Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 01:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe
-
Size
70KB
-
MD5
2114bbf88eb3b2990c76fa2657e2fa49
-
SHA1
90f1b79a9b4946f59e32fb31ae87db9dd2ce37ed
-
SHA256
a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae
-
SHA512
3f301fe529ba9be172c70e6323b13bf5443f81c26763c76ccfdad7142597efc1e5dd3b64b048a9e17e4e2a442d888a15d6342deb93681977b4c842d6a7d6d0b0
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slHt:Olg35GTslA5t3/w8Et
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ifvatoop-eadooc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ifvatoop-eadooc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ifvatoop-eadooc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ifvatoop-eadooc.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245} ifvatoop-eadooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ifvatoop-eadooc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\IsInstalled = "1" ifvatoop-eadooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{51475451-5a54-5245-5147-54515A545245}\StubPath = "C:\\Windows\\system32\\upretoas-exex.exe" ifvatoop-eadooc.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ifvatoop-eadooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ifvatoop-eadooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eatbeduk.exe" ifvatoop-eadooc.exe -
Executes dropped EXE 2 IoCs
pid Process 2936 ifvatoop-eadooc.exe 2668 ifvatoop-eadooc.exe -
Loads dropped DLL 3 IoCs
pid Process 1952 a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe 1952 a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe 2936 ifvatoop-eadooc.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ifvatoop-eadooc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ifvatoop-eadooc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ifvatoop-eadooc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ifvatoop-eadooc.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ifvatoop-eadooc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ifvatoop-eadooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ifvatoop-eadooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\idseapoos-cum.dll" ifvatoop-eadooc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ifvatoop-eadooc.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\upretoas-exex.exe ifvatoop-eadooc.exe File opened for modification C:\Windows\SysWOW64\idseapoos-cum.dll ifvatoop-eadooc.exe File created C:\Windows\SysWOW64\idseapoos-cum.dll ifvatoop-eadooc.exe File opened for modification C:\Windows\SysWOW64\ifvatoop-eadooc.exe ifvatoop-eadooc.exe File opened for modification C:\Windows\SysWOW64\ifvatoop-eadooc.exe a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe File opened for modification C:\Windows\SysWOW64\eatbeduk.exe ifvatoop-eadooc.exe File created C:\Windows\SysWOW64\eatbeduk.exe ifvatoop-eadooc.exe File created C:\Windows\SysWOW64\ifvatoop-eadooc.exe a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe File created C:\Windows\SysWOW64\upretoas-exex.exe ifvatoop-eadooc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2668 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe 2936 ifvatoop-eadooc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1952 a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe Token: SeDebugPrivilege 2936 ifvatoop-eadooc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2936 1952 a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe 28 PID 1952 wrote to memory of 2936 1952 a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe 28 PID 1952 wrote to memory of 2936 1952 a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe 28 PID 1952 wrote to memory of 2936 1952 a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe 28 PID 2936 wrote to memory of 436 2936 ifvatoop-eadooc.exe 5 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 2668 2936 ifvatoop-eadooc.exe 29 PID 2936 wrote to memory of 2668 2936 ifvatoop-eadooc.exe 29 PID 2936 wrote to memory of 2668 2936 ifvatoop-eadooc.exe 29 PID 2936 wrote to memory of 2668 2936 ifvatoop-eadooc.exe 29 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21 PID 2936 wrote to memory of 1204 2936 ifvatoop-eadooc.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe"C:\Users\Admin\AppData\Local\Temp\a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\ifvatoop-eadooc.exe"C:\Windows\system32\ifvatoop-eadooc.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\ifvatoop-eadooc.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5a4c0e23d9cc0a82f66b8794d8cd38f60
SHA1cfb7d0243459c05bf7f680541064cf25291e45cd
SHA2562da930314f9d8db077d73e6dfb5b4cdf0239a8c621a2498788aa4e0f564a0fb9
SHA5127d4fe9e2e90151b5edd782fc993be740dd1f42e0fbe84e42b4dd3c2accd4a33ea0d23f41f8edc5ffc65c1fa9e56fec71b3a6ddeabcd725b3559765fcf7622997
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD577546be208a45834f1327bbd0dc59e2a
SHA19aca6ced4dbf58ec120495cb97b4204d49944c73
SHA256a9f08b1237c0fb8af1de93bbe1a18c81be1c5cd1898a8c062880ac67912fe534
SHA512e0ad43c599091f5d9c4531316b5b4fabacee95f1b247647ca6545eb238b7f6ee74e5a844b097660ec5976fa451639cf16b41cb77499e0ba3393556741b6c09de
-
Filesize
70KB
MD52114bbf88eb3b2990c76fa2657e2fa49
SHA190f1b79a9b4946f59e32fb31ae87db9dd2ce37ed
SHA256a56f2e7703acff380f7cee95485a574be8436157c811e5193708e1c67218b5ae
SHA5123f301fe529ba9be172c70e6323b13bf5443f81c26763c76ccfdad7142597efc1e5dd3b64b048a9e17e4e2a442d888a15d6342deb93681977b4c842d6a7d6d0b0