Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24-04-2024 21:58

General

  • Target

    577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe

  • Size

    67KB

  • MD5

    b0bad3c5d1ce3ecad7914d3ec32e4a82

  • SHA1

    f957a18ed5b758017e635fb1407f037db4bb4418

  • SHA256

    577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25

  • SHA512

    e06fe9bbb21f905026f9b6a99e8ec475c9de2c3ea2c55dbce5622b0d0fe76a0ff9021725b1042af3d6787a7e3c1f635fd8249cfc610d04dac7766d0844883a79

  • SSDEEP

    1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+dwY5b:ulg35GTslA5t3Gdwm

Malware Config

Signatures

  • Windows security bypass 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Windows security modification 2 TTPs 4 IoCs
  • Modifies WinLogon 2 TTPs 5 IoCs
  • Drops file in System32 directory 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe
    "C:\Users\Admin\AppData\Local\Temp\577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\SysWOW64\ufratin.exe
      "C:\Windows\system32\ufratin.exe"
      2⤵
      • Windows security bypass
      • Modifies Installed Components in the registry
      • Sets file execution options in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Modifies WinLogon
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Windows\SysWOW64\ufratin.exe
        ùù¿çç¤
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:2748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\ihpakoab.exe

    Filesize

    70KB

    MD5

    7e37cf55f09a88dc3d0babfbd939cb1e

    SHA1

    051761b4ea45544c85e096aadbb114f61c0c379b

    SHA256

    a21109791e6d3dc65604761714c5f9d1029f87d016a86367ba8360b5cb2d583d

    SHA512

    b4b0a363cb7bb80f0819c33eddd4081093c3e928f47e76e12186b98cb40ab63446dbddca3aa4516dd556f84f651454e0dc76c6055f277c3beb365ef8c5671272

  • C:\Windows\SysWOW64\ougvoacom.dll

    Filesize

    5KB

    MD5

    f37b21c00fd81bd93c89ce741a88f183

    SHA1

    b2796500597c68e2f5638e1101b46eaf32676c1c

    SHA256

    76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

    SHA512

    252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

  • C:\Windows\SysWOW64\uxxexob.exe

    Filesize

    69KB

    MD5

    5158558b85d9131dad0fb9bbef086fdd

    SHA1

    90e9d066b92f442af157e9d46bc016fe925dc2e3

    SHA256

    af4a0005163067999c115f107d5f3314b987cfbefc82a52d55e3d28f42511abb

    SHA512

    c38050e3c1ffe47ddbde0700a70433d3c119cdc66673665c0f9cdf7c71632e944abe526939281f9a58e4dba9f101e8f8d1474e998e3bd3f137dbca16b2f6714f

  • \Windows\SysWOW64\ufratin.exe

    Filesize

    67KB

    MD5

    b0bad3c5d1ce3ecad7914d3ec32e4a82

    SHA1

    f957a18ed5b758017e635fb1407f037db4bb4418

    SHA256

    577066999bc3464f9926ac7d5c8cc6f2bbc09811f4143f2d9e9dcd77c52b1b25

    SHA512

    e06fe9bbb21f905026f9b6a99e8ec475c9de2c3ea2c55dbce5622b0d0fe76a0ff9021725b1042af3d6787a7e3c1f635fd8249cfc610d04dac7766d0844883a79

  • memory/1672-55-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2388-9-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2748-56-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB