73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9

Analysis

max time kernel
149s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9.exe
Size

408KB
MD5

6307d326021f0e5ea0f9b2fdfaaa47d1
SHA1

5e7d7c23ad01898b2e0a8904795c8a1f32d186b0
SHA256

73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9
SHA512

e2c91fab6b4e9f0f63ac5a566b917deddba931fa2c5f28a8456a720423c2255e0fb15c52d54eafc84e05e042036032e257a2348c710469f8766bf0fc89d77e45
SSDEEP

6144:4jlYKRF/LReWAsUyCxG8fqLPJVnM55pXmiu1NdSRf:4jauDReWfXPc55pXmiuXif

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

mhinti.exe

pid process

1504 mhinti.exe

pid	process
1504	mhinti.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mhinti.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\ProgramData\\mhinti.exe"	mhinti.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9.exe

description	pid	process	target process
PID 3224 wrote to memory of 1504	3224	73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9.exe	mhinti.exe
PID 3224 wrote to memory of 1504	3224	73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9.exe	mhinti.exe
PID 3224 wrote to memory of 1504	3224	73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9.exe	mhinti.exe

C:\Users\Admin\AppData\Local\Temp\73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9.exe
"C:\Users\Admin\AppData\Local\Temp\73f3b0607b51316625fb6c58d8f54cdb99da3fa61ae9e03e144ee41fdcb85fb9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3224

C:\ProgramData\mhinti.exe
"C:\ProgramData\mhinti.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1504

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DDF.sys .exe
Filesize
408KB

MD5
d23b94540e0b04bf6a22af68c4a375e6

SHA1
082946d00e7369be6595c54bf72cba7b7c2cb449

SHA256
ebc329390f628fecdd514568dbfb078e2f2de06b85dfde0401d654485514dc1f

SHA512
9839e1d0790cafbdb13b463d2fbf2f294b1338294b0d422e6770a6891d9fb6059489f5613ea1d8214c61a1f0ca977197addb41df00401d4e23bfd65422707231

Download Submit
C:\ProgramData\Saaaalamm\Mira.h
Filesize
136KB

MD5
cb4c442a26bb46671c638c794bf535af

SHA1
8a742d0b372f2ddd2d1fdf688c3c4ac7f9272abf

SHA256
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25

SHA512
074a31e8da403c0a718f93cbca50574d8b658921193db0e6e20eacd232379286f14a3698cd443dc740d324ad19d74934ae001a7ad64b88897d8afefbc9a3d4e3

Download Submit
C:\ProgramData\mhinti.exe
Filesize
271KB

MD5
41b48cf8c9c6b25c66f889d7ea41081a

SHA1
87d5db44fbf6aba3b798ddf9997f804eef7639d5

SHA256
45109962077363b94d54022140be4f27ae962e544d6581d4f42ee692b6f3f4d6

SHA512
4fbe87b4a14413c65cd63d000a253677728cf3097acc7964293f5d6a79522388a0d7da2a958ecfdc989625f89840f3c3b77c0fac4eb97a4685ca09dc89f94d9c

Download Submit
memory/1504-132-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3224-0-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3224-1-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/3224-9-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download