Analysis
-
max time kernel
129s -
max time network
93s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-05-2021 04:12
Static task
static1
Behavioral task
behavioral1
Sample
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe
Resource
win7v20210410
General
-
Target
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe
-
Size
464KB
-
MD5
15c55b525bf6ac3bd679992319d442e9
-
SHA1
a8af7037200fa0091c65a916e6f53c8690d66ba4
-
SHA256
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e
-
SHA512
a6a4af276863c48ab754b649cc590682b46809899c92b7eda1a3ae4d8d7dfd8ad47ff1e2062dd53b8e23db807b0de5c04b59969912bc5317c78919292a07b7fc
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeDesktopLayer.exepid process 4028 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe 4092 DesktopLayer.exe -
Processes:
resource yara_rule behavioral2/memory/4028-124-0x0000000000400000-0x0000000000413000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px61DC.tmp 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327238433" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C67CB9B-B56D-11EB-B2DB-EA801B2465EB} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327238602" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327238490" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 4092 DesktopLayer.exe 4092 DesktopLayer.exe 4092 DesktopLayer.exe 4092 DesktopLayer.exe 4092 DesktopLayer.exe 4092 DesktopLayer.exe 4092 DesktopLayer.exe 4092 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3740 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3740 iexplore.exe 3740 iexplore.exe 3684 IEXPLORE.EXE 3684 IEXPLORE.EXE 3684 IEXPLORE.EXE 3684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 740 wrote to memory of 4028 740 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 740 wrote to memory of 4028 740 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 740 wrote to memory of 4028 740 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe PID 4028 wrote to memory of 4092 4028 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 4028 wrote to memory of 4092 4028 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 4028 wrote to memory of 4092 4028 367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe DesktopLayer.exe PID 4092 wrote to memory of 3740 4092 DesktopLayer.exe iexplore.exe PID 4092 wrote to memory of 3740 4092 DesktopLayer.exe iexplore.exe PID 3740 wrote to memory of 3684 3740 iexplore.exe IEXPLORE.EXE PID 3740 wrote to memory of 3684 3740 iexplore.exe IEXPLORE.EXE PID 3740 wrote to memory of 3684 3740 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe"C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeC:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3740 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3684
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
C:\Users\Admin\AppData\Local\Temp\367b70bf01713368a807963e7917a0bade9587ef221d29dd855c53ab489f738eSrv.exeMD5
17efb7e40d4cadaf3a4369435a8772ec
SHA1eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SHA256f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
SHA512522fba06304950860fa9aa8933b12b9323dea47dbda363db3f57535396c156c4cf6934a9db38fff8c77503fcb889d030fadb639094a1f34bbad54c79c8734450
-
memory/3684-127-0x0000000000000000-mapping.dmp
-
memory/3740-121-0x0000000000000000-mapping.dmp
-
memory/3740-122-0x00007FFD1F1F0000-0x00007FFD1F25B000-memory.dmpFilesize
428KB
-
memory/4028-114-0x0000000000000000-mapping.dmp
-
memory/4028-123-0x0000000000480000-0x0000000000482000-memory.dmpFilesize
8KB
-
memory/4028-124-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/4092-117-0x0000000000000000-mapping.dmp
-
memory/4092-120-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB