Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 04:35
Static task
static1
Behavioral task
behavioral1
Sample
d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe
Resource
win10v2004-20240226-en
General
-
Target
d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe
-
Size
73KB
-
MD5
ac28c2506b65cb361235bbd865300468
-
SHA1
7a3c782663b61a4d42101df0dec0191e1f51001d
-
SHA256
d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86
-
SHA512
75a980250886065070a1b8b8d07a7f18cec0f3d1f0df760a75b3edad83d00005f005ee09b1cb42f634c4be2ae40c66d41947c67d5e59edef6b236804a9bc8aa3
-
SSDEEP
1536:xU9NVM6oqQg9lOkOYmxCibH6n2VY7WMezC:e9NVDvlOrjxH6IYKMem
Malware Config
Signatures
-
Processes:
etcucos.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" etcucos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" etcucos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" etcucos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" etcucos.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
etcucos.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{484B554C-4249-4255-484B-554C42494255} etcucos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{484B554C-4249-4255-484B-554C42494255}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" etcucos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{484B554C-4249-4255-484B-554C42494255}\IsInstalled = "1" etcucos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{484B554C-4249-4255-484B-554C42494255}\StubPath = "C:\\Windows\\system32\\ummoarob.exe" etcucos.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
etcucos.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe etcucos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" etcucos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oxteatut.exe" etcucos.exe -
Executes dropped EXE 2 IoCs
Processes:
etcucos.exeetcucos.exepid process 2824 etcucos.exe 2872 etcucos.exe -
Loads dropped DLL 3 IoCs
Processes:
d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exeetcucos.exepid process 1896 d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe 1896 d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe 2824 etcucos.exe -
Processes:
etcucos.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" etcucos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" etcucos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" etcucos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" etcucos.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
etcucos.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} etcucos.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify etcucos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" etcucos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\oukroocoos.dll" etcucos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" etcucos.exe -
Drops file in System32 directory 9 IoCs
Processes:
etcucos.exed653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exedescription ioc process File opened for modification C:\Windows\SysWOW64\oxteatut.exe etcucos.exe File opened for modification C:\Windows\SysWOW64\ummoarob.exe etcucos.exe File created C:\Windows\SysWOW64\ummoarob.exe etcucos.exe File opened for modification C:\Windows\SysWOW64\oukroocoos.dll etcucos.exe File opened for modification C:\WINDOWS\SysWOW64\etcucos.exe d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe File created C:\WINDOWS\SysWOW64\etcucos.exe d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe File created C:\Windows\SysWOW64\oxteatut.exe etcucos.exe File created C:\Windows\SysWOW64\oukroocoos.dll etcucos.exe File opened for modification C:\WINDOWS\SysWOW64\etcucos.exe etcucos.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
etcucos.exeetcucos.exepid process 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2872 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe 2824 etcucos.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
etcucos.exedescription pid process Token: SeDebugPrivilege 2824 etcucos.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exeetcucos.exedescription pid process target process PID 1896 wrote to memory of 2824 1896 d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe etcucos.exe PID 1896 wrote to memory of 2824 1896 d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe etcucos.exe PID 1896 wrote to memory of 2824 1896 d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe etcucos.exe PID 1896 wrote to memory of 2824 1896 d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe etcucos.exe PID 2824 wrote to memory of 436 2824 etcucos.exe winlogon.exe PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 2872 2824 etcucos.exe etcucos.exe PID 2824 wrote to memory of 2872 2824 etcucos.exe etcucos.exe PID 2824 wrote to memory of 2872 2824 etcucos.exe etcucos.exe PID 2824 wrote to memory of 2872 2824 etcucos.exe etcucos.exe PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE PID 2824 wrote to memory of 1192 2824 etcucos.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:436
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe"C:\Users\Admin\AppData\Local\Temp\d653fac296997214eb2b59e5077fbe5c414e3bfd3c66dfbfee378ad2f3c75d86.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\WINDOWS\SysWOW64\etcucos.exe"C:\WINDOWS\SysWOW64\etcucos.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\WINDOWS\SysWOW64\etcucos.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2872
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
74KB
MD559fad3774f3da89504cdab9c73e79c81
SHA10dd80d48a9cb05fd47890ea872b158eda383cc95
SHA256bbda394c279036cce252b6cda5a9f27ff4060689087f625bb79174748657912e
SHA5129c81ce6d725cccecfee9682fbab55a038f0752f86d4ab4a4d3d49425c45dce704ce6be15d8e554510b4bdae940e2b8793c9af4d2003fa3dcccbe4d303f1fb255
-
Filesize
73KB
MD531a1a415b59042460c9833946a1ac29c
SHA188c1d7006993d1cf7297cdee531ba6ac1bc97e74
SHA2563209700e0bbb79f2bd969d6f88bae52af667f7ff522576b5855778003a2bf5dc
SHA512fb6ad7b18caf50815d2f1b5d08e01dd5cf1cbf27ee6fe23e0b9c9bcc75fc899a79e6d28886ebabe692908445686c0922814a032cda939894e1276e87ff712223
-
Filesize
71KB
MD5714728387675b76543e187d1d6863940
SHA180096027d69a6f2abad63ed3ce81b4d35f2eb1bb
SHA2562ce3773113d1a8b9341e16590c83dc96128727c38d45880de7b98112d6204e63
SHA512fd7972c99d901d8e340b9896807036fb6014fc80851307c777467ffdf05ed967a02b675e421ac3c0aed846fa92a703321c7acf7a8db959541c9195a1f96d0206