Overview

overview

8

Static

static

3

Onn Setup2...08.exe

windows10-2004-x64

8

$PLUGINSDI...er.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...in.dll

windows10-2004-x64

1

$PLUGINSDI...zU.dll

windows10-2004-x64

3

CommFunc.dll

windows10-2004-x64

1

DLL3S_UsbA...32.dll

windows10-2004-x64

3

DLL3S_UsbA...64.dll

windows10-2004-x64

1

DLL3S_UsbA...32.dll

windows10-2004-x64

3

DLL3S_UsbA...64.dll

windows10-2004-x64

1

Driver/CommFunc.dll

windows10-2004-x64

1

Driver/DIFxAPI.dll

windows10-2004-x64

1

Driver/DIFxCmd.exe

windows10-2004-x64

1

Driver/HHT...tr.sys

windows10-2004-x64

1

Driver/Mou...vi.sys

windows10-2004-x64

1

Driver/devcon.exe

windows10-2004-x64

1

Driver/x64...PI.dll

windows10-2004-x64

1

Driver/x64...md.exe

windows10-2004-x64

1

Driver/x64...ve.bat

windows10-2004-x64

1

Driver/x64...up.bat

windows10-2004-x64

5

Driver/x64/HHTHid.sys

windows10-2004-x64

1

Driver/x64...tr.sys

windows10-2004-x64

1

Driver/x64...vi.sys

windows10-2004-x64

1

Driver/x64...id.exe

windows10-2004-x64

8

Driver/x64...vi.sys

windows10-2004-x64

1

Driver/x64...vi.sys

windows10-2004-x64

1

Driver/x64/devcon.exe

windows10-2004-x64

1

DrvInDll.dll

windows10-2004-x64

1

DuiLib.dll

windows10-2004-x64

3

HidServ.dll

windows10-2004-x64

1

HookDLL.dll

windows10-2004-x64

1

KbDaemon.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    92s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 22:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Driver/x64/InstallDriver_HHTHid.exe

  • Size

    172KB

  • MD5

    915c8e1c85b53df5983374f36a727d75

  • SHA1

    0bb6e31952300557e785b0cbc559a5f38605e2dd

  • SHA256

    fbf9fa038763bb13852247581d4c66660fab4a9557a1bb157d4643c052032db7

  • SHA512

    68189135cf15eb5b37571e8aa9ee85278646aef4acc2fe9be17ea647f96ede556a1608294285322911059cc90cdab74c963cd1db0f2cd9fffe450e63bbe05fab

  • SSDEEP

    3072:d/qyGcm48j1/j7jAcfhtolbWmJBW/EqVccMraZ+5X4EFEOZbKYC:d/qfJ9bHAcf8lF/W8qCaZv5Qby

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 8 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Driver\x64\InstallDriver_HHTHid.exe
    "C:\Users\Admin\AppData\Local\Temp\Driver\x64\InstallDriver_HHTHid.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3900
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c devcon.exe install HHTHid.inf "{C3BF46B7-AECF-4628-B748-25B93E654F32}\HID_DEVICE"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Users\Admin\AppData\Local\Temp\Driver\x64\devcon.exe
        devcon.exe install HHTHid.inf "{C3BF46B7-AECF-4628-B748-25B93E654F32}\HID_DEVICE"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:4348
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c devcon.exe update HHTHidMouFiltr.inf "HID\Vid_1CBE&Pid_0114&Col03"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3528
      • C:\Users\Admin\AppData\Local\Temp\Driver\x64\devcon.exe
        devcon.exe update HHTHidMouFiltr.inf "HID\Vid_1CBE&Pid_0114&Col03"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:4620
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:32
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fc553b41-2d62-dc4c-86fc-75b548bf5898}\hhthid.inf" "9" "4b2e0c68f" "000000000000014C" "WinSta0\Default" "0000000000000158" "208" "c:\users\admin\appdata\local\temp\driver\x64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4828
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\HIDCLASS\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:b2fe4818386da1dc:VHidMini.Inst:1.0.0.0:{c3bf46b7-aecf-4628-b748-25b93e654f32}\hid_device," "4b2e0c68f" "000000000000014C"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3124
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f22cc6d0-1d9d-804a-b955-050540384f16}\hhthidmoufiltr.inf" "9" "48b01fd53" "0000000000000164" "WinSta0\Default" "0000000000000180" "208" "c:\users\admin\appdata\local\temp\driver\x64"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2808
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "HID\VID_1CBE&PID_0114&COL03\1&2D595CA7&0&0002" "C:\Windows\INF\oem4.inf" "oem4.inf:bcec1b19d8f58feb:HIDUAS_Inst:1.0.0.0:hid\vid_1cbe&pid_0114&col03," "48b01fd53" "0000000000000164"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s hidserv
    1⤵
      PID:3156

