Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe
Resource
win10v2004-20240426-en
General
-
Target
78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe
-
Size
70KB
-
MD5
e48d35447598a5c7523c825ae46e47b4
-
SHA1
0c0a192a4cf2d852c1710f6d8da14497df30430b
-
SHA256
78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95
-
SHA512
3fffac76cb070b17afe35c1f63e8b6c506bd54d49f826687c3c4599df8e93823e5d00b75e7ade1694b7175d37e85f9b3aebcbb0c9ff7a716a4e26863ebc3b270
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8D6:Olg35GTslA5t3/w8u
Malware Config
Signatures
-
Processes:
hkavex-ihac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" hkavex-ihac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" hkavex-ihac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" hkavex-ihac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" hkavex-ihac.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
hkavex-ihac.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541} hkavex-ihac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" hkavex-ihac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\IsInstalled = "1" hkavex-ihac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{465A4258-4458-5541-465A-425844585541}\StubPath = "C:\\Windows\\system32\\agpafox.exe" hkavex-ihac.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
hkavex-ihac.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" hkavex-ihac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\egdopeas-eacooc.exe" hkavex-ihac.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe hkavex-ihac.exe -
Executes dropped EXE 2 IoCs
Processes:
hkavex-ihac.exehkavex-ihac.exepid process 884 hkavex-ihac.exe 4636 hkavex-ihac.exe -
Processes:
hkavex-ihac.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" hkavex-ihac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" hkavex-ihac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" hkavex-ihac.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" hkavex-ihac.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
hkavex-ihac.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" hkavex-ihac.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} hkavex-ihac.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify hkavex-ihac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" hkavex-ihac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\atviroov-deas.dll" hkavex-ihac.exe -
Drops file in System32 directory 9 IoCs
Processes:
78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exehkavex-ihac.exedescription ioc process File created C:\Windows\SysWOW64\hkavex-ihac.exe 78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe File created C:\Windows\SysWOW64\egdopeas-eacooc.exe hkavex-ihac.exe File created C:\Windows\SysWOW64\agpafox.exe hkavex-ihac.exe File opened for modification C:\Windows\SysWOW64\atviroov-deas.dll hkavex-ihac.exe File created C:\Windows\SysWOW64\atviroov-deas.dll hkavex-ihac.exe File opened for modification C:\Windows\SysWOW64\hkavex-ihac.exe hkavex-ihac.exe File opened for modification C:\Windows\SysWOW64\hkavex-ihac.exe 78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe File opened for modification C:\Windows\SysWOW64\egdopeas-eacooc.exe hkavex-ihac.exe File opened for modification C:\Windows\SysWOW64\agpafox.exe hkavex-ihac.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
hkavex-ihac.exehkavex-ihac.exepid process 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 4636 hkavex-ihac.exe 4636 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe 884 hkavex-ihac.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exehkavex-ihac.exedescription pid process Token: SeDebugPrivilege 4652 78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe Token: SeDebugPrivilege 884 hkavex-ihac.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exehkavex-ihac.exedescription pid process target process PID 4652 wrote to memory of 884 4652 78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe hkavex-ihac.exe PID 4652 wrote to memory of 884 4652 78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe hkavex-ihac.exe PID 4652 wrote to memory of 884 4652 78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe hkavex-ihac.exe PID 884 wrote to memory of 612 884 hkavex-ihac.exe winlogon.exe PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 4636 884 hkavex-ihac.exe hkavex-ihac.exe PID 884 wrote to memory of 4636 884 hkavex-ihac.exe hkavex-ihac.exe PID 884 wrote to memory of 4636 884 hkavex-ihac.exe hkavex-ihac.exe PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE PID 884 wrote to memory of 3436 884 hkavex-ihac.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe"C:\Users\Admin\AppData\Local\Temp\78f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\hkavex-ihac.exe"C:\Windows\system32\hkavex-ihac.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\hkavex-ihac.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5ad9503924614c20e3a4d3e54b70788e9
SHA1d3a285052c2c91ffaa098b5a032d8e7169441d23
SHA256feef76f20aa3627085ef219165f0cc493fc7c044384f5ece20a80243b6563d9e
SHA5123e08bbb39121b5327cc2d051e76e1fb2302bbf027dc769d1c5320abf85d0d82bd917101f59c4e6ba1eca82a351fc6bc2c09621e851a17f39e13e1a00e8df3869
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
73KB
MD5407f51fce4c495eb72a44b93d308149e
SHA1a62bc8242b001843d444785f475a4e7daa690b9f
SHA256a479cdb3019cb3b4857991c58ffa23861bbcf1d12c54e43693e3dafbf8b88016
SHA512198ed8eba916d976b7d67865a78aceced5323ea3db9d48edc718cd5e49024cd3cd06ddf191ebf68913da7e155c7808fdf75df195fd0001a150e0e0bfe782657c
-
Filesize
70KB
MD5e48d35447598a5c7523c825ae46e47b4
SHA10c0a192a4cf2d852c1710f6d8da14497df30430b
SHA25678f09d7b170da4a53068cfdc5a3076d2416a8ce8bc6621f4f201a18ce3562b95
SHA5123fffac76cb070b17afe35c1f63e8b6c506bd54d49f826687c3c4599df8e93823e5d00b75e7ade1694b7175d37e85f9b3aebcbb0c9ff7a716a4e26863ebc3b270