b87de06d3986e81df492865c9602dfca5bec48e6fdce645e2bfcc0683bf8c780

Analysis

max time kernel
45s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aloha_setup64.exe
Size

113.3MB
MD5

b10b30c5efe64450b05a36cb09e667d4
SHA1

0880748ded97b36a6a99bc230a37fbfb37ec1076
SHA256

b87de06d3986e81df492865c9602dfca5bec48e6fdce645e2bfcc0683bf8c780
SHA512

c99833113f8d431fe61fd771cd757a2a9ecbae34b093fe4a28a707fe9cc17126406215b75ca9ecb2ddd7c2fffdf427ecde0a009bdae6e42ffc716371c7ad7d60
SSDEEP

3145728:aaLjDEoCOq816WJAbbjopIcWPUTjVdV/migBDY8m:aaLnEBz8lcj6WcVdV+z5m

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015
Executes dropped EXE 2 IoCs

Processes:

setup.exesetup.exe

pid process

2908 setup.exe
3936 setup.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2908	setup.exe
3936	setup.exe

Modifies registry class 5 IoCs

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\CLSID\{685174F1-6D52-4FE0-AFB8-28BE41DF11AB}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Aloha Mobile\\Aloha\\Application\\2.0.0.1\\notification_helper.exe"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\CLSID	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\CLSID\{685174F1-6D52-4FE0-AFB8-28BE41DF11AB}	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\CLSID\{685174F1-6D52-4FE0-AFB8-28BE41DF11AB}\LocalServer32	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\CLSID\{685174F1-6D52-4FE0-AFB8-28BE41DF11AB}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Aloha Mobile\\Aloha\\Application\\2.0.0.1\\notification_helper.exe\""	setup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

setup.exe

pid process

3936 setup.exe
3936 setup.exe
3936 setup.exe
3936 setup.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

aloha_setup64.exe

description pid process

Token: 33 1444 aloha_setup64.exe
Token: SeIncBasePriorityPrivilege 1444 aloha_setup64.exe

pid	process
3936	setup.exe
3936	setup.exe
3936	setup.exe
3936	setup.exe

description	pid	process
Token: 33	1444	aloha_setup64.exe
Token: SeIncBasePriorityPrivilege	1444	aloha_setup64.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

aloha_setup64.exesetup.exe

description	pid	process	target process
PID 1444 wrote to memory of 2908	1444	aloha_setup64.exe	setup.exe
PID 1444 wrote to memory of 2908	1444	aloha_setup64.exe	setup.exe
PID 2908 wrote to memory of 3936	2908	setup.exe	setup.exe
PID 2908 wrote to memory of 3936	2908	setup.exe	setup.exe

C:\Users\Admin\AppData\Local\Temp\aloha_setup64.exe
"C:\Users\Admin\AppData\Local\Temp\aloha_setup64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444

C:\Users\Admin\AppData\Local\Temp\CR_73592.tmp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\CR_73592.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\CR_73592.tmp\ALOHA.PACKED.7Z"
2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2908

C:\Users\Admin\AppData\Local\Temp\CR_73592.tmp\setup.exe
C:\Users\Admin\AppData\Local\Temp\CR_73592.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Crashpad" --url=https://submit.backtrace.io/alohabrowser/9e03b2e36605d475196bcb6e61ae3a9157de20aa775eeae07c234f3b16008d28/minidump --annotation=device_id=d2547453-e731-4fdf-8f92-95f955a44aca --annotation=format=minidump --annotation=plat=Win64 --annotation=prod=Aloha --annotation=product_version=2.0.0.1 --annotation=token=9e03b2e36605d475196bcb6e61ae3a9157de20aa775eeae07c234f3b16008d28 --annotation=user_id=d2547453-e731-4fdf-8f92-95f955a44aca --annotation=ver=2.0.0.1 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff655fdfed0,0x7ff655fdfedc,0x7ff655fdfee8
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2856,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Aloha Mobile\Aloha\User Data\Crashpad\settings.dat
Filesize
40B

MD5
61cc6a28f6ce41951ac9e9dc21d9a6e9

SHA1
1e5558d1e0e2798703030065f8fddf2f0aa495ee

SHA256
6aa36ba6739de1100652351e9cf8ff6a6b78d1f4485d41565c774fcc118879fc

SHA512
7628707e058428caf0a55a1fc2779305152b0bfff8e904aa20d0ee9e21379e1cc20048933bed8a399a78cb3451224ab59d7ed2336ece158d622cc67ef6a8daaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CR_73592.tmp\setup.exe
Filesize
2.8MB

MD5
077d0e77b468e28e5e91b1c626d0ab56

SHA1
ac814fc5ee40e760b03b76e3a8e747e0c281a19a

SHA256
4b2647e7a4b01d9470368c84e9cef57f70d547e1a6af676252bf8a72dcdd882f

SHA512
c57eb927525341c1198db5087dc2853ee99c140ea2dde883434d684fdf6e1124b11f15ded7477eec62445260db13179a6ffda4dbc0688149bbe3a19e05ca226c

Download Submit