Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15-05-2021 04:05
Static task
static1
Behavioral task
behavioral1
Sample
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe
Resource
win7v20210410
General
-
Target
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe
-
Size
728KB
-
MD5
d33dfa9f7716a4ff7867dda2b8437bf7
-
SHA1
77973958bf9749d0a7dc4a042ce1bdf28189c9a3
-
SHA256
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c
-
SHA512
1991864ea9a4c92157e6ad051182ce9689a697031b2e7c66b17afee1a53157d8d907a65dc5f37d54e5202cc61943ce2a3fb86a22ba571a3cbb3b8bc19f31569e
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeDesktopLayer.exepid process 1660 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe 1976 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe upx C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe upx \Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe upx \Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral1/memory/1660-74-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exefacef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exepid process 1096 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe 1660 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe -
Drops file in Program Files directory 3 IoCs
Processes:
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exedescription ioc process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\px119.tmp facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327833054" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{501CEA81-B559-11EB-A1DA-5A6828A642A0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
DesktopLayer.exepid process 1976 DesktopLayer.exe 1976 DesktopLayer.exe 1976 DesktopLayer.exe 1976 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1332 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1332 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1332 iexplore.exe 1332 iexplore.exe 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exefacef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 1096 wrote to memory of 1660 1096 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe PID 1096 wrote to memory of 1660 1096 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe PID 1096 wrote to memory of 1660 1096 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe PID 1096 wrote to memory of 1660 1096 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe PID 1660 wrote to memory of 1976 1660 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe DesktopLayer.exe PID 1660 wrote to memory of 1976 1660 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe DesktopLayer.exe PID 1660 wrote to memory of 1976 1660 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe DesktopLayer.exe PID 1660 wrote to memory of 1976 1660 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe DesktopLayer.exe PID 1976 wrote to memory of 1332 1976 DesktopLayer.exe iexplore.exe PID 1976 wrote to memory of 1332 1976 DesktopLayer.exe iexplore.exe PID 1976 wrote to memory of 1332 1976 DesktopLayer.exe iexplore.exe PID 1976 wrote to memory of 1332 1976 DesktopLayer.exe iexplore.exe PID 1332 wrote to memory of 1388 1332 iexplore.exe IEXPLORE.EXE PID 1332 wrote to memory of 1388 1332 iexplore.exe IEXPLORE.EXE PID 1332 wrote to memory of 1388 1332 iexplore.exe IEXPLORE.EXE PID 1332 wrote to memory of 1388 1332 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe"C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeC:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1332 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1388
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G8AB1J6B.txtMD5
bd9cd6f3765f4e3985394beb56a1c135
SHA135b5762e994ca410bf62ddeba42ef00d74b75ab3
SHA256a53d2efe8cc62ef818e58fb98df3ca15deb7224fd9bd46ea220339a8c401ad50
SHA5127d21877d6955e3762a2c426095c7069692c68dfa02f07049d0f9a2df2e020ba8bcaedf5da3a55f1801522cb1debc3ee3f117f03d191f4c8ed0f3bf41589fb52c
-
\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
memory/1332-71-0x0000000000000000-mapping.dmp
-
memory/1332-77-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/1388-72-0x0000000000000000-mapping.dmp
-
memory/1660-61-0x0000000000000000-mapping.dmp
-
memory/1660-74-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1660-73-0x00000000001C0000-0x00000000001CF000-memory.dmpFilesize
60KB
-
memory/1660-63-0x00000000768B1000-0x00000000768B3000-memory.dmpFilesize
8KB
-
memory/1976-66-0x0000000000000000-mapping.dmp
-
memory/1976-70-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB