db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b

Analysis

max time kernel
147s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe
Size

688KB
MD5

80f40ba8fb792a8debc98fa0e17c5703
SHA1

f3a540f3f0eaa335ab06d4187f724f7d5d69ea62
SHA256

db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b
SHA512

c66a882063e9799ea02ac57536d4f77b8dd3fe357a9d09d052eb9340c94d03ea11ce02a72af1f7ba031789da450c3454799a8625368cf74a77428de96a39a644
SSDEEP

3072:4eGOMNYPDeGRieGOMNYPDeGRieGOMNYPDeGRieGOMNYPDeGR3:4zYrnizYrnizYrnizYrn3

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	NTDETECT.EXE

Executes dropped EXE 1 IoCs

pid	Process
2988	NTDETECT.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\WINDOWS.EXE"	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AVG = "C:\\WINDOWS.EXE"	NTDETECT.EXE

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	NTDETECT.EXE
File opened (read-only)	\??\B:	NTDETECT.EXE
File opened (read-only)	\??\E:	NTDETECT.EXE

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\KlampokChild.616	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2876	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2876	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe
2988	NTDETECT.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2988	2876	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe	28
PID 2876 wrote to memory of 2988	2876	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe	28
PID 2876 wrote to memory of 2988	2876	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe	28
PID 2876 wrote to memory of 2988	2876	db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe	28

C:\Users\Admin\AppData\Local\Temp\db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe
"C:\Users\Admin\AppData\Local\Temp\db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- \??\c:\NTDETECT.EXE
  c:\NTDETECT.EXE
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:2988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\NTDETECT.EXE

Filesize
688KB

MD5
80f40ba8fb792a8debc98fa0e17c5703

SHA1
f3a540f3f0eaa335ab06d4187f724f7d5d69ea62

SHA256
db1c836306ca113b9167ddae600f1e9c37b2d743038dbb344dfec45e5d54dc7b

SHA512
c66a882063e9799ea02ac57536d4f77b8dd3fe357a9d09d052eb9340c94d03ea11ce02a72af1f7ba031789da450c3454799a8625368cf74a77428de96a39a644

Download Submit
memory/2876-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/2876-9-0x00000000026E0000-0x000000000270D000-memory.dmp

Filesize
180KB

Download
memory/2876-14-0x00000000026E0000-0x000000000270D000-memory.dmp

Filesize
180KB

Download
memory/2876-17-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download