Analysis
-
max time kernel
119s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-05-2021 03:20
Static task
static1
Behavioral task
behavioral1
Sample
3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe
Resource
win7v20210408
General
-
Target
3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe
-
Size
193KB
-
MD5
03b17e1b56311e64852d5df83123e8d4
-
SHA1
f4e96cfad1df5efa065e11388f094d7b5d686cbe
-
SHA256
3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71
-
SHA512
77352fed7f7d1e5f7b3e8403c7caf66fbeccd426ff60029c43147b2932c6e7119f9bc54cd4a9fe0bdc2914f56cdfc3275c8bc66a58038c3bebfa6a58c16a17af
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DesktopLayer.exepid process 416 DesktopLayer.exe -
Processes:
resource yara_rule C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/2116-121-0x0000000000400000-0x000000000043F000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe File opened for modification C:\Program Files (x86)\Microsoft\px32CD.tmp 3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886233" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327827650" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886233" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327844244" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886233" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCB441F9-B54C-11EB-A11C-F682FE25733D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2439943358" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327876236" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2449318553" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2439943358" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 416 DesktopLayer.exe 416 DesktopLayer.exe 416 DesktopLayer.exe 416 DesktopLayer.exe 416 DesktopLayer.exe 416 DesktopLayer.exe 416 DesktopLayer.exe 416 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1216 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1216 iexplore.exe 1216 iexplore.exe 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE 2676 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 2116 wrote to memory of 416 2116 3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe DesktopLayer.exe PID 2116 wrote to memory of 416 2116 3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe DesktopLayer.exe PID 2116 wrote to memory of 416 2116 3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe DesktopLayer.exe PID 416 wrote to memory of 1216 416 DesktopLayer.exe iexplore.exe PID 416 wrote to memory of 1216 416 DesktopLayer.exe iexplore.exe PID 1216 wrote to memory of 2676 1216 iexplore.exe IEXPLORE.EXE PID 1216 wrote to memory of 2676 1216 iexplore.exe IEXPLORE.EXE PID 1216 wrote to memory of 2676 1216 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe"C:\Users\Admin\AppData\Local\Temp\3a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1216 CREDAT:82945 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
03b17e1b56311e64852d5df83123e8d4
SHA1f4e96cfad1df5efa065e11388f094d7b5d686cbe
SHA2563a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71
SHA51277352fed7f7d1e5f7b3e8403c7caf66fbeccd426ff60029c43147b2932c6e7119f9bc54cd4a9fe0bdc2914f56cdfc3275c8bc66a58038c3bebfa6a58c16a17af
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
03b17e1b56311e64852d5df83123e8d4
SHA1f4e96cfad1df5efa065e11388f094d7b5d686cbe
SHA2563a02ab67a8bfb6121f6968e932504759b462cf479f1834cd23b579ae1448dc71
SHA51277352fed7f7d1e5f7b3e8403c7caf66fbeccd426ff60029c43147b2932c6e7119f9bc54cd4a9fe0bdc2914f56cdfc3275c8bc66a58038c3bebfa6a58c16a17af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
57010df1ded674ce061f8af29a2e6fbb
SHA183e50ef272059dc3fab93e694d5e220dc48bf0c4
SHA25668492169f14b36562d813f4ae7506f4b324b85f0e6aec352a37faba29b289616
SHA512211ecb686dec8e8dd57cc8aeebdb8953f81aa56eebec9b463df4d41d98942317ed001ae5ffc9cc0c3ce5c542317cd0838447b885016697411b99f68190bd430b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
9f98fa55f005ab814b547ab8d436e243
SHA1e1520caea00a9410079a3de311a0c5849e2143fa
SHA25675004dc0d0af42e7f4e85a867b57f7a6f8b90c87ef63723183add65d384db378
SHA5126813e92ce3f90f00710572a3175e03cc61f0e244bab774ac000170292c36b56154ec05cecfe72595465ffbaa325e53e22693ec8a3ba7461093f3c538f7d4919d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\HP3K22YD.cookieMD5
8e83bef31e58e9a96ecfb7d70f25e0dd
SHA1e5b84fcc5440d5bd7c77f7af5fb0d5e43e22dd2f
SHA256ec2e29e3fa7f6414ccb7c19189dea29893d20ea7868352075c4d3539a363a8e2
SHA5129ab3b42a46abea18f4964e2d2a8ed9cb826a44a5ff8a3b7dab8e4bdb495efd9b7903e69e69a4d6f6a26ca0615198e9d79520388f12da8d9af1c96a19d1df3c6b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\ZMBVLF87.cookieMD5
94c82da41d8112fc1ce8c0ff524c353e
SHA19c82e04de03c8cd75dac9461f1db5136f7373686
SHA25614ce97f6439393ab252575f32deb0885f627129ddc77394ec01094494831e152
SHA51232df8d13548c5c9fd25e010884b0d82556a167808cafc2c21415327bff577b1d5c6c21f294011d03903763311bdde80c3fe263fec39b84086508b94b27ec073f
-
memory/416-117-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/416-114-0x0000000000000000-mapping.dmp
-
memory/1216-119-0x00007FF86C460000-0x00007FF86C4CB000-memory.dmpFilesize
428KB
-
memory/1216-118-0x0000000000000000-mapping.dmp
-
memory/2116-121-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/2116-120-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/2676-124-0x0000000000000000-mapping.dmp