Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 14:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
789c0f1fc165564b8ae2f5db1e5f5cc1.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
789c0f1fc165564b8ae2f5db1e5f5cc1.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
789c0f1fc165564b8ae2f5db1e5f5cc1.exe
-
Size
69KB
-
MD5
789c0f1fc165564b8ae2f5db1e5f5cc1
-
SHA1
70a2b4ca9ad54d27e61560145e6a7b861ef8741d
-
SHA256
dcae51a8dab451b812a3a4721d237fae9cd179f81d652df7fb49508f134ab44c
-
SHA512
468ab3866bd3fe52b6471d435ac1e1651d9883f59850cc312771c744401066d0dcbc95422c7c550de3eaf2eabcf46a96a69be46eef1d689137656663fbd21475
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8A:Olg35GTslA5t3/w8A
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" uvhituh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" uvhituh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" uvhituh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" uvhituh.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47534147-4d48-4351-4753-41474D484351}\StubPath = "C:\\Windows\\system32\\eahlooxur.exe" uvhituh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47534147-4d48-4351-4753-41474D484351} uvhituh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47534147-4d48-4351-4753-41474D484351}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" uvhituh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47534147-4d48-4351-4753-41474D484351}\IsInstalled = "1" uvhituh.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\nhesoad-epex.exe" uvhituh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe uvhituh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" uvhituh.exe -
Executes dropped EXE 2 IoCs
pid Process 1488 uvhituh.exe 4736 uvhituh.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" uvhituh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" uvhituh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" uvhituh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" uvhituh.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify uvhituh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" uvhituh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ihxooteat.dll" uvhituh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" uvhituh.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} uvhituh.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\nhesoad-epex.exe uvhituh.exe File opened for modification C:\Windows\SysWOW64\eahlooxur.exe uvhituh.exe File opened for modification C:\Windows\SysWOW64\uvhituh.exe 789c0f1fc165564b8ae2f5db1e5f5cc1.exe File created C:\Windows\SysWOW64\uvhituh.exe 789c0f1fc165564b8ae2f5db1e5f5cc1.exe File opened for modification C:\Windows\SysWOW64\nhesoad-epex.exe uvhituh.exe File created C:\Windows\SysWOW64\eahlooxur.exe uvhituh.exe File opened for modification C:\Windows\SysWOW64\ihxooteat.dll uvhituh.exe File created C:\Windows\SysWOW64\ihxooteat.dll uvhituh.exe File opened for modification C:\Windows\SysWOW64\uvhituh.exe uvhituh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 4736 uvhituh.exe 4736 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe 1488 uvhituh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1704 789c0f1fc165564b8ae2f5db1e5f5cc1.exe Token: SeDebugPrivilege 1488 uvhituh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1488 1704 789c0f1fc165564b8ae2f5db1e5f5cc1.exe 82 PID 1704 wrote to memory of 1488 1704 789c0f1fc165564b8ae2f5db1e5f5cc1.exe 82 PID 1704 wrote to memory of 1488 1704 789c0f1fc165564b8ae2f5db1e5f5cc1.exe 82 PID 1488 wrote to memory of 616 1488 uvhituh.exe 5 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 4736 1488 uvhituh.exe 83 PID 1488 wrote to memory of 4736 1488 uvhituh.exe 83 PID 1488 wrote to memory of 4736 1488 uvhituh.exe 83 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56 PID 1488 wrote to memory of 3416 1488 uvhituh.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\789c0f1fc165564b8ae2f5db1e5f5cc1.exe"C:\Users\Admin\AppData\Local\Temp\789c0f1fc165564b8ae2f5db1e5f5cc1.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\uvhituh.exe"C:\Windows\system32\uvhituh.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SysWOW64\uvhituh.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4736
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD510ac245c621a44bf2f06ab3b1f736f2f
SHA11b1d5a6a188ec3771e501fd2df3104aa53e6880d
SHA2565031086abca5872418e6327c91d43f97495bd60a643b6086787a95295e6c6d51
SHA51231e32a5beb8835fcd37d087869f89ebeda7545d5945dde381df884db7f8a818dc8c2bae672eba4aa31ab133b6e6e4e6d15cb51d49537bbf2e31d3be152a0b67c
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD5d649b7b4cb91bde92486c1b56c628870
SHA1dc159e9aa4a10f54620d5f8befc3edfc0a3bf0a9
SHA256e191c27a106cf662878a5f4d1c25ea2f678fe3c4fcad97f5b267ac0f35fa9f32
SHA5122620b9b7023b74623984f2f697ca544b4c9a3df29762aa3f4f559e94607dd8bfcf94bd52702fdd097fc7db9b23f4d044d558a1c0fe942988ca4c26b7b3ecb0bb
-
Filesize
69KB
MD5789c0f1fc165564b8ae2f5db1e5f5cc1
SHA170a2b4ca9ad54d27e61560145e6a7b861ef8741d
SHA256dcae51a8dab451b812a3a4721d237fae9cd179f81d652df7fb49508f134ab44c
SHA512468ab3866bd3fe52b6471d435ac1e1651d9883f59850cc312771c744401066d0dcbc95422c7c550de3eaf2eabcf46a96a69be46eef1d689137656663fbd21475