Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 10:02
Static task
static1
Behavioral task
behavioral1
Sample
p1cture3.jpg.dll
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
p1cture3.jpg.dll
-
Size
114KB
-
MD5
06767d3cc0087dc7b1adc149b0f1f7d5
-
SHA1
0cdffab8da2e54c119426026e02d89680224c38f
-
SHA256
af5030e85147368bd9ad59c09a39cbf28ecde7c7fb93e5b659346f424b3593f3
-
SHA512
8e3a11116bee673486f6ac90ea4685a8bdc79cdb6880fda9cd92f81f902f9ec12f9b2dfa758305247f5edf908aa44ad9854a292446c2b726fe6c34b452fe0783
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
regsvr32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier regsvr32.exe -
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2AA852F1-597D-11EB-A3A5-424ABE5A776C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b66000000000200000000001066000000010000200000004dc785718e81db06c1846fb2c1843f4145c5cd91448f4632b889f8f8c3f592e8000000000e8000000002000020000000e9348f1a713bac6c6b559a0689ddfe2b1c5a48fb30d952ccdaaa0abf5638e00490000000708c9a8e8d3eeb997a8a72cc21dadc628d369047df7c2d6adb5c36fe84a89303c46bbc69b915be55d7d244b3c405014a70a2d27cfbed523c8a4ae7a62bab62461c21863c366187d2b8f92207dd3b5d981302184189918a757fa61ccefb4ddd491fbe1b2f37e8124fe525006cfd188d2042e09a4e80e38c93f41db7f5f74028d86945ead6792150a9b5d4210aebdea6b140000000b0694ecfb79ffc238d777c8fa8d7637ce0d83992c85e53a17e1a2259ef1bddea80fc8025099d29479a302e67b2e9d4c429db4c1226f98b1329122942c397be19 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000033044fc40189d459fe40d0e3dcc9b66000000000200000000001066000000010000200000004052d110dfbfdcdd470f1400e04310a034467e87f412a428c000d00f01be4a8a000000000e8000000002000020000000c2d06ebc5e5640fdd78dc3ec3c007ad483e757d9d8dc50e379ebcd40dc7d5f91200000001788225865642e24f4524241d958d30f6ae9e11830a3efc0404bd245d32ab03440000000eb3427d088575b0d2817dd696dae710d530968d5a83f15a48e4252233d41b032048b5f56d926f60d6bb27a0d9d13723180fd3b7a2a98d8362704dbc1515a7652 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "317732945" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6072C551-597D-11EB-A3A5-424ABE5A776C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f029651c8aedd601 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 658 IoCs
Processes:
regsvr32.exepid process 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe -
Suspicious use of SendNotifyMessage 656 IoCs
Processes:
regsvr32.exepid process 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe 1072 regsvr32.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEpid process 1664 iexplore.exe 1664 iexplore.exe 1088 IEXPLORE.EXE 1088 IEXPLORE.EXE 512 iexplore.exe 512 iexplore.exe 1964 IEXPLORE.EXE 1964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
regsvr32.exeiexplore.exeiexplore.exedescription pid process target process PID 1648 wrote to memory of 1072 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1072 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1072 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1072 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1072 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1072 1648 regsvr32.exe regsvr32.exe PID 1648 wrote to memory of 1072 1648 regsvr32.exe regsvr32.exe PID 1664 wrote to memory of 1088 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 1088 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 1088 1664 iexplore.exe IEXPLORE.EXE PID 1664 wrote to memory of 1088 1664 iexplore.exe IEXPLORE.EXE PID 512 wrote to memory of 1964 512 iexplore.exe IEXPLORE.EXE PID 512 wrote to memory of 1964 512 iexplore.exe IEXPLORE.EXE PID 512 wrote to memory of 1964 512 iexplore.exe IEXPLORE.EXE PID 512 wrote to memory of 1964 512 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\p1cture3.jpg.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\p1cture3.jpg.dll2⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:512 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-7-0x000007FEF5D40000-0x000007FEF5FBA000-memory.dmpFilesize
2.5MB
-
memory/1072-3-0x0000000000000000-mapping.dmp
-
memory/1072-4-0x0000000074B31000-0x0000000074B33000-memory.dmpFilesize
8KB
-
memory/1072-5-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/1072-6-0x0000000000180000-0x00000000001A5000-memory.dmpFilesize
148KB
-
memory/1088-8-0x0000000000000000-mapping.dmp
-
memory/1648-2-0x000007FEFB6F1000-0x000007FEFB6F3000-memory.dmpFilesize
8KB
-
memory/1964-10-0x0000000000000000-mapping.dmp