Analysis
- max time kernel
135s - max time network
136s - platform
windows10_x64 - resource
win10 - submitted
25/09/2020, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
123770d492a5870dedd5a9d6de4ce9d8.dll
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target 123770d492a5870dedd5a9d6de4ce9d8.dll
- Size 501KB
- Sample200925-j9cesllgla
- SHA256 b5bca2548051f7a0bccedd44ae018dfe9df7632ecb9c7c7ff98a6aadecc985b3
- MD5 123770d492a5870dedd5a9d6de4ce9d8
- SHA1 f9312c30223c1864a9bc35784b228f11d4941ccd
- SHA512 bad3fcfa4cd39fcb351a1e586e9ef60e451caa2d7c8d4ed1b4f2fe2611a526bb4648b1d7e06390723815d0c81e135d769a7a5b4f0efc78a5c46e3badbd5b18f3
- MD5 SHA1 SHA512
Malware Config
Signatures
- JavaScript code in executable 5 IoCs
resource yara_rule behavioral2/files/0x00020000000155ee-11.dat js behavioral2/files/0x000100000001ada8-14.dat js behavioral2/files/0x000100000001adac-26.dat js behavioral2/files/0x000100000001adae-28.dat js behavioral2/files/0x000100000001adaf-29.dat js -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF92DA79-FF15-11EA-95F0-46C5BBD542B6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2215313641" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068b7d9be127e174ebef6d707e0cbae1000000000020000000000106600000001000020000000b54f3554ff8c8c67ec65f4e2f93f142ad68d3be98410f90422cb0d0ac91c5cb6000000000e800000000200002000000005392b431da3fa8f04e14cc8997e6b5fba23e5c5dd6468f8ea0c52b707415a84e00000000702d14a6374fba1752c072747fd0f4eab6ed1106c85cfe523b25094bc17cc8a1f5283acf3a8397f818b854f5bb01f4e8ad031d19abc56ef13497df9a29a2a4115912486d1eda0018ea7812ebf9c0086f12e3280357d4ce0d5b56c5cf312baf1b0aeb0e40d120a19c7fe91ec638917db47d7a3052982dd0cb7ad79519df838c37f7af059c12688b133cdb5c573ed55b9e33116aeda0a4560f770a47090264171a95ba95b0624067362d9b41f0203607a95264ff5e0958fd3d0f7c17ee5679aaeae62da669fc989e2a5861357134f6d0694bf60dac5ac8416db4ffc610824a98840000000099d7965c15c69127386ac36b783e5cc0a62726d986d6b1fe21db9539c293d15d4f78dac891321871578082fbc574c01b2c46230db57b1af71a9268bba8f1380 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068b7d9be127e174ebef6d707e0cbae1000000000020000000000106600000001000020000000590159dfa02fe5fb88bb00d48d2007964b9c876e7e8a7bb4b4aae114e06584cd000000000e80000000020000200000001a9cda23732e6b492a587fee95d89154c06bd9693c67f08ee939220e0f300e28e000000008cc9e7a09f2b43899007dac8234d4a62015708dd6c4b55e9d7ce964ce94a4703c0890c6dc5ef482e3d350f22effd2e4506424b7f74d22dde82489cc574352a27026f8ed7f9dc217a688385f24ea00249882483172b5138ab76e7a9eb4bd3b27c4934035bac45a48ff3fa41b809c4bcfc1c408ac52b1bee0b5e2d9a461e00f782ffcbb03bc822b11f619d8a1b7939370bcbf1a828ed37227e55f241b82b2ae3be8a263ce87c1901e2a5924cf2614fd78f584587c8341db084e1abc1d170a57b77f974bec4b439925851b4a6122f0274efa58c07b3b59213c1a664d223467859c400000003d8a62139dbd84ec9e83416dfb3d479ddd18294b447395e36b9708160ddf55114082830df6f152bdd7c50f4fb260e68904af271e11c47bb0c30207c3099132dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30839586" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00998f852293d601 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2215313641" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9667E2F-FF15-11EA-95F0-46C5BBD542B6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6083e38c2293d601 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30839586" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068b7d9be127e174ebef6d707e0cbae1000000000020000000000106600000001000020000000046fc19a9a41f17d6b5a7642c2ecd0ecf019333e46b0ebd8d332eb64484bce2f000000000e80000000020000200000009d1263f1767938903739b08553b77dc89bf8e1026df75d9d6425eeff6a41eb4820000000ab1c457b4c65b526ce737bc709e3f3b87f12f6db24d29f9e30be299a1df5bf05400000006e0d96a74c140fb7045f34bfd899c6411d31f8892b24bbd21b359c6478c849562da4c6b90b7b93ae1fb5cb3ee4ccc44aa27a0d3a222beb300a8cf53b445727f2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D69E9341-FF15-11EA-95F0-46C5BBD542B6} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068b7d9be127e174ebef6d707e0cbae10000000000200000000001066000000010000200000003e65b0760020da26d1c0a4056627450b15936a6318c96b73f05b1a82c3bb7ed5000000000e80000000020000200000007a9bd986d13dd162116c66dc148cfe479b744ef608d1e7991ba1afc32b555b2e20000000d665149ea41ad452be8eabd6f8597c61aec0927c0d9bde6772e34e7ba534ee9740000000e8cb7b6b7aff234caafd21184ddedcffea5beeb64a269fea19fd87f3b7741b5808297298b43d8f8536b065dc96546bab74cae2061ca375fdae638e79a309237a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07f9b852293d601 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068b7d9be127e174ebef6d707e0cbae10000000000200000000001066000000010000200000008612adc1bed74b66b726fa66261174410ed7c255c860edc6ee56ba195627af91000000000e80000000020000200000009cc88db97f552d4acb2005aa50e5e4dcb56ceac11853494b323d128e78bb85d620000000188ad5b10043ca2f6fd1ca0b958ddc7ae95234ecbd2e73fe0c85122ee63da80f40000000a2c9c7110b5301ecb04a3d714c20651df8559f31188ba2cbd92debd90d690a6e46dbc13af07e16148ad0095c5264730958c0a2ada3bb4c9b12b7ae9b87c1dd19 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1624 iexplore.exe 748 iexplore.exe 2708 iexplore.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1624 iexplore.exe 1624 iexplore.exe 1924 IEXPLORE.EXE 1924 IEXPLORE.EXE 748 iexplore.exe 748 iexplore.exe 3532 IEXPLORE.EXE 3532 IEXPLORE.EXE 2708 iexplore.exe 2708 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2532 wrote to memory of 3024 2532 rundll32.exe 67 PID 2532 wrote to memory of 3024 2532 rundll32.exe 67 PID 2532 wrote to memory of 3024 2532 rundll32.exe 67 PID 1624 wrote to memory of 1924 1624 iexplore.exe 79 PID 1624 wrote to memory of 1924 1624 iexplore.exe 79 PID 1624 wrote to memory of 1924 1624 iexplore.exe 79 PID 748 wrote to memory of 3532 748 iexplore.exe 81 PID 748 wrote to memory of 3532 748 iexplore.exe 81 PID 748 wrote to memory of 3532 748 iexplore.exe 81 PID 2708 wrote to memory of 2504 2708 iexplore.exe 83 PID 2708 wrote to memory of 2504 2708 iexplore.exe 83 PID 2708 wrote to memory of 2504 2708 iexplore.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\123770d492a5870dedd5a9d6de4ce9d8.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\123770d492a5870dedd5a9d6de4ce9d8.dll,#12⤵PID:3024
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:748 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3532
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2504
-