Overview
overview
10Static
static
10Img.exe
windows7-x64
3Img.exe
windows10-2004-x64
3setup_akl.exe
windows7-x64
10setup_akl.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3AKV.exe
windows7-x64
3AKV.exe
windows10-2004-x64
3POL.dll
windows7-x64
3POL.dll
windows10-2004-x64
3POL.exe
windows7-x64
6POL.exe
windows10-2004-x64
6POL.dll
windows7-x64
3POL.dll
windows10-2004-x64
3POL.dll
windows7-x64
3POL.dll
windows10-2004-x64
3POL.chm
windows7-x64
1POL.chm
windows10-2004-x64
1POL.exe
windows7-x64
6POL.exe
windows10-2004-x64
6Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7qs.html
windows7-x64
3qs.html
windows10-2004-x64
3Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2025, 01:34
Behavioral task
behavioral1
Sample
Img.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Img.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
setup_akl.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
setup_akl.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
AKV.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
AKV.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
POL.dll
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
POL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
POL.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
POL.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
POL.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
POL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
POL.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
POL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
POL.chm
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
POL.chm
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
POL.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
POL.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Uninstall.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
Uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
qs.html
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
qs.html
Resource
win10v2004-20241007-en
General
-
Target
POL.exe
-
Size
14KB
-
MD5
4687a64503f962915cd278baada57449
-
SHA1
ef42ea6ac10a1eff3b8ccea7194e4bdcaf18f6bb
-
SHA256
2660a6af939bf1e32391c5ef13afb14ee65a6bd866d4b152e7f5db6747d7a67c
-
SHA512
0aa67de3ce116f2d0c4f5d43da8aceee4802272feeae5e018e0dc653eb6f609a786e2f40df4e9102ee9f1e199831aaa021fd4c50960d83568eb2f87cb8f0b7f8
-
SSDEEP
384:Hy7jAinxMexPlOXA5ChIcotxMqEhCa0TUVBKuK:Hy7jAinxLAWC5sfjTUVBKR
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\POL Agent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\POL.exe" POL.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language POL.exe -
Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\TypeLib\ = "{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}" POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\Version\ = "3.0" POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\ = "NATUPnP 1.0 Type Library" POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\FLAGS\ = "0" POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\ProgID POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\Version POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\0\win32\ POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\FLAGS\ POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\Version\ POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\InProcServer32\ POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\ POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\TypeLib\ POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\VersionIndependentProgID\ = "Msxml2.SAXAttributes" POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\0 POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\0\ POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\hnetcfg.dll\\2" POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\InProcServer32\ = "%SystemRoot%\\SysWow64\\msxml3.dll" POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0 POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4} POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\ POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\TypeLib POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62} POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\ProgID\ POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\0\win32 POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5DE923F8-9DF7-7C76-9DFA-1B5ED4798ED4}\1.0\FLAGS POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\VersionIndependentProgID\ POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\ = "Codovo.Nexihviz.Magefaki class" POL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\ProgID\ = "Msxml2.SAXAttributes.3.0" POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\InProcServer32 POL.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98624181-D062-4BEE-7AA1-4214C7295A62}\VersionIndependentProgID POL.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2520 POL.exe Token: SeIncBasePriorityPrivilege 2520 POL.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2520 POL.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2520 POL.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2520 POL.exe 2520 POL.exe 2520 POL.exe 2520 POL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\POL.exe"C:\Users\Admin\AppData\Local\Temp\POL.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2520