25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0
-
SHA512
9e43bcca0b6c984139fb7dd1a502087eca2e1b35eaf58b461849b610d6030f4c32d25e240a2b5be398d80adbbfb65bed133a46c39f99ffe1e1f80d025adfbe11
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8X0:Olg35GTslA5t3/w8k
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" impoosoax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" impoosoax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" impoosoax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" impoosoax.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741574B-424d-4f54-4741-574B424D4f54} impoosoax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741574B-424d-4f54-4741-574B424D4f54}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" impoosoax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741574B-424d-4f54-4741-574B424D4f54}\IsInstalled = "1" impoosoax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4741574B-424d-4f54-4741-574B424D4f54}\StubPath = "C:\\Windows\\system32\\asfuxid.exe" impoosoax.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe impoosoax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" impoosoax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ufvinex.exe" impoosoax.exe -
Executes dropped EXE 2 IoCs
pid Process 1704 impoosoax.exe 4928 impoosoax.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" impoosoax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" impoosoax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" impoosoax.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" impoosoax.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} impoosoax.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify impoosoax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" impoosoax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\unharaf-ougex.dll" impoosoax.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" impoosoax.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\impoosoax.exe 25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe File created C:\Windows\SysWOW64\impoosoax.exe 25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe File opened for modification C:\Windows\SysWOW64\ufvinex.exe impoosoax.exe File created C:\Windows\SysWOW64\ufvinex.exe impoosoax.exe File opened for modification C:\Windows\SysWOW64\unharaf-ougex.dll impoosoax.exe File opened for modification C:\Windows\SysWOW64\asfuxid.exe impoosoax.exe File created C:\Windows\SysWOW64\asfuxid.exe impoosoax.exe File created C:\Windows\SysWOW64\unharaf-ougex.dll impoosoax.exe File opened for modification C:\Windows\SysWOW64\impoosoax.exe impoosoax.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 4928 impoosoax.exe 4928 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe 1704 impoosoax.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2596 25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe Token: SeDebugPrivilege 1704 impoosoax.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 1704 2596 25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe 85 PID 2596 wrote to memory of 1704 2596 25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe 85 PID 2596 wrote to memory of 1704 2596 25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe 85 PID 1704 wrote to memory of 616 1704 impoosoax.exe 5 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 4928 1704 impoosoax.exe 86 PID 1704 wrote to memory of 4928 1704 impoosoax.exe 86 PID 1704 wrote to memory of 4928 1704 impoosoax.exe 86 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56 PID 1704 wrote to memory of 3364 1704 impoosoax.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe"C:\Users\Admin\AppData\Local\Temp\25edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\impoosoax.exe"C:\Windows\system32\impoosoax.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\impoosoax.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4928
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD53d852e358e55ca9621304f4beb59cf24
SHA11486e9a9a28b46f49446f2bf99ff8907d565b5cd
SHA2568b50cbf95eea990a6e3286bbf72ef34469dbe730d3387691d8d5545d27577ad6
SHA5128b4ffb5df364abdd023cebaad87b7566d12b64226a601dc965bd7c2c9afe587e8c0c358b1f8f9488d337043141d668f528e7d58bf10f998cf35b862465687475
-
Filesize
68KB
MD51c13a1d62a411a1cd02a1f4c2b22e3d7
SHA1bf805fb92a2292765e190c963692d193de143f1d
SHA25625edfe9d0de9edb895b7c4c921086abd987c6e76fabbe1c0e5d8c2183b81edc0
SHA5129e43bcca0b6c984139fb7dd1a502087eca2e1b35eaf58b461849b610d6030f4c32d25e240a2b5be398d80adbbfb65bed133a46c39f99ffe1e1f80d025adfbe11
-
Filesize
71KB
MD5673ba48491c969a4e050fa48b56bf911
SHA18f4b8f52118fe9605e56bb3bc3d33480e70ad629
SHA256c0266a539095f7bf8fc310755498a1d7b8a977b1e04fcb28dd6fb45c167b38cc
SHA512d6eb0b5664432201f5c4d61841ec88162d1f3924fc7a3fc28f8eb8b5eb1d6a46a4aeb671a726beb7b5a876cf0c9f880075f48bc22dea26cd954b12b46f296f3c
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4