Overview

overview

7

Static

static

3

a40aaea79b...4b.exe

windows7-x64

7

a40aaea79b...4b.exe

windows10-2004-x64

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-05-2024 02:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a40aaea79b5481b460c3cd1e28397012559a1102f5ec71c2b114b8108196064b.exe

  • Size

    170KB

  • MD5

    2a071d9edcc27561b9ec1452d10e9fc2

  • SHA1

    672abe339f15396dd1fcf5691b4163e352a1bb22

  • SHA256

    a40aaea79b5481b460c3cd1e28397012559a1102f5ec71c2b114b8108196064b

  • SHA512

    63f54e739782d08ec8d512af61c169411d8aad4cd1fb9b170f9b000812beab39f79c7bdb688f314ce6b5e495cea252aceded65def2e37f772ccb362bc126f4e3

  • SSDEEP

    3072:tJpOm5axh63laEo+pXX1pQD2UCohD8mxLCj+5cmeDye42L712xrpdJ8xLeb7Uj:DAm5oh63laEo+pXX1pkF8mxeq5+4m71X

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 14 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 62 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a40aaea79b5481b460c3cd1e28397012559a1102f5ec71c2b114b8108196064b.exe
    "C:\Users\Admin\AppData\Local\Temp\a40aaea79b5481b460c3cd1e28397012559a1102f5ec71c2b114b8108196064b.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Maps connected drives based on registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\ProgramData\OEMExt\ntinit32.exe
      "C:\ProgramData\OEMExt\ntinit32.exe" 1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2640
      • C:\Users\Admin\AppData\Roaming\OEMExt\ntinit32.exe
        "C:\Users\Admin\AppData\Roaming\OEMExt\ntinit32.exe" 1
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2872
    • C:\ProgramData\OEMExt\ntinit32.exe
      "C:\ProgramData\OEMExt\ntinit32.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\ProgramData\OEMExt\ntinit32.exe
        "C:\ProgramData\OEMExt\ntinit32.exe" 1
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Maps connected drives based on registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2436
  • C:\ProgramData\OEMExt\ntinit32.exe
    C:\ProgramData\OEMExt\ntinit32.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Enumerates connected drives
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\ProgramData\Ole320\sppcomapi.exe
      "C:\ProgramData\Ole320\sppcomapi.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\UIFY6LXE.txt
    Filesize

    15B

    MD5

    0a1c66dd2c6aa58d45c637c9025efd9f

    SHA1

    fdaeb1cc552b3f270e93db11f114fb447712eb6e

    SHA256

    a8fc4e1d6c05e8dc4203faf0fd70fd9b7ccccdd541926a69f26374cc275b334f

    SHA512

    5f040358ac4170aa64a96fe3b9083ab7ae8cb46040a4804e9c5a301d00ebab069db69bcb8e540e01ccf6bd9b9ab5f1f1bf87eef28a69b2c4f9f720df762ea8ad

    Download Submit

  • C:\Users\Admin\AppData\Roaming\OEMExt\ntinit32.exe
    Filesize

    170KB

    MD5

    19882fecfe01847f43608e18f7fffb04

    SHA1

    d3415d42e20b7c2e3e7aca2915b7863e16e14499

    SHA256

    ad84c06ca23c411338856f6f75d5f0f6936a3b67ac2f4b58f29fd902809b4543

    SHA512

    7e9a1be113f915febc97769aadfac037d2895cd512d6c7e75a59df938ac0160deb3cdf8f61188146be7e324b0ab4041e612f7dd5631308ad8e4f3907d5ee0e13

    Download Submit

  • \ProgramData\OEMExt\ntinit32.exe
    Filesize

    170KB

    MD5

    a978185d930138129a6a16488956af45

    SHA1

    faf6047dcf1a8cbc1f9a0c5f878d43f6366af03d

    SHA256

    d0c490f3dddf8009501fab734f484f2fcb9866462cacee4300c5566afc7f1dc7

    SHA512

    fe783196ebff00dff9358f3eb2b498230dbcd3b08824b9dde2ac59bc34eadfc1da9dbb32eb895991117bc1206f6c9010b1c9dd31cccc362d0aae65b04ad677c6

    Download Submit

  • \ProgramData\Ole320\sppcomapi.exe
    Filesize

    170KB

    MD5

    4d726078be2f7125cda23a626b86cf35

    SHA1

    8aa4185eb60f49867ca0c30033d7ea62537c5405

    SHA256

    5cfec2359894fe38d1cb2bd0c8c72fdc769a17fa78510244c79b4090769fb743

    SHA512

    86e0199e50c709e389cf223b8a6ccede308efc1a65c7cee0bd2484908c83a19d9c6de9e805cc6181104ebd482296d8132418f206d98ee2e08cc28535456c1906

    Download Submit