Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
03-06-2024 04:05
Static task
static1
Behavioral task
behavioral1
Sample
d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe
Resource
win10v2004-20240426-en
General
-
Target
d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe
-
Size
73KB
-
MD5
9fdedc26a459559813da9708a67a67d2
-
SHA1
384a6098d0fc88462828660efe73fdfa6af50f33
-
SHA256
d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac
-
SHA512
d1f402438b2cdf9e1fd82a59f5b03272acde2c78c40a704e90107982e898f620d66eced5028d53e35fac93161922844f507c7a0900fa4c786bcc971e2e68ddcf
-
SSDEEP
768:x/nQODtOgZwPeS2oyrw0U/Q7/PM8ee+YLVrvgA4R+Fy0u4ETZC6oLclNLqEntgtt:xo62PVOUY7/2efJDtuZ86LNtG5Mip/
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" alponuv-idid.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\IsInstalled = "1" alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\StubPath = "C:\\Windows\\system32\\adberob-ecum.exe" alponuv-idid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858} alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4249534D-495a-4858-4249-534D495A4858}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" alponuv-idid.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\uctoarer-edur.exe" alponuv-idid.exe -
Executes dropped EXE 2 IoCs
pid Process 300 alponuv-idid.exe 2528 alponuv-idid.exe -
Loads dropped DLL 3 IoCs
pid Process 1728 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 1728 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 300 alponuv-idid.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" alponuv-idid.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ohcegis-fat.dll" alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" alponuv-idid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} alponuv-idid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" alponuv-idid.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\alponuv-idid.exe d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe File opened for modification C:\Windows\SysWOW64\uctoarer-edur.exe alponuv-idid.exe File created C:\Windows\SysWOW64\uctoarer-edur.exe alponuv-idid.exe File created C:\Windows\SysWOW64\adberob-ecum.exe alponuv-idid.exe File created C:\Windows\SysWOW64\ohcegis-fat.dll alponuv-idid.exe File opened for modification C:\Windows\SysWOW64\alponuv-idid.exe alponuv-idid.exe File created C:\Windows\SysWOW64\alponuv-idid.exe d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe File opened for modification C:\Windows\SysWOW64\adberob-ecum.exe alponuv-idid.exe File opened for modification C:\Windows\SysWOW64\ohcegis-fat.dll alponuv-idid.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 2528 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe 300 alponuv-idid.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 300 alponuv-idid.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 300 1728 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 29 PID 1728 wrote to memory of 300 1728 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 29 PID 1728 wrote to memory of 300 1728 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 29 PID 1728 wrote to memory of 300 1728 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 29 PID 300 wrote to memory of 432 300 alponuv-idid.exe 5 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 2528 300 alponuv-idid.exe 30 PID 300 wrote to memory of 2528 300 alponuv-idid.exe 30 PID 300 wrote to memory of 2528 300 alponuv-idid.exe 30 PID 300 wrote to memory of 2528 300 alponuv-idid.exe 30 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18 PID 300 wrote to memory of 1072 300 alponuv-idid.exe 18
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe"C:\Users\Admin\AppData\Local\Temp\d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\alponuv-idid.exe"C:\Windows\SysWOW64\alponuv-idid.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Windows\SysWOW64\alponuv-idid.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2528
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD56a855b0589a940f967ffe5ece7cbe9b5
SHA18be134aeaf257598964f888cfa7a83fed799c9a1
SHA256c422f71e89e9316f4726b39c6901e2fcc79b1f769b19b0c0cee5a3db13e5eee7
SHA512dbc55809d211b7351ac73a716f66e99fe6d962cd23875debcb3a4575907d408366085a582867af4a824d1882dd64316d151fbbc37c46f3d2a0c4d1320c87b420
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
74KB
MD5e51de5b598cba09f434c69f5ad996a5a
SHA14f62e0ae3f047e7e77ac6b3b2d6bd37f779effe3
SHA25652ba1523099f614fff0e5867e18f780bb1f7c3640cbeef98648e5faeb1b70cdf
SHA512a10a3d02472aa36ec6c23ef49d0b89e734c1ad09cde84b67cadde8f7af9954634e3e17d2f7d84a17a6edf5b07c7ea2044a4a78ea016d9f7abdb5027364fa6626
-
Filesize
71KB
MD5958447be18cad6ab706beccbcac3c73d
SHA140c28166e023723370a9bf116119c092f92bdd84
SHA256d91aa0d4b40163b9c81d3d41a3e5f58a18466d44fe90ce77f68e34a87e62ec1f
SHA512be4845844cd5600747aba5525425b1d21df25f09cd5efbf36c5e3f2ffcbc8bf398561db59be89226cb3c0a22d94edac9f7b824dfaccf9257dff3d7b66a825fc2