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\{F22CC~1\HHTHidMouFiltr.sys
      Filesize

      23KB

      MD5

      fbcbbba0fbc8e1d9eb42f22a92e0c96b

      SHA1

      f256cce7c0bc30963a2649f2f0ddd06d1c80a3bb

      SHA256

      96a8a9229837a2a25d568d0493b4bf18949c1332113c9c8ffaaebaa849de201a

      SHA512

      822c7fb3a5771fc0d30b652426345c15c668b3375b209e4fb73d78b6ec301bb413ad2921dc3284592176e9333886b081c86c2a4be51d354dbd7f65fe1f09d0b6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{FC553~1\HHTHid.cat
      Filesize

      134KB

      MD5

      095dc7acc89c2c8e61840596553d8519

      SHA1

      4127b83f178a9118616ff465e9cddcd41990a08e

      SHA256

      fbacc8f5d653c9b1b73801d9db792f9d46465620ff0336bf1bf24db0acc34aba

      SHA512

      07d2b42f3e16ce1963d8322a2dc59579ca6ca3b7d1840aeb089cbdb953cd8ad1a70e3b530b2fe214749a0a1116641466649d60a365ec664be92128051f26a0b3

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{FC553~1\HHTHid.sys
      Filesize

      24KB

      MD5

      175f4a95e9472aa9853e3f4f15ebecd0

      SHA1

      69ae4a618d12c69a61fc815e2a916be88382ab6b

      SHA256

      8d6691a44c33ab197794a179e9692be11b77927e6fad4b4fcd50379ee819d337

      SHA512

      288213e726be769a6422443061052ea06fdfa75a5965e781f3d40f4002dd5edd8e99eeb82a4901a75074be5a8bf255b0e90d1fdd53b7294fbcf3c57cd569c2a6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{f22cc6d0-1d9d-804a-b955-050540384f16}\hhthidmoufiltr.inf
      Filesize

      2KB

      MD5

      6fbda8a676e67d3eea78c6a9a6896873

      SHA1

      fad34c293068bca26a9f507c3eae261d3928af7a

      SHA256

      ae5afe303f7111027fdf70c2d5121bab709a7542483042350f7fdc952bc6e0bf

      SHA512

      7e78c5bb317c72c3170ffd630861744bafc62b7b861946414695ea22b409d7e49a0b77df30ec2e2307896bed8cbf87c171ecdae531fc905bf1d9cfe3b9275513

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{fc553b41-2d62-dc4c-86fc-75b548bf5898}\hhthid.inf
      Filesize

      2KB

      MD5

      dc2dd1a76541c8398a085c064a2333c9

      SHA1

      2dd1032f416d6c7ddd747114e439cbb6220ff8df

      SHA256

      9d10225b2b672358e85a52f90fc2b1f4cfee11487eea1e00c7c6de8b7456b35c

      SHA512

      79336504339ec1f6cd9a635611484e4131307cc8e308fae890b7064d61c8678c9bbe6b4fd3f481403af67035ece2c113fb98676c183e2dbfa7d74654dc453a38

      Download Submit

    • C:\Windows\System32\CatRoot2\dberr.txt
      Filesize

      21KB

      MD5

      eb5a227b792942152269d15d46f28526

      SHA1

      c072fa3d391183b3e5c540bda32c0255130a6d60

      SHA256

      5d64455aa9529968eec83b457eecea5f5937f193accfaf149cc5e137b994218b

      SHA512

      5cef207c12f6670fa297d67717f4bc08f20aefdce847473ea1137f54a27769b3ae1ff77ddb8239175e6d2abd5d3dc63468e915ae80df350d99c7169d7dd06fe5

      Download Submit