Analysis
-
max time kernel
132s -
max time network
98s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
17-05-2021 04:37
Static task
static1
Behavioral task
behavioral1
Sample
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe
Resource
win7v20210410
General
-
Target
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe
-
Size
372KB
-
MD5
32d6092c9accf6e3ff855209f34cff3c
-
SHA1
eb052743df8bde8b675c652a07d96718b8db7d05
-
SHA256
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28
-
SHA512
97f931dedb5bba7f3ec69942b7fb3b02cb71dcd081b989adbd50901350f9d274d3ae189f508dba26e3c3aecfba43ed22cf1159ecd742a5d75fd6d002dbb9b40b
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeDesktopLayer.exepid process 2672 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe 1640 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe upx C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/2672-123-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px7EF9.tmp a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "327404200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "327404257" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "327404369" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0060C6FE-B6EF-11EB-B2DB-E2597A2395CA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 1640 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe 1640 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 776 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 776 iexplore.exe 776 iexplore.exe 4032 IEXPLORE.EXE 4032 IEXPLORE.EXE 4032 IEXPLORE.EXE 4032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exea4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 624 wrote to memory of 2672 624 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe PID 624 wrote to memory of 2672 624 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe PID 624 wrote to memory of 2672 624 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe PID 2672 wrote to memory of 1640 2672 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe DesktopLayer.exe PID 2672 wrote to memory of 1640 2672 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe DesktopLayer.exe PID 2672 wrote to memory of 1640 2672 a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe DesktopLayer.exe PID 1640 wrote to memory of 776 1640 DesktopLayer.exe iexplore.exe PID 1640 wrote to memory of 776 1640 DesktopLayer.exe iexplore.exe PID 776 wrote to memory of 4032 776 iexplore.exe IEXPLORE.EXE PID 776 wrote to memory of 4032 776 iexplore.exe IEXPLORE.EXE PID 776 wrote to memory of 4032 776 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe"C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeC:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:82945 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
C:\Users\Admin\AppData\Local\Temp\a4f7f8fc7995f49b688114a83c5208798a085a2611330b25255ddb6a82969c28Srv.exeMD5
2a591a91440acc2cfabfd0221cfe1378
SHA1add23a4e51dc5649984f56c235c48382f5c4f235
SHA2562f37132fabb06650873ad3bd0b15d2c13596fc7be401c0ca05b443c9a227a44c
SHA5123018caf86d187c14256deb92407157daf116720623c9ecd7d153c8456d4d1f9ec9b7a88db6db9a02f06367301af5d6c3d30e62f8ad04657fd651d4221a9287ac
-
memory/776-121-0x0000000000000000-mapping.dmp
-
memory/776-126-0x00007FFCBA850000-0x00007FFCBA8BB000-memory.dmpFilesize
428KB
-
memory/1640-117-0x0000000000000000-mapping.dmp
-
memory/1640-120-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2672-114-0x0000000000000000-mapping.dmp
-
memory/2672-123-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2672-122-0x00000000001F0000-0x00000000001FF000-memory.dmpFilesize
60KB
-
memory/4032-127-0x0000000000000000-mapping.dmp