f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 05:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92.exe
Size

72KB
MD5

a239d609d74a3e48a34a87f9b0cd1d74
SHA1

9b1d465e31282fe56276d2d216a077fda0b0853f
SHA256

f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92
SHA512

4a7725a35d9dfff9e4aacfb633960eb169e08b07f6d4ed62de7a88204d238438d888c26ad7b756621389aca966c51bcbd902f712c456d9dd181b3680040afb7d
SSDEEP

1536:xU9NVM6oqQg9lOkOYmxCibH6n2VY7WMez2/:e9NVDvlOrjxH6IYKMe2

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	axdasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	axdasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	axdasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	axdasik.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5350444F-4846-4d41-5350-444F48464d41}	axdasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5350444F-4846-4d41-5350-444F48464d41}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	axdasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5350444F-4846-4d41-5350-444F48464d41}\IsInstalled = "1"	axdasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5350444F-4846-4d41-5350-444F48464d41}\StubPath = "C:\\Windows\\system32\\ucfoabod.exe"	axdasik.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	axdasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	axdasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ahcoanet.exe"	axdasik.exe

Executes dropped EXE 2 IoCs

pid	Process
2920	axdasik.exe
1040	axdasik.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	axdasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	axdasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	axdasik.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	axdasik.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	axdasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\acxudoar.dll"	axdasik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	axdasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	axdasik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	axdasik.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\axdasik.exe	f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92.exe
File created	C:\Windows\SysWOW64\ahcoanet.exe	axdasik.exe
File opened for modification	C:\Windows\SysWOW64\ucfoabod.exe	axdasik.exe
File created	C:\Windows\SysWOW64\ucfoabod.exe	axdasik.exe
File opened for modification	C:\Windows\SysWOW64\acxudoar.dll	axdasik.exe
File created	C:\Windows\SysWOW64\acxudoar.dll	axdasik.exe
File created	C:\Windows\SysWOW64\axdasik.exe	f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92.exe
File opened for modification	C:\Windows\SysWOW64\ahcoanet.exe	axdasik.exe
File opened for modification	C:\Windows\SysWOW64\axdasik.exe	axdasik.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
1040	axdasik.exe
1040	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe
2920	axdasik.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	axdasik.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2920	1496	f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92.exe	81
PID 1496 wrote to memory of 2920	1496	f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92.exe	81
PID 1496 wrote to memory of 2920	1496	f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92.exe	81
PID 2920 wrote to memory of 612	2920	axdasik.exe	5
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 1040	2920	axdasik.exe	82
PID 2920 wrote to memory of 1040	2920	axdasik.exe	82
PID 2920 wrote to memory of 1040	2920	axdasik.exe	82
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56
PID 2920 wrote to memory of 3452	2920	axdasik.exe	56

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3452
- C:\Users\Admin\AppData\Local\Temp\f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92.exe
  "C:\Users\Admin\AppData\Local\Temp\f941dd6949d9d8c2c997ce4c78906f97a96f6fbcbead90e71ff4bb8876866d92.exe"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\SysWOW64\axdasik.exe
    "C:\Windows\SysWOW64\axdasik.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\axdasik.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\acxudoar.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
C:\Windows\SysWOW64\ahcoanet.exe

Filesize
73KB

MD5
4dd927704ed94b855bbc40db51508f9e

SHA1
5a8bcd7fbf7b5a5e1bd527f5c84649ebfce13e40

SHA256
33dc4b836cf071e70ca37fcb5a508c79e2b987bda609c7255c1a767cfdbed39d

SHA512
d337aa40cdfa1ba804a71917fe0a1479eeb15db937d519c0810815bece5fcb0e91b22e5c883fdaaf926273fbb46096d9095f142eebde5bed153c8560ba7a2072

Download Submit
C:\Windows\SysWOW64\axdasik.exe

Filesize
70KB

MD5
e72e8a8e918648725ca3a5fde5624f31

SHA1
8e5c89fdd5c707456ac4481008c3e08488564d9b

SHA256
ce17f737c208b80791f4d2478f52ce0217fba253952849aba34b50985ba92e98

SHA512
d454261ad2c510f009f3070fa3c119cd8692840a817cd8ed8c221aed3769f6432ff5a92c198783cf174713a2985b05ae8bb9034b961006c642705ee413663b23

Download Submit
C:\Windows\SysWOW64\ucfoabod.exe

Filesize
72KB

MD5
ee6788f7108560abd31c17fe48a46d37

SHA1
0e7ebc0c4b9fe31a370c8a39e8b5544d4b866440

SHA256
df20521057a05b3b5f077a8e03527403fbb5924395d26bc36a416c1caf42de61

SHA512
db38eb186a7a6e3bf668fb791e1e14810a74b6c27cadff5cfdd3e5e1dfbf19555e6c29767609820c10ec2cc3de0abef770bc66248e081ddf63de1dc90b641b07

Download Submit
memory/1040-48-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1496-3-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2920-47-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download