a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Original/b44634d90a9ff2ed8a9d0304c11bf612.exe
Size

480KB
MD5

b44634d90a9ff2ed8a9d0304c11bf612
SHA1

8f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4
SHA256

27d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e
SHA512

7e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239
SSDEEP

6144:iWWPaCGkGGCBJKeNm1VbeuJCeU2HM7R+mzZUxrKkhhcghPrQANJRjiP6EQ6a9k7v:ReGkGJN8VyUxrvoZgJRjJ6a9TgS

Score

7^/10

Malware Config

Signatures

Allows Network login with blank passwords 1 TTPs 1 IoCs
Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol
T1021.001

Processes:

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0"
Deletes itself 1 IoCs

Processes:

pHJDsrqwPggIHDd.exe

pid process

1100 pHJDsrqwPggIHDd.exe
Executes dropped EXE 1 IoCs

Processes:

pHJDsrqwPggIHDd.exe

pid process

1100 pHJDsrqwPggIHDd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0"

pid	process
1100	pHJDsrqwPggIHDd.exe

pid	process
1100	pHJDsrqwPggIHDd.exe

Drops file in System32 directory 3 IoCs

Processes:

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\ne9bzef6m8.dll
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\ne9bzef6m8.dll
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat

Drops file in Windows directory 1 IoCs

Processes:

b44634d90a9ff2ed8a9d0304c11bf612.exe

description ioc process

File created C:\Windows\pHJDsrqwPggIHDd.exe b44634d90a9ff2ed8a9d0304c11bf612.exe

description	ioc	process
File created	C:\Windows\pHJDsrqwPggIHDd.exe	b44634d90a9ff2ed8a9d0304c11bf612.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FF83E345-99AA-4A14-9B8E-240C04F0BC51}\WpadDecisionTime = 2041363a86adda01
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FF83E345-99AA-4A14-9B8E-240C04F0BC51}\WpadNetworkName = "Network 3"
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-e3-95-81-09-77\WpadDecisionTime = 2041363a86adda01
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-e3-95-81-09-77\WpadDecision = "0"
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FF83E345-99AA-4A14-9B8E-240C04F0BC51}\WpadDecision = "0"
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FF83E345-99AA-4A14-9B8E-240C04F0BC51}\WpadDecisionReason = "1"
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-e3-95-81-09-77
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FF83E345-99AA-4A14-9B8E-240C04F0BC51}\b2-e3-95-81-09-77
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FF83E345-99AA-4A14-9B8E-240C04F0BC51}
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-e3-95-81-09-77\WpadDecisionReason = "1"

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b44634d90a9ff2ed8a9d0304c11bf612.exepHJDsrqwPggIHDd.exe

pid	process
2740	b44634d90a9ff2ed8a9d0304c11bf612.exe
1100	pHJDsrqwPggIHDd.exe
1100	pHJDsrqwPggIHDd.exe
1100	pHJDsrqwPggIHDd.exe
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608
608

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pHJDsrqwPggIHDd.exe

pid process

1100 pHJDsrqwPggIHDd.exe

pid	process
1100	pHJDsrqwPggIHDd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

b44634d90a9ff2ed8a9d0304c11bf612.exepHJDsrqwPggIHDd.exe

description	pid	process
Token: SeDebugPrivilege	2740	b44634d90a9ff2ed8a9d0304c11bf612.exe
Token: SeDebugPrivilege	1100	pHJDsrqwPggIHDd.exe
Token: SeDebugPrivilege	608

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

b44634d90a9ff2ed8a9d0304c11bf612.exe

description	pid	process	target process
PID 2740 wrote to memory of 1100	2740	b44634d90a9ff2ed8a9d0304c11bf612.exe	pHJDsrqwPggIHDd.exe
PID 2740 wrote to memory of 1100	2740	b44634d90a9ff2ed8a9d0304c11bf612.exe	pHJDsrqwPggIHDd.exe
PID 2740 wrote to memory of 1100	2740	b44634d90a9ff2ed8a9d0304c11bf612.exe	pHJDsrqwPggIHDd.exe
PID 2740 wrote to memory of 1100	2740	b44634d90a9ff2ed8a9d0304c11bf612.exe	pHJDsrqwPggIHDd.exe
PID 608 wrote to memory of 2492	608		wmiprvse.exe
PID 608 wrote to memory of 2492	608		wmiprvse.exe
PID 608 wrote to memory of 2492	608		wmiprvse.exe

C:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe
"C:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\pHJDsrqwPggIHDd.exe
C:\Users\Admin\AppData\Local\Temp\Original\b44634d90a9ff2ed8a9d0304c11bf612.exe
2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\pHJDsrqwPggIHDd.exe

Filesize
480KB

MD5
b44634d90a9ff2ed8a9d0304c11bf612

SHA1
8f72e02dcbd87a4c1b880d349e34e0deb8e7bdd4

SHA256
27d3378f41d3bd82d84544f7331856001a5fca259b6ef9001c15cdc43207c73e

SHA512
7e48e19817a132c8c29f56c271865ad7ef375291229e9b844c3d3c7ff8927b23fe4eb87494ef89f3dae0e1795648ae910e576ca0c42c231c15aaca60bb619239

Download Submit
memory/608-18-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/608-25-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/608-24-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/608-22-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/608-21-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/608-14-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/608-12-0x00000000002E0000-0x000000000031C000-memory.dmp

Filesize
240KB

Download
memory/608-17-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/608-16-0x0000000000320000-0x0000000000361000-memory.dmp

Filesize
260KB

Download
memory/1100-19-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1100-11-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1100-10-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2740-1-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2740-8-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2740-9-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2740-0-0x0000000000310000-0x0000000000312000-memory.dmp

Filesize
8KB

Download