Analysis
-
max time kernel
92s -
max time network
141s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-05-2021 12:06
Static task
static1
Behavioral task
behavioral1
Sample
67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662.exe
Resource
win7v20210410
General
-
Target
67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662.exe
-
Size
228KB
-
MD5
00d8b22278e3bf540badb67f4cc95542
-
SHA1
5618e2742527f4e0d64c8cdabf4c547469473d8e
-
SHA256
67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662
-
SHA512
f591dbe24dfa3f4c8beac27c10c33dc973621de7c1ded6977475de3aff611d8f1e9dd26c3c173eb60a0a2956acaacf903e2ce6cb09ff712b32c92134282c0ee6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exeDesktopLayer.exepid process 2712 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe 216 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe upx C:\Users\Admin\AppData\Local\Temp\67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/2712-123-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px248.tmp 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886007" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327779324" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3990976070" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886007" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1907DA80-B46B-11EB-A11C-46584878C9AA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3997695129" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886007" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327747333" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327730739" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3990976070" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 216 DesktopLayer.exe 216 DesktopLayer.exe 216 DesktopLayer.exe 216 DesktopLayer.exe 216 DesktopLayer.exe 216 DesktopLayer.exe 216 DesktopLayer.exe 216 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 288 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 288 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 288 iexplore.exe 288 iexplore.exe 1520 IEXPLORE.EXE 1520 IEXPLORE.EXE 1520 IEXPLORE.EXE 1520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662.exe67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 1824 wrote to memory of 2712 1824 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662.exe 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe PID 1824 wrote to memory of 2712 1824 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662.exe 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe PID 1824 wrote to memory of 2712 1824 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662.exe 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe PID 2712 wrote to memory of 216 2712 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe DesktopLayer.exe PID 2712 wrote to memory of 216 2712 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe DesktopLayer.exe PID 2712 wrote to memory of 216 2712 67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe DesktopLayer.exe PID 216 wrote to memory of 288 216 DesktopLayer.exe iexplore.exe PID 216 wrote to memory of 288 216 DesktopLayer.exe iexplore.exe PID 288 wrote to memory of 1520 288 iexplore.exe IEXPLORE.EXE PID 288 wrote to memory of 1520 288 iexplore.exe IEXPLORE.EXE PID 288 wrote to memory of 1520 288 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662.exe"C:\Users\Admin\AppData\Local\Temp\67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exeC:\Users\Admin\AppData\Local\Temp\67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:288 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
ef07b2dc81b7fdcc01d8a9cce1261822
SHA1535c60f61ed56d43a349e92b86dd5204a1b61859
SHA2564f4d35e9bbae40c756cb82b60a2bbfe0dfe055b06ddf2494a953ce7565ff8eb6
SHA5121a26ee805d55b252567caec75c0b75ec5493aa1865b4fd8a1cf6b18972e2ffd82ba778b4a6a80ed85c9d016d841d26be11d4bc6f4bf8d8b512e7261dc7ad3fe3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
d70ee1250aaf8d8dc861e3d0241c1ca4
SHA14d95473cfdb3b9271ea5556401a2f042648b0524
SHA2562208e87500227917c837ca9db201c9b4fe75fffaa0bcc182c6dd278bbd6e4045
SHA5127d78ff1c40cca2726bd253901acef4ded3c7b15acd6711242220493c885cb353b5a17ede86004f6a659ec5f52805b9a221745eaa634dcc45f1f72fc3067edfa3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\KKF5HISC.cookieMD5
5502b8c0f31e22c6b40bce0cee5a9dd9
SHA188e6a1d28adb946f606e907fbe296079fcf823be
SHA256f595a0b7c13abc5e667cafde93eb78bb8fcbb1fb03e592d8d4d050f33dc2e057
SHA51233dd0bbdae44e5dab6907bb9f7e1834f2c34ba58d5667d3575a867f600a9c440b42a6eae9b53d57cf52db0b89ee1809b9efe2e01598ae5ce708b570612151f8e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\YYIV5JP3.cookieMD5
b8a37b418e3ec2e5c3463cb230877534
SHA16105f3f394f448038751a58c9ab944e598f8f127
SHA256c5a69d61cba54604bbb91281989e5cbae889c09988ee6d4ed3e76cca0586acf9
SHA51232df1ab0ad255e12a01ebcd3b9706fc49864357e1f3de65da2ddb3a24940ae850cb31a9650ef664fafed0643c7c4295060df056eae8fa3a8abbeddbe0e97dcd2
-
C:\Users\Admin\AppData\Local\Temp\67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Local\Temp\67fca67d693881c64958232a25e4a2c841e473bc335b699f2b955a14895d8662Srv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
memory/216-117-0x0000000000000000-mapping.dmp
-
memory/216-120-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/288-121-0x0000000000000000-mapping.dmp
-
memory/288-124-0x00007FFC17D50000-0x00007FFC17DBB000-memory.dmpFilesize
428KB
-
memory/1520-128-0x0000000000000000-mapping.dmp
-
memory/1824-125-0x00000000008C0000-0x00000000009FC000-memory.dmpFilesize
1.2MB
-
memory/2712-114-0x0000000000000000-mapping.dmp
-
memory/2712-123-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/2712-122-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB