Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 04:05
Static task
static1
Behavioral task
behavioral1
Sample
d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe
Resource
win10v2004-20240426-en
General
-
Target
d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe
-
Size
73KB
-
MD5
9fdedc26a459559813da9708a67a67d2
-
SHA1
384a6098d0fc88462828660efe73fdfa6af50f33
-
SHA256
d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac
-
SHA512
d1f402438b2cdf9e1fd82a59f5b03272acde2c78c40a704e90107982e898f620d66eced5028d53e35fac93161922844f507c7a0900fa4c786bcc971e2e68ddcf
-
SSDEEP
768:x/nQODtOgZwPeS2oyrw0U/Q7/PM8ee+YLVrvgA4R+Fy0u4ETZC6oLclNLqEntgtt:xo62PVOUY7/2efJDtuZ86LNtG5Mip/
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" alponuv-idid.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5350444F-4846-4d41-5350-444F48464d41} alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5350444F-4846-4d41-5350-444F48464d41}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5350444F-4846-4d41-5350-444F48464d41}\IsInstalled = "1" alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5350444F-4846-4d41-5350-444F48464d41}\StubPath = "C:\\Windows\\system32\\adberob-ecum.exe" alponuv-idid.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\uctoarer-edur.exe" alponuv-idid.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe alponuv-idid.exe -
Executes dropped EXE 2 IoCs
pid Process 1304 alponuv-idid.exe 3612 alponuv-idid.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" alponuv-idid.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" alponuv-idid.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} alponuv-idid.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ohcegis-fat.dll" alponuv-idid.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" alponuv-idid.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\alponuv-idid.exe d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe File opened for modification C:\Windows\SysWOW64\ohcegis-fat.dll alponuv-idid.exe File opened for modification C:\Windows\SysWOW64\alponuv-idid.exe alponuv-idid.exe File created C:\Windows\SysWOW64\adberob-ecum.exe alponuv-idid.exe File created C:\Windows\SysWOW64\ohcegis-fat.dll alponuv-idid.exe File created C:\Windows\SysWOW64\alponuv-idid.exe d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe File opened for modification C:\Windows\SysWOW64\uctoarer-edur.exe alponuv-idid.exe File created C:\Windows\SysWOW64\uctoarer-edur.exe alponuv-idid.exe File opened for modification C:\Windows\SysWOW64\adberob-ecum.exe alponuv-idid.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 3612 alponuv-idid.exe 3612 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe 1304 alponuv-idid.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1304 alponuv-idid.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4048 wrote to memory of 1304 4048 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 84 PID 4048 wrote to memory of 1304 4048 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 84 PID 4048 wrote to memory of 1304 4048 d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe 84 PID 1304 wrote to memory of 604 1304 alponuv-idid.exe 5 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3612 1304 alponuv-idid.exe 85 PID 1304 wrote to memory of 3612 1304 alponuv-idid.exe 85 PID 1304 wrote to memory of 3612 1304 alponuv-idid.exe 85 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55 PID 1304 wrote to memory of 3316 1304 alponuv-idid.exe 55
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:604
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe"C:\Users\Admin\AppData\Local\Temp\d1111a5279e29e5dd55baaee3c766d86c7f560f8873f124bc1cfcfe3f0aeacac.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Windows\SysWOW64\alponuv-idid.exe"C:\Windows\SysWOW64\alponuv-idid.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\alponuv-idid.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD534447aa56a526617604d60be3ab10a71
SHA115ea4394db748f41b1a9f0f14f751154e3f42a33
SHA2564000739dff7160d33878e68ed86f0a62d378227ee6808ed6ebb21ae2da96657c
SHA512464c2f12d0ee1afa15241b27d5e2564dcb89e4d8f334e3b3a341aa6e2ec02d30db0e1311cffd8840771cd1dedfd1fdf53901d30870bb0866cb440b5cffcddd5f
-
Filesize
71KB
MD5958447be18cad6ab706beccbcac3c73d
SHA140c28166e023723370a9bf116119c092f92bdd84
SHA256d91aa0d4b40163b9c81d3d41a3e5f58a18466d44fe90ce77f68e34a87e62ec1f
SHA512be4845844cd5600747aba5525425b1d21df25f09cd5efbf36c5e3f2ffcbc8bf398561db59be89226cb3c0a22d94edac9f7b824dfaccf9257dff3d7b66a825fc2
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
74KB
MD525715476b69d2cf805b28e0928b73c45
SHA1026a188b007dfd12a914267b092d34a40b0a4318
SHA256e44526af97fc8ecfbc7268167b1810040f88020f1777cb86a355d1b415443dbb
SHA51285e37a5fea7491a0fa6bfaf9d6703ac5a5102657b28bf5d545b7e1ab25cff4f4b4f6da0cbaea4da7d58d9bb6dbab6c78997272b9b3b4d2cb950e02b9170eb633