Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
17-05-2021 04:37
Static task
static1
Behavioral task
behavioral1
Sample
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe
Resource
win7v20210410
General
-
Target
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe
-
Size
372KB
-
MD5
32d6092c9accf6e3ff855209f34cff3c
-
SHA1
eb052743df8bde8b675c652a07d96718b8db7d05
-
SHA256
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28
-
SHA512
97f931dedb5bba7f3ec69942b7fb3b02cb71dcd081b989adbd50901350f9d274d3ae189f508dba26e3c3aecfba43ed22cf1159ecd742a5d75fd6d002dbb9b40b
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeDesktopLayer.exepid process 1996 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe 900 DesktopLayer.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe upx C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe upx C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe upx \Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral1/memory/1996-74-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exea4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exepid process 1756 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe 1996 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe -
Drops file in Program Files directory 3 IoCs
Processes:
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\px1593.tmp a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "328000090" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{392BB421-B6DE-11EB-849A-C2EBB310CB62} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
DesktopLayer.exepid process 900 DesktopLayer.exe 900 DesktopLayer.exe 900 DesktopLayer.exe 900 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1736 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1736 iexplore.exe 1736 iexplore.exe 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exea4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 1756 wrote to memory of 1996 1756 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe PID 1756 wrote to memory of 1996 1756 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe PID 1756 wrote to memory of 1996 1756 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe PID 1756 wrote to memory of 1996 1756 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe PID 1996 wrote to memory of 900 1996 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe DesktopLayer.exe PID 1996 wrote to memory of 900 1996 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe DesktopLayer.exe PID 1996 wrote to memory of 900 1996 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe DesktopLayer.exe PID 1996 wrote to memory of 900 1996 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe DesktopLayer.exe PID 900 wrote to memory of 1736 900 DesktopLayer.exe iexplore.exe PID 900 wrote to memory of 1736 900 DesktopLayer.exe iexplore.exe PID 900 wrote to memory of 1736 900 DesktopLayer.exe iexplore.exe PID 900 wrote to memory of 1736 900 DesktopLayer.exe iexplore.exe PID 1736 wrote to memory of 1572 1736 iexplore.exe IEXPLORE.EXE PID 1736 wrote to memory of 1572 1736 iexplore.exe IEXPLORE.EXE PID 1736 wrote to memory of 1572 1736 iexplore.exe IEXPLORE.EXE PID 1736 wrote to memory of 1572 1736 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe"C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeC:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HNJH0VUU.txtMD5
f11e9e2b8a0f62f376d8e3c28d8a4a16
SHA179301a6277f8d54662aa7b4394b543a70c888347
SHA256c126d982da44981ca725d4063d624ef769a650337cdb5b554f6a1f664de1a44a
SHA5124d6d454455808b968b507522ad61a279285ee954314818aac70e251b17e027fca928096ee4dfedad427fcf77effa940f995382d1fcf0cb59426e54c1f237e49c
-
\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
memory/900-66-0x0000000000000000-mapping.dmp
-
memory/900-70-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1572-72-0x0000000000000000-mapping.dmp
-
memory/1736-71-0x0000000000000000-mapping.dmp
-
memory/1736-77-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/1996-63-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/1996-61-0x0000000000000000-mapping.dmp
-
memory/1996-73-0x0000000000230000-0x000000000023F000-memory.dmpFilesize
60KB
-
memory/1996-74-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB