Analysis
-
max time kernel
130s -
max time network
101s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
16-05-2021 05:40
Static task
static1
Behavioral task
behavioral1
Sample
9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe.exe
Resource
win7v20210408
General
-
Target
9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe.exe
-
Size
540KB
-
MD5
0b42b3068dccec381d93d6392ba3df56
-
SHA1
51a612fe6bc702e03c02ce7d7773d778fe2470ec
-
SHA256
9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe
-
SHA512
c27f748f813251b07f2995edf19fdb06d157aa6b599ee64105a7a160a05589b062739b0f442f01aa1c2339eacb68d9f22f4ca028c7316468be6846a489ee308f
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exeDesktopLayer.exepid process 3908 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe 1676 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe upx C:\Users\Admin\AppData\Local\Temp\9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe upx behavioral2/memory/3908-118-0x0000000000400000-0x000000000042E000-memory.dmp upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx -
Drops file in Program Files directory 3 IoCs
Processes:
9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exedescription ioc process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\px9AAF.tmp 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327371081" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327371138" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3CC8FFB-B6A1-11EB-B2DB-5A4A21AC7400} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327371250" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 1676 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe 1676 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 3616 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 3616 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 3616 iexplore.exe 3616 iexplore.exe 208 IEXPLORE.EXE 208 IEXPLORE.EXE 208 IEXPLORE.EXE 208 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe.exe9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 808 wrote to memory of 3908 808 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe.exe 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe PID 808 wrote to memory of 3908 808 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe.exe 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe PID 808 wrote to memory of 3908 808 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe.exe 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe PID 3908 wrote to memory of 1676 3908 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe DesktopLayer.exe PID 3908 wrote to memory of 1676 3908 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe DesktopLayer.exe PID 3908 wrote to memory of 1676 3908 9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe DesktopLayer.exe PID 1676 wrote to memory of 3616 1676 DesktopLayer.exe iexplore.exe PID 1676 wrote to memory of 3616 1676 DesktopLayer.exe iexplore.exe PID 3616 wrote to memory of 208 3616 iexplore.exe IEXPLORE.EXE PID 3616 wrote to memory of 208 3616 iexplore.exe IEXPLORE.EXE PID 3616 wrote to memory of 208 3616 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe.exe"C:\Users\Admin\AppData\Local\Temp\9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813fe.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exeC:\Users\Admin\AppData\Local\Temp\9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3616 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Local\Temp\9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
C:\Users\Admin\AppData\Local\Temp\9fe828a18f176ce50c4e6174b1afcea163914e1741d2830867cb0b8a1be813feSrv.exeMD5
da18881ccaefeaa4942af9291cb34826
SHA1e4f33c21684bede05ccea60dd0767250ff2b3aba
SHA2561d736643af18fe45f74f67a68c3268b39e7dbd84aaaf46dba5e23e48e8402842
SHA5122420cf80794f4e74fb95934698714d4386e022d68c0c4e181d9d6e189bf3fab09f920e6e9128e423a1dbf357558bab628133d1084a7a306617c3a9c2461a5901
-
memory/208-128-0x0000000000000000-mapping.dmp
-
memory/808-125-0x0000000000550000-0x000000000069A000-memory.dmpFilesize
1.3MB
-
memory/1676-119-0x0000000000000000-mapping.dmp
-
memory/1676-122-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/3616-123-0x0000000000000000-mapping.dmp
-
memory/3616-124-0x00007FFA8B2C0000-0x00007FFA8B32B000-memory.dmpFilesize
428KB
-
memory/3908-114-0x0000000000000000-mapping.dmp
-
memory/3908-118-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/3908-117-0x00000000001E0000-0x00000000001EF000-memory.dmpFilesize
60KB