a7ae40544682a27bb1837c0c5d99f417bb4b8e8036e851529fe49a3d507a570b

Resubmissions

25/05/2025, 19:50

250525-ykd8zswk1210

16/05/2025, 17:00

250516-vjaydsdj7t10

28/03/2025, 18:22

250328-w1brpa1pv210

28/03/2025, 17:54

250328-whdtbsy1d110

Analysis

max time kernel
899s
max time network
898s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
16/05/2025, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
babv.exe
Size 29KB
Sample250516-vjaydsdj7t
SHA256 a7ae40544682a27bb1837c0c5d99f417bb4b8e8036e851529fe49a3d507a570b
MD5 85e61aaafe402f7a04e793a53288a072
SHA1 e8d088224025f54c58fa11e8b9835fa7dfd3b9ff
SHA512 cbfd7413fa3373e4c947c35b9605c1dade7159de0990f0961eef2bc4e2dc5e06b2e8cef974f9ada76951732a74d715c84d22e58c7dd1a841eab0e3096cc36511
SSDEEP 384:tBs/hl7b1/JEI+GPWrb5hFEaemqD6CLeQTGBsbh0w4wlAokw9OhgOL1vYRGOZz/L:t47bXEI+GevhEsqdLe3BKh0p29SgR5d
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1564	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2044	Trojan.exe
4592	Trojan.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	babv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330179853-1108322181-418488014-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe
2044	Trojan.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2044	Trojan.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	Trojan.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 2044	4840	babv.exe	78
PID 4840 wrote to memory of 2044	4840	babv.exe	78
PID 4840 wrote to memory of 2044	4840	babv.exe	78
PID 2044 wrote to memory of 1564	2044	Trojan.exe	79
PID 2044 wrote to memory of 1564	2044	Trojan.exe	79
PID 2044 wrote to memory of 1564	2044	Trojan.exe	79
PID 5580 wrote to memory of 4592	5580	cmd.exe	83
PID 5580 wrote to memory of 4592	5580	cmd.exe	83
PID 5580 wrote to memory of 4592	5580	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\babv.exe
"C:\Users\Admin\AppData\Local\Temp\babv.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\Trojan.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" ..
1⤵
- Suspicious use of WriteProcessMemory
PID:5580
- C:\Users\Admin\AppData\Local\Temp\Trojan.exe
  C:\Users\Admin\AppData\Local\Temp\Trojan.exe ..
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4592

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:896

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1688

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4919ba6e-59a6-4d20-b371-a5651e4da617.down_data

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\4919ba6e-59a6-4d20-b371-a5651e4da617.down_data
Size 555KB
SHA256 855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
MD5 5683c0028832cae4ef93ca39c8ac5029
SHA1 248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA512 aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
SSDEEP 6144:m4W6OWkK0An6PtQ3VG7Gz3AW/ZPfMKUPIbs7aGU4toNNQQPi/+sMT/TtpNkppXsb:hW6O/k1zQWZz/QtGo2saBKZIxWoOu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trojan.exe

Path C:\Users\Admin\AppData\Local\Temp\Trojan.exe
Size 29KB
SHA256 a7ae40544682a27bb1837c0c5d99f417bb4b8e8036e851529fe49a3d507a570b
MD5 85e61aaafe402f7a04e793a53288a072
SHA1 e8d088224025f54c58fa11e8b9835fa7dfd3b9ff
SHA512 cbfd7413fa3373e4c947c35b9605c1dade7159de0990f0961eef2bc4e2dc5e06b2e8cef974f9ada76951732a74d715c84d22e58c7dd1a841eab0e3096cc36511
SSDEEP 384:tBs/hl7b1/JEI+GPWrb5hFEaemqD6CLeQTGBsbh0w4wlAokw9OhgOL1vYRGOZz/L:t47bXEI+GevhEsqdLe3BKh0p29SgR5d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Trojan.exe.tmp

Path C:\Users\Admin\AppData\Local\Temp\Trojan.exe.tmp
Size 33B
SHA256 80de74995ae320ec9800438db200ae3a2b2974cfcc953a8c4b2d4f3bc964deec
MD5 96a280bcff7963785833b878cb477165
SHA1 63383695f05953e46b4ddb2b8afcc8f0e07f79bd
SHA512 91a59aee549efda9e9da2d4c812e50a1de3011b15dd68f299e33338b10c3c798a93a70bbbd2affb1a7baa7d789e55a1a783c485f134c1ea920be394c8b5a40d6
MD5 SHA1 SHA512

Submit Download

memory/2044-13-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/2044-14-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/2044-19-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/4592-16-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/4592-18-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/4840-0-0x0000000074C81000-0x0000000074C82000-memory.dmp

Download

memory/4840-1-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/4840-2-0x0000000074C80000-0x0000000075231000-memory.dmp

Download

memory/4840-12-0x0000000074C80000-0x0000000075231000-memory.dmp

Download