Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe
Resource
win7-20240903-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe
-
Size
70KB
-
MD5
e5eb7a28de47cc97a9f8a729f6101b39
-
SHA1
b2bb5d627fec1e52f10f13ef05d0c3d7e80704c9
-
SHA256
034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1
-
SHA512
cf4084e650cde5c179164044b9c677cb63f0381446342402f7130ee0ba034d252d6525ddc4f10d9bb78fd9ad572d82d258046d522d3369b2dc8b0af4dd83dd2b
-
SSDEEP
1536:x0PMkmQgitNDBThJz0J+TdrIreROg/pP0F3UgOkFDWI5wz:XkmQ9tNdThJIJ+ea8WpwUgOyDC
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" eafguroh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" eafguroh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" eafguroh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" eafguroh.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A514142-4f50-5745-5A51-41424F505745} eafguroh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A514142-4f50-5745-5A51-41424F505745}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" eafguroh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A514142-4f50-5745-5A51-41424F505745}\IsInstalled = "1" eafguroh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5A514142-4f50-5745-5A51-41424F505745}\StubPath = "C:\\Windows\\system32\\ouxtoasoom-eahor.exe" eafguroh.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\dmagut.exe" eafguroh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe eafguroh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" eafguroh.exe -
Executes dropped EXE 2 IoCs
pid Process 2736 eafguroh.exe 2932 eafguroh.exe -
Loads dropped DLL 3 IoCs
pid Process 2688 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe 2688 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe 2736 eafguroh.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" eafguroh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" eafguroh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" eafguroh.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" eafguroh.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger eafguroh.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" eafguroh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} eafguroh.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify eafguroh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" eafguroh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\etvedeh-deas.dll" eafguroh.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\eafguroh.exe 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe File created C:\Windows\SysWOW64\ouxtoasoom-eahor.exe eafguroh.exe File opened for modification C:\Windows\SysWOW64\ouxtoasoom-eahor.exe eafguroh.exe File opened for modification C:\Windows\SysWOW64\etvedeh-deas.dll eafguroh.exe File created C:\Windows\SysWOW64\etvedeh-deas.dll eafguroh.exe File opened for modification C:\Windows\SysWOW64\eafguroh.exe eafguroh.exe File opened for modification C:\Windows\SysWOW64\eafguroh.exe 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe File opened for modification C:\Windows\SysWOW64\dmagut.exe eafguroh.exe File created C:\Windows\SysWOW64\dmagut.exe eafguroh.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eafguroh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2932 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe 2736 eafguroh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2736 eafguroh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2736 2688 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe 30 PID 2688 wrote to memory of 2736 2688 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe 30 PID 2688 wrote to memory of 2736 2688 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe 30 PID 2688 wrote to memory of 2736 2688 034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe 30 PID 2736 wrote to memory of 428 2736 eafguroh.exe 5 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 2932 2736 eafguroh.exe 31 PID 2736 wrote to memory of 2932 2736 eafguroh.exe 31 PID 2736 wrote to memory of 2932 2736 eafguroh.exe 31 PID 2736 wrote to memory of 2932 2736 eafguroh.exe 31 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21 PID 2736 wrote to memory of 1208 2736 eafguroh.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:428
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe"C:\Users\Admin\AppData\Local\Temp\034e4bab6ab3be79e291f21c884ebe162b2fcd2747ec0c00e30e1c0ea4ba70e1.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\eafguroh.exe"C:\Windows\SysWOW64\eafguroh.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\eafguroh.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2932
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD5488764e0207b7c81bfa0a9382354b8e1
SHA1d9a91c6010911732caae3813be61300cf7994793
SHA256e3bbf40d870fec6960c31578e6a5f832aecbb4540661e7aa62b4246759949a07
SHA51223186914c7fd7c243e6758d9ee41bb0f958b4e1ccb7e66a64c36988efbf96ecc40224fdd7dd88e8d28507b6e7d089cda5ab4d48a5220e5d9f71681e559128337
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
70KB
MD574057555f41a633040f7e1a697ef8338
SHA180d4678520e1e2a7888820cd9968ef9309ceafa9
SHA2564c96ff6594d9208a79b3a15a34f80308cb791dc189163b8d4da985ddee4982eb
SHA5122db41e47a5898602b080e6aca56392da43f8a89f70749ac07dd34e13dd3806593b87e092486c32dfe1b33b192dbc6a6183e96d2de08b69d1851aa2fb13adeb11
-
Filesize
68KB
MD57c79e157f709cd482295cb61bcc4823d
SHA1818c370a17518c0928cc810c2db8e99d1b2cc4f4
SHA2560168b19d338e0daf78610934ee6832da2d655d8e43a05b096f4a3af2ebcc274d
SHA512ec7f8fa2897597600e4f57941f50bfade07c0c419bae1acb9968682e4f2ce0138a480344618a660845b554903ca19e5bd1572e4dbdbba65949c26d42dfea410d