cc566b6bc4da449a0c8eeb8c52c6503e14b3405b8ee409e57eb9269e9952b7e7

General

Target
hookloader12.exe
Size 148KB
Sample260503-mk2thaft9s
SHA256 cc566b6bc4da449a0c8eeb8c52c6503e14b3405b8ee409e57eb9269e9952b7e7
MD5 e8230cc80234a7c83f1ea1f31533de3a
SHA1 ed561396a0fe3b043e89fa1296a946549a1dcbaf
SHA512 e73a211a1400dfc497bd22d035d7347266a2791aef2b32220c97da736a8b8f03aa68dbec3077d975085e7dd4654334eabddb7f1c0729f9dab1b29a206dac0290
SSDEEP 768:RVZFcmU/cX1uToHtkS1ChL4dP6h09xopv8Jaw7qeugl+lxRIT1dfcR92l0OZG/3E:jZFcZnxBQ080wWgl+lxRIPfk60N3hm
TLSH
T1E8E34A26DE15547FE2A9D578CA430D85DE32BC8A4791ABCF17804DE60EA67C09F3E302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5028	hookloader12.exe

Executes dropped EXE 1 IoCs

pid	Process
1424	ox_1777804336437.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	hookloader12.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	hookloader12.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	hookloader12.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	hookloader12.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	hookloader12.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	hookloader12.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	hookloader12.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	hookloader12.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	hookloader12.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	hookloader12.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	hookloader12.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	hookloader12.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5028	hookloader12.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5028	hookloader12.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 6032	5028	hookloader12.exe	89
PID 6032 wrote to memory of 1424	6032	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\hookloader12.exe
"C:\Users\Admin\AppData\Local\Temp\hookloader12.exe"
1⤵
- Downloads MZ/PE file
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\cmd.exe
  /c start C:\Users\Admin\AppData\Local\Temp\ox_1777804336437.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Users\Admin\AppData\Local\Temp\ox_1777804336437.exe
    C:\Users\Admin\AppData\Local\Temp\ox_1777804336437.exe
    3⤵
    - Executes dropped EXE
    PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ox_1777804336437.exe

Path C:\Users\Admin\AppData\Local\Temp\ox_1777804336437.exe
Size 276KB
SHA256 2f660620d2b7277ef3180f8429e35afa7884f1945b73662aa1a38ec3258ea4c3
MD5 1fe91af4eedac6208e1e2a1046962771
SHA1 4340beb5b7a15e9d1d8b1548f98454de49f0f958
SHA512 54a3fd8f9001d0ad240ec541274130c57eb4bea9c4bacb799daeab0fc587a29aa081e473c974b0bc94c575dde5bba6e8a146d92803fb61e9d337d622358f5df2
SSDEEP 3072:/COlajPxi/CVpWD+Xc1q1pgpmegV1w6DHz6J1jab6UdJPU:/3a3Vpasc1qfQmbV1X6JOTdJP
TLSH
T1F4548369EF48AC5AD8F7A8FB3C012A3ED0D0546787F179E684C2097D5A0889F17F6D90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5028-0-0x0000000140000000-0x0000000140025000-memory.dmp

Download

memory/5028-16-0x00000000025B0000-0x0000000002659000-memory.dmp

Download

memory/5028-18-0x0000000140000000-0x0000000140025000-memory.dmp

Download

memory/5028-17-0x0000000002F60000-0x0000000002F6C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads