125f296c4f5617819ff56818e3b6c6e2cc463a994e7061a8a5fc58dd189ea3e3

Analysis

max time kernel
140s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 01:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WinHex.exe
Size

1.4MB
MD5

0bc48abad1ce6dc97a649e42f31d668f
SHA1

66b405640d43de81951e6202c2d7c239949ed6a6
SHA256

8fb578ca01388b5e2d6749418ee072d1b52a7c03e0aebcf0265f88f74d68e138
SHA512

a5f4ddfa5d9123b9705b77b8ca801e72bcadf30a6e8c380284f4ab5357ad02c88a31471e8c09b469d70d2158861cc793fb2c91303f183779727c5bb63bfed19d
SSDEEP

24576:3AmWVRjgsSykFQtV7GF/1JmbxEzl3trUuzOsGfO5hdOhPhvd9lWhM5GUMn0Tjl:qttV7m/Lm8tHMO5o5dzwUlTjl

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	WinHex.exe
File opened (read-only)	\??\Z:	WinHex.exe
File opened (read-only)	\??\W:	WinHex.exe
File opened (read-only)	\??\Q:	WinHex.exe
File opened (read-only)	\??\P:	WinHex.exe
File opened (read-only)	\??\K:	WinHex.exe
File opened (read-only)	\??\V:	WinHex.exe
File opened (read-only)	\??\O:	WinHex.exe
File opened (read-only)	\??\J:	WinHex.exe
File opened (read-only)	\??\G:	WinHex.exe
File opened (read-only)	\??\E:	WinHex.exe
File opened (read-only)	\??\Y:	WinHex.exe
File opened (read-only)	\??\U:	WinHex.exe
File opened (read-only)	\??\T:	WinHex.exe
File opened (read-only)	\??\N:	WinHex.exe
File opened (read-only)	\??\L:	WinHex.exe
File opened (read-only)	\??\X:	WinHex.exe
File opened (read-only)	\??\S:	WinHex.exe
File opened (read-only)	\??\R:	WinHex.exe
File opened (read-only)	\??\M:	WinHex.exe
File opened (read-only)	\??\H:	WinHex.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	helppane.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.whs\ = "WHSFile"	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\shell\\Command	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XFCFile\shell	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XFCFile\ = "X-Ways Forensics Case File"	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XFCFile\DefaultIcon	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHXFile\shell\Open\Command	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WHXFile\	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XFCFile\shell\Open\Command	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XFCFile	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WHXFile\shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winhex.exe\" \"%1\""	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XFCFile\shell\Open	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XFCFile\shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winhex.exe\" \"%1\""	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.whs	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\shell	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.whx	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHXFile\shell	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winhex.exe\",3"	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\shell\Command\ = "notepad.exe \"%1\""	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xfc\ = "XFCFile"	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XFCFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winhex.exe\",0"	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\shell\Open\Command	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WHXFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winhex.exe\",0"	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\shell\Open	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.whx\ = "WHXFile"	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHXFile	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHXFile\DefaultIcon	WinHex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winhex.exe\" \"%1\""	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHSFile\DefaultIcon	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WHXFile\shell\Open	WinHex.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xfc	WinHex.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2720	helppane.exe
Token: SeTakeOwnershipPrivilege	2720	helppane.exe
Token: SeTakeOwnershipPrivilege	2720	helppane.exe
Token: SeTakeOwnershipPrivilege	2720	helppane.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	helppane.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2292	WinHex.exe
2720	helppane.exe
2720	helppane.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2832	2292	WinHex.exe	30
PID 2292 wrote to memory of 2832	2292	WinHex.exe	30
PID 2292 wrote to memory of 2832	2292	WinHex.exe	30
PID 2292 wrote to memory of 2832	2292	WinHex.exe	30
PID 2292 wrote to memory of 2832	2292	WinHex.exe	30
PID 2292 wrote to memory of 2832	2292	WinHex.exe	30
PID 2292 wrote to memory of 2832	2292	WinHex.exe	30

C:\Users\Admin\AppData\Local\Temp\WinHex.exe
"C:\Users\Admin\AppData\Local\Temp\WinHex.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\winhlp32.exe
  winhlp32.exe -x
  2⤵
  PID:2832

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2292-13-0x0000000000280000-0x00000000002AB000-memory.dmp

Filesize
172KB

Download
memory/2292-12-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2292-16-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2292-19-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2292-23-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2292-25-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2292-29-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2292-31-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2292-35-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2292-37-0x0000000000400000-0x0000000000599000-memory.dmp

Filesize
1.6MB

Download
memory/2720-1-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/2720-18-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download