Analysis
- max time kernel
120s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
09/11/2024, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe
Resource
win7-20241023-en
windows7-x64
13 signatures
120 seconds
Behavioral task
behavioral2
Sample
6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
- Target 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe
- Size 80KB
- Sample241109-1885dawnhm
- SHA256 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512
- MD5 adfa594684568ea21cd3637e0490e3d0
- SHA1 5b12c792de6b8398029ba6d2d60825fc08a77665
- SHA512 9eb1b95e44a9c74145abcee2cc5a7e83d636c1680d8f5563ce1003cab11255137299de9da389a62dce0fcc8bfa598f66e65ef93da81180eaf7c8288c8e7aa8d2
- SSDEEP 1536:BteqGDlXvCDB04f5Gn/L8ZlALNtnd17i9wh:Olg35GTclABtnDi9wh
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ortifim-toab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ortifim-toab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ortifim-toab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ortifim-toab.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53504445-424a-5748-5350-4445424A5748} ortifim-toab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53504445-424a-5748-5350-4445424A5748}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ortifim-toab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53504445-424a-5748-5350-4445424A5748}\IsInstalled = "1" ortifim-toab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{53504445-424a-5748-5350-4445424A5748}\StubPath = "C:\\Windows\\system32\\tpuhex.exe" ortifim-toab.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ortifim-toab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ortifim-toab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\oulpoguv.exe" ortifim-toab.exe - Executes dropped EXE 2 IoCs
pid Process 3968 ortifim-toab.exe 4604 ortifim-toab.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ortifim-toab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ortifim-toab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ortifim-toab.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ortifim-toab.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger ortifim-toab.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ortifim-toab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ortifim-toab.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ortifim-toab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ortifim-toab.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\lsamud.dll" ortifim-toab.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\oulpoguv.exe ortifim-toab.exe File opened for modification C:\Windows\SysWOW64\lsamud.dll ortifim-toab.exe File created C:\Windows\SysWOW64\lsamud.dll ortifim-toab.exe File opened for modification C:\Windows\SysWOW64\ortifim-toab.exe 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe File opened for modification C:\Windows\SysWOW64\oulpoguv.exe ortifim-toab.exe File created C:\Windows\SysWOW64\tpuhex.exe ortifim-toab.exe File opened for modification C:\Windows\SysWOW64\ortifim-toab.exe ortifim-toab.exe File created C:\Windows\SysWOW64\ortifim-toab.exe 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe File opened for modification C:\Windows\SysWOW64\tpuhex.exe ortifim-toab.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ortifim-toab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ortifim-toab.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 4604 ortifim-toab.exe 4604 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe 3968 ortifim-toab.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 832 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe Token: SeDebugPrivilege 3968 ortifim-toab.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 832 wrote to memory of 3968 832 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe 83 PID 832 wrote to memory of 3968 832 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe 83 PID 832 wrote to memory of 3968 832 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe 83 PID 3968 wrote to memory of 616 3968 ortifim-toab.exe 5 PID 3968 wrote to memory of 4604 3968 ortifim-toab.exe 84 PID 3968 wrote to memory of 4604 3968 ortifim-toab.exe 84 PID 3968 wrote to memory of 4604 3968 ortifim-toab.exe 84 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56 PID 3968 wrote to memory of 3504 3968 ortifim-toab.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe"C:\Users\Admin\AppData\Local\Temp\6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512N.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\ortifim-toab.exe"C:\Windows\system32\ortifim-toab.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\ortifim-toab.exe--k33p4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4604
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\lsamud.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ortifim-toab.exe
- Size 80KB
- SHA256 6b3d5d03ea6a89ea1d52b1f2d66140c8eaff6a0b22036823c6a0ea5dbcfa8512
- MD5 adfa594684568ea21cd3637e0490e3d0
- SHA1 5b12c792de6b8398029ba6d2d60825fc08a77665
- SHA512 9eb1b95e44a9c74145abcee2cc5a7e83d636c1680d8f5563ce1003cab11255137299de9da389a62dce0fcc8bfa598f66e65ef93da81180eaf7c8288c8e7aa8d2
- SSDEEP 1536:BteqGDlXvCDB04f5Gn/L8ZlALNtnd17i9wh:Olg35GTclABtnDi9wh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\oulpoguv.exe
- Size 84KB
- SHA256 7ffeec377e8d3f96d599ef8a7ddee04cd4c21bf64ee9c2d69a70b3717f3abb3a
- MD5 6967a1b46e7ad1b43dc02a638340b284
- SHA1 c0b4f7715cddf056c019dc58a652b0ec0db67318
- SHA512 407ae485d4089771b5f5de857e6a76c8c0d2215ebb4c6c374c1333dd8e5405fdc5f6aa7be9a82a99780a12fbe473f1ee4045b80c1e45de8a11ad94e55088e77d
- SSDEEP 1536:1YA56h4XCr4FQ1qOFufvaxsYK2Y1DHK2Fs6UDhDZFSLHLVmIy0b:+i6aQR0XLp1Dqb6UDhDZFSLHLVkU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\tpuhex.exe
- Size 83KB
- SHA256 45974a12928b02bffe6d3c6c008072490c3e02a6d75585e3179af971c41956a1
- MD5 a15a25950700aa6cb2f9ac8cd2f97a18
- SHA1 5a549a70c34de0b483aea5f0f6069188532bc02d
- SHA512 8442984ac5ca96f5560d48098a7158bd59a07bcd188537386c14e8dd48cf8863fd152ffb95ff2b9c12e885b2db918f03224e5ad9d5bd7f621543d0185fe69821
- SSDEEP 1536:xZA56h4XCr4FQ1qOFufvaxsYK2Y1DHK2Fs6UDhDZFSLHLVmIy0G:Hi6aQR0XLp1Dqb6UDhDZFSLHLVkF
- MD5 SHA1 SHA512 SSDEEP