Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe
Resource
win10v2004-20240426-en
General
-
Target
acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe
-
Size
71KB
-
MD5
c7057413eee356b86dfa3df7ef95b0cc
-
SHA1
62b789cec6c70491ad98a6f6aa04a4c662d43c15
-
SHA256
acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77
-
SHA512
f05ae8d51a10787afec9ca32e6fb82b217ab2148e912a28669e0faa184b9577cccc00fcb7e9f68d37d3c463158c0dfe4358f18d652f519ab85c72bb5aaeb8a6c
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slD:Olg35GTslA5t3/w8k
Malware Config
Signatures
-
Processes:
axnedud.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" axnedud.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" axnedud.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" axnedud.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" axnedud.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
axnedud.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\IsInstalled = "1" axnedud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\StubPath = "C:\\Windows\\system32\\alkeaved-udid.exe" axnedud.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858} axnedud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" axnedud.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
axnedud.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" axnedud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\adkeakux-acum.exe" axnedud.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe axnedud.exe -
Executes dropped EXE 2 IoCs
Processes:
axnedud.exeaxnedud.exepid process 2800 axnedud.exe 2660 axnedud.exe -
Loads dropped DLL 3 IoCs
Processes:
acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exeaxnedud.exepid process 2916 acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe 2916 acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe 2800 axnedud.exe -
Processes:
axnedud.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" axnedud.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" axnedud.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" axnedud.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" axnedud.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
axnedud.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} axnedud.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify axnedud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" axnedud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\avhotuf.dll" axnedud.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" axnedud.exe -
Drops file in System32 directory 9 IoCs
Processes:
acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exeaxnedud.exedescription ioc process File created C:\Windows\SysWOW64\axnedud.exe acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe File opened for modification C:\Windows\SysWOW64\adkeakux-acum.exe axnedud.exe File opened for modification C:\Windows\SysWOW64\alkeaved-udid.exe axnedud.exe File created C:\Windows\SysWOW64\alkeaved-udid.exe axnedud.exe File created C:\Windows\SysWOW64\avhotuf.dll axnedud.exe File opened for modification C:\Windows\SysWOW64\axnedud.exe acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe File created C:\Windows\SysWOW64\adkeakux-acum.exe axnedud.exe File opened for modification C:\Windows\SysWOW64\avhotuf.dll axnedud.exe File opened for modification C:\Windows\SysWOW64\axnedud.exe axnedud.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
axnedud.exeaxnedud.exepid process 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2660 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe 2800 axnedud.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exeaxnedud.exedescription pid process Token: SeDebugPrivilege 2916 acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe Token: SeDebugPrivilege 2800 axnedud.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exeaxnedud.exedescription pid process target process PID 2916 wrote to memory of 2800 2916 acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe axnedud.exe PID 2916 wrote to memory of 2800 2916 acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe axnedud.exe PID 2916 wrote to memory of 2800 2916 acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe axnedud.exe PID 2916 wrote to memory of 2800 2916 acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe axnedud.exe PID 2800 wrote to memory of 432 2800 axnedud.exe winlogon.exe PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 2660 2800 axnedud.exe axnedud.exe PID 2800 wrote to memory of 2660 2800 axnedud.exe axnedud.exe PID 2800 wrote to memory of 2660 2800 axnedud.exe axnedud.exe PID 2800 wrote to memory of 2660 2800 axnedud.exe axnedud.exe PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE PID 2800 wrote to memory of 1196 2800 axnedud.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe"C:\Users\Admin\AppData\Local\Temp\acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\axnedud.exe"C:\Windows\system32\axnedud.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\axnedud.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\adkeakux-acum.exeFilesize
74KB
MD5b45bce75742f261da105e32a294f9b49
SHA12dd235ff6123b79b0292408cd9d4ae421af33d20
SHA2566ebe60a03b3a7e128e9afdf32aaa1c24683d541980a0c476b3a7cdc2d40ba838
SHA512576bfe4d98d59c8fd2ee2c4ae9c10b937c3631eb246b3035153c64a0001308b6fbbddb9c51b7401eebce6a75900fe4d1d2ac913c5804c443df9b561fd281bd7c
-
C:\Windows\SysWOW64\alkeaved-udid.exeFilesize
73KB
MD5ecc3230822f0cd6fc3b174a7b305ef60
SHA1b52627509d3d30b79fb8d83abaf074d0ac749a44
SHA2564d4a4415b2253b618f60e7fe17f19a576fcf1aa53772f01f2733a6140712319a
SHA5121700b8b7b4e34025983105f5ae9cb2cd2bc2a3abb3323c4b8abebc9000132fca1dd630597b2fd0983630ef5a2aaf6f1610c0b907ff7256cc144c1841cdc7a84f
-
C:\Windows\SysWOW64\avhotuf.dllFilesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
\Windows\SysWOW64\axnedud.exeFilesize
71KB
MD5c7057413eee356b86dfa3df7ef95b0cc
SHA162b789cec6c70491ad98a6f6aa04a4c662d43c15
SHA256acfb18b67c6b0773e4b330fd392e0400ac8f33d59825a81cb2ff59ed1e983e77
SHA512f05ae8d51a10787afec9ca32e6fb82b217ab2148e912a28669e0faa184b9577cccc00fcb7e9f68d37d3c463158c0dfe4358f18d652f519ab85c72bb5aaeb8a6c
-
memory/2660-56-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2800-55-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2916-10-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB