Overview

overview

10

Static

static

3

18fe37fd8b...7N.exe

windows7-x64

10

18fe37fd8b...7N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 18:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    18fe37fd8b64145b123d5b9498ebc1ee36116e4e9c58e02293f273fdc7957277N.exe

  • Size

    1016KB

  • MD5

    033277c330873b005d0b593011a48780

  • SHA1

    e37535d32d6a8104d33107d39a1e93685bfe5117

  • SHA256

    18fe37fd8b64145b123d5b9498ebc1ee36116e4e9c58e02293f273fdc7957277

  • SHA512

    80435c29cbc80d99829511fc3c9b1819ad2f1f21c36e450b80854ba24d13a4583d43348ef155f7c369fce4bdb4585350640100fc76477ce56e95cb4b810568b2

  • SSDEEP

    6144:BIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUB:BIXsgtvm1De5YlOx6lzBH46U

Score
10/10
defense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • UAC bypass 3 TTPs 12 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 24 IoCs
    persistence
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 4 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 25 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 34 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\18fe37fd8b64145b123d5b9498ebc1ee36116e4e9c58e02293f273fdc7957277N.exe
    "C:\Users\Admin\AppData\Local\Temp\18fe37fd8b64145b123d5b9498ebc1ee36116e4e9c58e02293f273fdc7957277N.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Users\Admin\AppData\Local\Temp\avbhxuykkfl.exe
      "C:\Users\Admin\AppData\Local\Temp\avbhxuykkfl.exe" "c:\users\admin\appdata\local\temp\18fe37fd8b64145b123d5b9498ebc1ee36116e4e9c58e02293f273fdc7957277n.exe*"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1060
      • C:\Users\Admin\AppData\Local\Temp\ittaen.exe
        "C:\Users\Admin\AppData\Local\Temp\ittaen.exe" "-C:\Users\Admin\AppData\Local\Temp\upzqexsfqijjufac.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • System policy modification
        PID:652
      • C:\Users\Admin\AppData\Local\Temp\ittaen.exe
        "C:\Users\Admin\AppData\Local\Temp\ittaen.exe" "-C:\Users\Admin\AppData\Local\Temp\upzqexsfqijjufac.exe"
        3⤵
        • Modifies WinLogon for persistence
        • UAC bypass
        • Adds policy Run key to start application
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Hijack Execution Flow: Executable Installer File Permissions Weakness
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Safe Mode Boot

1
T1562.009

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\zdwwtvzvpqajdxbmeehle.bdh
    Filesize

    280B

    MD5

    e42c045839f151ab09163b2849c1e806

    SHA1

    b67c67305a7da29f85df309132246c039b06b2f2

    SHA256

    d7bebf53b989ba410089ad990777f08a8e3cb170c7780454bda2efbdab881332

    SHA512

    cbba511279713c7533a7121e44a824a3720213136f9b8ad33644c590194dccad2a11f392c00b94d7e9043ef962b9378fddf5e0261d61b7568fe3b0a0d1fe0adc

    Download Submit

  • C:\Program Files (x86)\zdwwtvzvpqajdxbmeehle.bdh
    Filesize

    280B

    MD5

    b990a2748f4b88cedb0798ed57a6226f

    SHA1

    59d8f66f264365064fd73e524553082a812f267c

    SHA256

    62a03424bc4f48dbde3b6bdca5e36087e2762a29f6af10de285ace6e0ff89c95

    SHA512

    597b198617768f12512dbfe6ba4666de441b21f9678c8f9ca25856655a48d4f5a9386961c2df5b48944f20c38be42325d9e29b6a8c2c8f3ac329b93c954f916f

    Download Submit

  • C:\Program Files (x86)\zdwwtvzvpqajdxbmeehle.bdh
    Filesize

    280B

    MD5

    053844bf897e705c9cc613c8696c0842

    SHA1

    89bc7e386817b46125a38dfdc1d69648fa036cf5

    SHA256

    a3978fc29ce6d6b9cf4fc78b98a7e166fccf6253132cd50e17639dfa40b9a1a1

    SHA512

    f61733e7ae1a4a0778495294ffeb027a368a0d5dd2229d4c9c6d9935b79e6d7b6bac1212946cdb5fd2a8320717be33fed0eeda20917bd26dcabc7f69247dc6db

