Overview

overview

10

Static

static

10

307abb12c6...d7.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    52s
  • max time network
    23s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-02-2025 13:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    307abb12c62dd8421cedfe6a11475e742caaae82faf9cb14d9812772edefe8d7.exe

  • Size

    5.6MB

  • MD5

    f659a0d8ebd02ee8ee6eb70cef397cd7

  • SHA1

    78c4038cd147d6e14cb0255e7ff170d477e9eca4

  • SHA256

    307abb12c62dd8421cedfe6a11475e742caaae82faf9cb14d9812772edefe8d7

  • SHA512

    ae5275a56c782960d7d3efdd32d8458300b763114d040723b363f51dbd77ae6e371ef3d4081745feac202890284c77ddf8e796289a473eb43b998172b6eaddb9

  • SSDEEP

    98304:AUd98EKniqMUs8RVe0jHs4+b4EmeICxgHxC6qz1loJoYFqQ5dn6uqhAoCVtxnz+C:F8sn+RVJM44YCxwxmzLOFfdrq+P/xnCC

Score
10/10
hijackloaderdiscoveryloader

Malware Config

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

    loaderhijackloader
  • Hijackloader family
    hijackloader
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 59 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\307abb12c62dd8421cedfe6a11475e742caaae82faf9cb14d9812772edefe8d7.exe
    "C:\Users\Admin\AppData\Local\Temp\307abb12c62dd8421cedfe6a11475e742caaae82faf9cb14d9812772edefe8d7.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:900
  • C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1228
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2900
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      2⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4216
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2004

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/900-0-0x0000000000400000-0x0000000000561000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/900-1-0x0000000074710000-0x000000007488D000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/4216-2-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-4-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-3-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-14-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-13-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-12-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-11-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-10-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-9-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4216-8-0x000001CBD5C00000-0x000001CBD5C01000-memory.dmp

      Filesize

      4KB

      Download