Overview

overview

10

Static

static

3

8ab5333e54...53.exe

windows7-x64

10

8ab5333e54...53.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 01:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8ab5333e54b83f7e920eb51d308b5a5fd6798ca530ef683ddf6360d5c10f3153.exe

  • Size

    1.3MB

  • MD5

    9da793b606f0e48141a94caa8eae97f9

  • SHA1

    f459ba585097b971445e92dae8077c4c60e1d7c7

  • SHA256

    8ab5333e54b83f7e920eb51d308b5a5fd6798ca530ef683ddf6360d5c10f3153

  • SHA512

    8d74a7fa050414e4d93f393a7253cfa23fd62de1fe424e574f6a96bc4be3a79664d3ff1473fe4807936b0105b24b836b98f39ce6c205088e815f1ec57032cba9

  • SSDEEP

    12288:iVgvmzFHi0mo5aH0qMzd5807FAPJQPDHvd:iVgvOHi0mGaH0qSdPFS4V

Score
10/10
defense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 3 IoCs
    persistence
  • UAC bypass 3 TTPs 12 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 29 IoCs
    persistence
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Executes dropped EXE 2 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
    defense_evasion
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • System policy modification 1 TTPs 36 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ab5333e54b83f7e920eb51d308b5a5fd6798ca530ef683ddf6360d5c10f3153.exe
    "C:\Users\Admin\AppData\Local\Temp\8ab5333e54b83f7e920eb51d308b5a5fd6798ca530ef683ddf6360d5c10f3153.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Adds policy Run key to start application
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Hijack Execution Flow: Executable Installer File Permissions Weakness
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\eflsr.exe
      "C:\Users\Admin\AppData\Local\Temp\eflsr.exe" "-"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Impair Defenses: Safe Mode Boot
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:1052
    • C:\Users\Admin\AppData\Local\Temp\eflsr.exe
      "C:\Users\Admin\AppData\Local\Temp\eflsr.exe" "-"
      2⤵
      • Modifies WinLogon for persistence
      • UAC bypass
      • Adds policy Run key to start application
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Hijack Execution Flow: Executable Installer File Permissions Weakness
      • System Location Discovery: System Language Discovery
      • System policy modification
      PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Impair Defenses

2
T1562

Disable or Modify Tools

1
T1562.001

Safe Mode Boot

1
T1562.009

Modify Registry

5
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\gbbcvvryzqbqhrxlqllmf.bij
    Filesize

    280B

    MD5

    a017fad19822e50cc015558cd8397641

    SHA1

    388fcbabd65289e11712ad3d9f017121df79c2e2

    SHA256

    cd7bb9dd7b15d6c4ab6eb3c0856d1d7579172ffde56213c66bf073e5c6643b45

    SHA512

    4bc3f04db81c72e15aa30fa7e0bf858d7cad254b89ff24b92a6346030383d7c97db595ae9834c8eec16e2c7f5ac3b7c335b58cfdbadc90bd50feb3ce292749fb

    Download Submit

  • C:\Program Files (x86)\gbbcvvryzqbqhrxlqllmf.bij
    Filesize

    280B

    MD5

    2d21da57fd9f39a8c7fc1ce2d4bfa7d2

    SHA1

    6f93eaede09488d0204e0231aaa9e405523f83b0

    SHA256

    be599804091fc662b6d9185116b53bf0af97abad03a4942e50bf3aa66910288e

    SHA512

    d677d8420fe7830af673271ef30e682e696da664057c1899ca89f0ebcb055cfb3abf8c602b4a681fab8db61e6d318e6d68d10777c6ab434bb37a2721b345adea

    Download Submit

  • C:\Program Files (x86)\gbbcvvryzqbqhrxlqllmf.bij
    Filesize

    280B

    MD5

    8316469f5270e459efc6c5ba0b8bfcff

    SHA1

    3ce56ea9e2acd84562ef78efe5c9efd19374c8e9

    SHA256

    53ce4e2681e36070d98da532802e6adc8f77342596d059e88f2b4d7f1c8eabca

    SHA512

    9ac096058eadaa55f6dfcad879d094c73e02b70456acdfa3a081bc5955c25e24ac6037d564f1d1870e3882c4dcafab669dfa58476fb2e048c6886250595b9581

    Download Submit

  • C:\Program Files (x86)\gbbcvvryzqbqhrxlqllmf.bij
    Filesize

    280B

    MD5

    5c43e238e2e22b69e84c2cceea6e2d2e

    SHA1

    1cbc1c35a59a3742204a4a0eb734f8def1825919

    SHA256

    d04340d8b3ca6d16d8477d5811df5e3dc93618f15cbb200d5830314b11c00c60

    SHA512

    624a0b14beaa65ef8d0c5f235f828c7eb75c2ccd14f0837862771c84418bccd8ce1f6d53eaa1e56b061569ec67be086dd81b6d5c43f35fbf998f05a03e21cee3

    Download Submit

  • C:\Users\Admin\AppData\Local\bhseitasegccezqpflwimxewikggidut.pam
    Filesize

    4KB

    MD5

    94ee2791bc6a0987b49fed38854c6a09

    SHA1

    a295eb3e0bf0bf434ce06b0300b411d7a592a6c0

    SHA256

    71a1e63771589d23b8e60f27f6788f1d4b9a3bbed3dee919e1609b6af4bb061f

    SHA512

    c490d8bfb4c5e7728608cf7287713476575da1e6a94e42f04b9610bfd125af12fff44516f5df6b18502a0f9aa954e53d8cd316f3df09728f209a020535350e50

    Download Submit

  • C:\Users\Admin\AppData\Local\gbbcvvryzqbqhrxlqllmf.bij
    Filesize

    280B

    MD5

    0650e2c70dd6ac3abf71b94c109cf11e

    SHA1

    a6d83637f928c69cd0e442f65fcb65d9f649d618

    SHA256

    b07f390da3716905766796ded9497b7eaf0d476bf7123c4736b5b0aa4e29d8d5

    SHA512

    b9c0d896bfd2ba80683af7443b029d9723e8506d93493aef5c5c7c2fa391f4bdc5bb0534ca2effef782e5167293ddfd987345d3f6dceea7125f281c9c74ffebf

    Download Submit

  • \Users\Admin\AppData\Local\Temp\eflsr.exe
    Filesize

    2.0MB

    MD5

    9043992b68e3bdcaac3a0db18398136b

    SHA1

    bd3169b77bf74f2fdb1b3b6c4dd9939fa588992d

    SHA256

    d5cf9c2f13d5fabf5460b3093b984b93b7919a657d0ad78c5ce504abf2756d88

    SHA512

    76a0d73a0ce542bf2e2c1374acc3c7d3a8a1662a6d10585dc1cd4a23d5b22d7672b1a37fbb7c32b93ffd9fd4ae4344de40435ee07b3cdcb35ea4fd53fec24374

    Download Submit