Analysis
-
max time kernel
83s -
max time network
94s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-05-2021 00:25
Static task
static1
Behavioral task
behavioral1
Sample
fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe
Resource
win7v20210410
General
-
Target
fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe
-
Size
230KB
-
MD5
9dc135d8f028fb7c70933fdec936f419
-
SHA1
d5e61fbc352fc2dc8d1b8f234801b96e7b3cd04f
-
SHA256
fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7
-
SHA512
95f2462cd33328ace30978f40619b0dfb329915bd68befa2cf62616658ee6444a367fd77ac2b8477eef0fcaf5a4c1c38191c1f07f511e34abd3bbe633fa6f4b7
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exeDesktopLayer.exepid process 4060 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe 3184 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe upx C:\Users\Admin\AppData\Local\Temp\fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/4060-123-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx -
Drops file in Program Files directory 3 IoCs
Processes:
fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px695E.tmp fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327209203" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327209091" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327209034" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{992CD41D-B528-11EB-B2DB-EA801B2465EB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 3184 DesktopLayer.exe 3184 DesktopLayer.exe 3184 DesktopLayer.exe 3184 DesktopLayer.exe 3184 DesktopLayer.exe 3184 DesktopLayer.exe 3184 DesktopLayer.exe 3184 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4076 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4076 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exeiexplore.exeIEXPLORE.EXEpid process 672 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe 672 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe 4076 iexplore.exe 4076 iexplore.exe 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exefcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 672 wrote to memory of 4060 672 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe PID 672 wrote to memory of 4060 672 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe PID 672 wrote to memory of 4060 672 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe PID 4060 wrote to memory of 3184 4060 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe DesktopLayer.exe PID 4060 wrote to memory of 3184 4060 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe DesktopLayer.exe PID 4060 wrote to memory of 3184 4060 fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe DesktopLayer.exe PID 3184 wrote to memory of 4076 3184 DesktopLayer.exe iexplore.exe PID 3184 wrote to memory of 4076 3184 DesktopLayer.exe iexplore.exe PID 4076 wrote to memory of 1296 4076 iexplore.exe IEXPLORE.EXE PID 4076 wrote to memory of 1296 4076 iexplore.exe IEXPLORE.EXE PID 4076 wrote to memory of 1296 4076 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe"C:\Users\Admin\AppData\Local\Temp\fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exeC:\Users\Admin\AppData\Local\Temp\fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4076 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Local\Temp\fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Local\Temp\fcaf8d356cd9c31dc8c05093f18532a8ed9a356a435570554e6ac211f19a95f7Srv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
memory/1296-127-0x0000000000000000-mapping.dmp
-
memory/3184-117-0x0000000000000000-mapping.dmp
-
memory/3184-122-0x0000000000470000-0x0000000000471000-memory.dmpFilesize
4KB
-
memory/4060-114-0x0000000000000000-mapping.dmp
-
memory/4060-119-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB
-
memory/4060-123-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4076-124-0x0000000000000000-mapping.dmp
-
memory/4076-126-0x00007FFD1F1F0000-0x00007FFD1F25B000-memory.dmpFilesize
428KB