Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
15-05-2021 04:05
Static task
static1
Behavioral task
behavioral1
Sample
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe
Resource
win7v20210410
General
-
Target
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe
-
Size
728KB
-
MD5
d33dfa9f7716a4ff7867dda2b8437bf7
-
SHA1
77973958bf9749d0a7dc4a042ce1bdf28189c9a3
-
SHA256
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c
-
SHA512
1991864ea9a4c92157e6ad051182ce9689a697031b2e7c66b17afee1a53157d8d907a65dc5f37d54e5202cc61943ce2a3fb86a22ba571a3cbb3b8bc19f31569e
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeDesktopLayer.exepid process 924 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe 1784 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe upx C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/924-125-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px1775.tmp facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327881640" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "649589676" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327849648" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "649589676" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886246" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5225DF0C-B559-11EB-A11C-4EB55871646D} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327833055" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30886246" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30886246" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "657558463" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 1784 DesktopLayer.exe 1784 DesktopLayer.exe 1784 DesktopLayer.exe 1784 DesktopLayer.exe 1784 DesktopLayer.exe 1784 DesktopLayer.exe 1784 DesktopLayer.exe 1784 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2172 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2172 iexplore.exe 2172 iexplore.exe 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE 2520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exefacef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 3708 wrote to memory of 924 3708 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe PID 3708 wrote to memory of 924 3708 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe PID 3708 wrote to memory of 924 3708 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe PID 924 wrote to memory of 1784 924 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe DesktopLayer.exe PID 924 wrote to memory of 1784 924 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe DesktopLayer.exe PID 924 wrote to memory of 1784 924 facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe DesktopLayer.exe PID 1784 wrote to memory of 2172 1784 DesktopLayer.exe iexplore.exe PID 1784 wrote to memory of 2172 1784 DesktopLayer.exe iexplore.exe PID 2172 wrote to memory of 2520 2172 iexplore.exe IEXPLORE.EXE PID 2172 wrote to memory of 2520 2172 iexplore.exe IEXPLORE.EXE PID 2172 wrote to memory of 2520 2172 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe"C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeC:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
a0a5a4d72ad62fd610b043c84033deaf
SHA1aa5c3deaba3b479e004880b369f63f2b59b23b9a
SHA25635d20d28885d84fef2a2e06125bf9626fbab13b99d1238a435a444a8db1cb9c6
SHA51220dd0d4276e854bca2767bd4cf7f04068a23742ff33926a7ba5296d2b0a453d456f37662e443c4df2fc3027bbead658a8ca6f8be40a61c82e3d6085cf85b9243
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776MD5
fad3320f34ac445862a17a3bea50f3e8
SHA13b3f82205017584f487c729887e855e3a29d123a
SHA256673fa401579fd33164f8b6781258907367dffbcfe0e0b1498c3968231fd0e747
SHA512ff4619fdcd68e68fbb63300467de260358a75d034b9eb081180dda2cf06732cbb074c8bdcd4a934e4f68e5eb051df7d3f04f5ec84561dd0f22919ae7fff46e8f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\9ZCTC1FH.cookieMD5
6d0595281b4c3aa114fc0f27a2a58b07
SHA1ea70df2e6ce698fdbd2e7a8c9dbc370af23a9b19
SHA256466887b9b583422e826b9f4e44cab33dfe8b9b6134a16d571663f8ca7c4206e5
SHA512a8aebf9575b253e26f3b40f38744040c6a54090c17241b23a0fd459a22f72ec391f5e3d7fa507c389eba12bcc38e368e12c54d74dc9f2963312b37515a24b83b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\JAOCP4SP.cookieMD5
c2eac7bff8a41422d1001704438f5d31
SHA176c13b01e8ad568da178f4b1eb36ebb939d5e9b1
SHA25635fe7c71fb9670d57917b1ce734baa859f486a48b1a79df4b0f7900dbdb070aa
SHA5126cda589884e2ca4d0e2c91343a8d06c4e12389f1696f09186c5d1a5b5d9084702b1bc48a4d63c1252bb966b54329fbafcb5aa81e2542623dfb40ee4e49e9a293
-
C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Local\Temp\facef372e4fdf2e90cb32a0100219bda77e714e741e9b45820f7ca111b91fa3cSrv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
memory/924-114-0x0000000000000000-mapping.dmp
-
memory/924-124-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/924-125-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/1784-120-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/1784-117-0x0000000000000000-mapping.dmp
-
memory/2172-122-0x00007FFFCA510000-0x00007FFFCA57B000-memory.dmpFilesize
428KB
-
memory/2172-121-0x0000000000000000-mapping.dmp
-
memory/2520-123-0x0000000000000000-mapping.dmp