c63d002506855885ef330524e7284a9c4b01ddb78f05db74f2dbfe6ab905190d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 19.8MB
Sample240628-sdaz4avejc
SHA256 c63d002506855885ef330524e7284a9c4b01ddb78f05db74f2dbfe6ab905190d
MD5 1e7360d144db1f0ff44b48114b1ff6b4
SHA1 e164a928226fc54535707069fee7f82b7a5b57cd
SHA512 f79aee721d7802c5aafbaf52e59a19f3360f00b6f3518f7daa99569118fcf7700c4aaba04a6398c1a7c2be4332bb83e19caaff3f1f7c50c9a7b460d77f5bfd6a
SSDEEP 196608:30bq45mmYPrOLaxhcFecFNOkX/Roslbo9KLD1B8NAJFq0eHH+tNJKAXkZ:kbq4o3jOLaeFDoCbL8NAJQ0e+tNUsk
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1736	JRWeb.exe

Loads dropped DLL 2 IoCs

pid	Process
2160	Setup.exe
1736	JRWeb.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2160	Setup.exe
2160	Setup.exe
1736	JRWeb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 1736	2160	Setup.exe	28
PID 2160 wrote to memory of 1736	2160	Setup.exe	28
PID 2160 wrote to memory of 1736	2160	Setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe
  C:\Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

90ffdec7

Path C:\Users\Admin\AppData\Local\Temp\90ffdec7
Size 8.2MB
SHA256 4f60f0dfbfc9671763edd75f3d0ff83b2782c3cf0ee15531f27890cf42ab0028
MD5 9b97e0eeeb2c72848b8364571aa3bea6
SHA1 a976cd15348f6caa5b013d16c7bfb89973601686
SHA512 62ee1d713aed80a8f7282fc9f86c05f4e9be202de8b356728b467b264d7a2715e4cf80ece8a2334f0440834bcf39407dd5fd48a097e5add612e1260a7d54e9c1
SSDEEP 196608:becFNOkX/Roslbo9KLD1B8NAJFq0eHH+tNJKAXQ:bFDoCbL8NAJQ0e+tNUsQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

butadiene.wav

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\butadiene.wav
Size 6.2MB
SHA256 09ff3222b2598b793f7081f8c3c20fe071b45cbdba1982997f1ae9c05c20957c
MD5 67aff9151292ba13adbbdbe84bef05fe
SHA1 c2766299f21528bdf1593ed4f849df1df1b10642
SHA512 a67122d5880dcd411a1143ba76d75604c592018bc90959360ac995b127c7204c93a68815ba823411d6b5e2ae961f76f7b9e6e11e4a572fe7b5aae598e4ff098a
SSDEEP 98304:/Y8/B/XJcypa0CmzBdwI1AIo7Qds/g/ZQ7dzMIL5iWSOLgxhnXH8P3jOumF:/Y8p5ZZ51+7Qds6KMOcWyxh3KCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfidy.svg

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\perfidy.svg
Size 65KB
SHA256 580209f46352f01b832c81a836e72d05819d33502f51bdda6212eefe0b7675d6
MD5 d7046da347cd1c24f9af82a326413734
SHA1 a8ecd6cd212e0b866ef9611bf07b6826262da0c4
SHA512 cd0327dce2c68ee800e204972a88afc30b59e93847a4837fb72ddb2ee0de73e40b8e4450d7f800d50adf239ee0bdf6a1818e21c05677d1893906fc898f59c9de
SSDEEP 1536:6bRFkD3NfbPK7VCUaPlm4M3V+J3X3qAeF3dCPVaGrQWKf/BHI:6bRF0dfToCUatm4S+9Y4P4Gr2Zo
MD5 SHA1 SHA512 SSDEEP

Submit Download

JRWeb.exe

Path \Users\Admin\AppData\Local\Temp\Hq_Control\JRWeb.exe
Size 1.1MB
SHA256 6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf
MD5 c047ae13fc1e25bc494b17ca10aa179e
SHA1 e293c7815c0eb8fbc44d60a3e9b27bd91b44b522
SHA512 0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c
SSDEEP 12288:a9hZPq27B7+x3dPC4gvgdVwTzDxsVyY4YoUwpf5kpRG6xsfJAYo2R0B5YD5sW91A:STS27B7+x3E4tdS/Dxkd4YoDfZ90gLS
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebView2Loader.dll

Path \Users\Admin\AppData\Local\Temp\Hq_Control\WebView2Loader.dll
Size 157KB
SHA256 4ae3f7437a6991db64eac8e5d2fa02e9edce56ad98aaa273006963fed39548a8
MD5 4a99cb402c0d843b61a83015e0d3d731
SHA1 ac59e7722c85fef8050a715e6f4c3a3e5085d98e
SHA512 1eceb6ff5f53a98e61f21c90de9242e46c9607817eeb7ce77f500a5b225e123ac52b357c7729b334063cd8c8b37c2fbe38e76c1a5ee77244b176aa3e08d7eb18
SSDEEP 3072:dr0B+bUXT4UPcGE91jkXmxyu1A14mRgo8JzeTIJEtcuVux4WurbzQrTvhr:djgj4UPBE9dGvW9mRmEtc+FLDWh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2160-0-0x0000000100000000-0x00000001013EE000-memory.dmp

Download

memory/2160-6-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

Download

memory/2160-8-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

Download

memory/2160-13-0x000007FEF6758000-0x000007FEF6759000-memory.dmp

Download

memory/2160-14-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

Download

memory/2160-17-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

Download

memory/2160-25-0x000007FEF6740000-0x000007FEF6898000-memory.dmp

Download