    Download Submit

  • C:\Program Files (x86)\zdwwtvzvpqajdxbmeehle.bdh
    Filesize

    280B

    MD5

    c927b322707276829d4f83abbf4fa3b6

    SHA1

    001ebdadbceebf8106f67bb696b084ed5dc37724

    SHA256

    a6d6aeb022e335e3793687cb399e1d3491003165a9d37750c1828d57979b4132

    SHA512

    a69e001402c0dadc543157f05550b46977dab75e41c222456cc8d842b2a1f4ba930570fc336735af495b0f01c08b75f0fd4b282f3eb3aec0f1ca1e1ac926de7a

    Download Submit

  • C:\Program Files (x86)\zdwwtvzvpqajdxbmeehle.bdh
    Filesize

    280B

    MD5

    3bec04f9ba094b0d0d2d08fccda858c1

    SHA1

    83c72dbbba728596dd93e6f8b36f3d442cfd40ab

    SHA256

    150a8bb072c6b2aae5ef37cc7c5f2f292956af885075d378c1584e76fc133894

    SHA512

    125394a348a0f64084e75c2cfa4c0951132ec1a980f81eb72308a1c610279902d6ca8a8ec8184071f001c0cb169aecbccaf6a90144e6741dc7b1230e0aefce31

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\avbhxuykkfl.exe
    Filesize

    320KB

    MD5

    cf1fbf7a36a088cc9a6e996cf91421f2

    SHA1

    3add43d0e6d9ce15599bfcc4f0f37413eb124e98

    SHA256

    47acd9b1f38538ca3445d837c1a26f99046bb4f443a1023a810ff5c190d7b1ff

    SHA512

    8cd569ced88e849d3b4c80f607cd1ae21fe6f9b0b4c7d327fc574f98a511f006363d45b0da28e5fc7c20494671edae9003e695d5883a4a774e160654214589ff

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ittaen.exe
    Filesize

    708KB

    MD5

    8952b6682b1cc6734c500eea2e76cc03

    SHA1

    b2996bafbfedc7b91ea322f0883478be7f0af9bd

    SHA256

    0459704bf200f2d7efc873020d46654b7cd934fd7d27ea96f689f0776c7a740b

    SHA512

    576d12ef027acea64a7e9919c881f6906ed94b069970836e911e0e4beb6be085caea574d236488cc907e375105e1b8962342a1a663ecb9e4118963ee4cfa7caa

    Download Submit

  • C:\Users\Admin\AppData\Local\ujnygtipugbvafuqteshlwergnseztyd.orc
    Filesize

    4KB

    MD5

    b385d624f219b74bc99f5d46f7e3ed1c

    SHA1

    d2b00bd9c033bd4eff3a61290f9ee5e74c3b9529

    SHA256

    44213c4a353591ea11c53e5033e8b9f18003e7f9066cbbf620aa53a4bd577eaa

    SHA512

    1d6fd8991f37d67bfd64705f97c9f1a58f2033034edbedb3f5d2611bb7dfcdf3e4206d629935ff37e6bed959e7acf69504c09b859123121c0e7ebf56df381e16

    Download Submit

  • C:\Users\Admin\AppData\Local\zdwwtvzvpqajdxbmeehle.bdh
    Filesize

    280B

    MD5

    e061f70581af6a5128ea572de6347545

    SHA1

    d98db62407a6b0ad9cb6db063e0b584414331bbd

    SHA256

    b6259aaaca0087024bd091e6d468548e7547b5a2eb1f35368adc457b3d38bbfa

    SHA512

    c0ae8ae81e86fadc43efb9e9d9aebf4180d39208916917195b6e2a9ae8f5722810b5c11334349d0c17458b247c7b377bb53e0e081c5579d2a961c77147b4259f

    Download Submit

  • C:\Windows\SysWOW64\khtmcxujwqtvivswha.exe
    Filesize

    1016KB

    MD5

    033277c330873b005d0b593011a48780

    SHA1

    e37535d32d6a8104d33107d39a1e93685bfe5117

    SHA256

    18fe37fd8b64145b123d5b9498ebc1ee36116e4e9c58e02293f273fdc7957277

    SHA512

    80435c29cbc80d99829511fc3c9b1819ad2f1f21c36e450b80854ba24d13a4583d43348ef155f7c369fce4bdb4585350640100fc76477ce56e95cb4b810568b2

    Download Submit