Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-06-2022 04:05
Static task
static1
Behavioral task
behavioral1
Sample
1a2ec310ec65184670344e1f00c9ccd64ed7e8030f3ad8ee7250a039589da9c2.dll
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1a2ec310ec65184670344e1f00c9ccd64ed7e8030f3ad8ee7250a039589da9c2.dll
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
1a2ec310ec65184670344e1f00c9ccd64ed7e8030f3ad8ee7250a039589da9c2.dll
-
Size
224KB
-
MD5
530850cb621e89af1a084cfa10f7460b
-
SHA1
db95980c83669df95ca049be4c09b061004d359a
-
SHA256
1a2ec310ec65184670344e1f00c9ccd64ed7e8030f3ad8ee7250a039589da9c2
-
SHA512
c8c31a4756d1bc7af8ab721f194eb85ace02e7753a52e7ed7db516e12ef7d0ebb647ada1142103de446d383e6b1413f339b1a7a7081dce0f856636e49919c87f
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Internet Explorer Protected Mode 1 TTPs 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" notepad.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" notepad.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" notepad.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main notepad.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "361427644" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D143FFF1-E6E3-11EC-8F66-F2A7A8855ABA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09b7dc6f07ad801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000e5193c839f7c77291d87353c28242d0b81b220a26720ea8d6527f69c81a11ad0000000000e80000000020000200000005c64b42687a7cdef8ba9fb0d3c771e0edbe53242d14c3e944c89d75c57e609a8900000006fb6fcdbaaa508262e6be292cc11edf5e3d177fc888ee0592600aac36593a9a308ce1a6c58ba929c31c5c15bb9ecdb38e6044f6316e4c939ec785c8dbd2d2b05424df815fbeb0ef874fda47b6275b2222c3dabf3548ab27c86a4505e343bfb32131a2851f3f72ea2aa66537b8d14daa9cbca4525336a55b8eec75b33dce6a99619ff9cb62ccecbf16f6d1cd09ae3b55040000000ae3e53f9d04e0e642a8a9f307c4fff5bf08c63589189ed9544317629de6e7e21478f3d33a75fdc3632378a4c3657135b90d27c3fe992b19c1384ba14e310f1ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004863fcdc101a3947b120786fa95ba35b00000000020000000000106600000001000020000000a7a35c7cf2d3e7c1d94a1bc20bae17ae4f772350dde5665b82c4b17663ff8dd5000000000e8000000002000020000000188d31f7e493323e9f973a859f25c25b1a2f92d52b3efd39be017151a650bdaf2000000054ad9352c08c9273290236ca89b929fb8365bff39dd941f9a96c2e6f1789c19a40000000f38e1ca71fbc4cda9297b600e1dff07dd744cd45a919572c0a2b74368c8fd38bc2a1dbd4b1539b0626afde6ded29d8478ec08cffe3b6ba60285e5a15e8ed0c86 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main notepad.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 852 rundll32.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 1544 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 852 rundll32.exe 852 rundll32.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe 2012 notepad.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
pid Process 1180 iexplore.exe 1180 iexplore.exe 1180 iexplore.exe 1180 iexplore.exe 1180 iexplore.exe 1180 iexplore.exe 1180 iexplore.exe 1180 iexplore.exe 1180 iexplore.exe 1180 iexplore.exe 112 ctfmon.exe 112 ctfmon.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1180 iexplore.exe 1180 iexplore.exe 1960 IEXPLORE.EXE 1960 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 800 wrote to memory of 852 800 rundll32.exe 27 PID 800 wrote to memory of 852 800 rundll32.exe 27 PID 800 wrote to memory of 852 800 rundll32.exe 27 PID 800 wrote to memory of 852 800 rundll32.exe 27 PID 800 wrote to memory of 852 800 rundll32.exe 27 PID 800 wrote to memory of 852 800 rundll32.exe 27 PID 800 wrote to memory of 852 800 rundll32.exe 27 PID 852 wrote to memory of 1496 852 rundll32.exe 28 PID 852 wrote to memory of 1496 852 rundll32.exe 28 PID 852 wrote to memory of 1496 852 rundll32.exe 28 PID 852 wrote to memory of 1496 852 rundll32.exe 28 PID 852 wrote to memory of 2012 852 rundll32.exe 29 PID 852 wrote to memory of 2012 852 rundll32.exe 29 PID 852 wrote to memory of 2012 852 rundll32.exe 29 PID 852 wrote to memory of 2012 852 rundll32.exe 29 PID 1976 wrote to memory of 112 1976 explorer.exe 31 PID 1976 wrote to memory of 112 1976 explorer.exe 31 PID 1976 wrote to memory of 112 1976 explorer.exe 31 PID 852 wrote to memory of 2012 852 rundll32.exe 29 PID 1180 wrote to memory of 1960 1180 iexplore.exe 34 PID 1180 wrote to memory of 1960 1180 iexplore.exe 34 PID 1180 wrote to memory of 1960 1180 iexplore.exe 34 PID 1180 wrote to memory of 1960 1180 iexplore.exe 34 PID 852 wrote to memory of 1544 852 rundll32.exe 35 PID 852 wrote to memory of 1544 852 rundll32.exe 35 PID 852 wrote to memory of 1544 852 rundll32.exe 35 PID 852 wrote to memory of 1544 852 rundll32.exe 35 PID 852 wrote to memory of 1544 852 rundll32.exe 35 PID 852 wrote to memory of 1180 852 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a2ec310ec65184670344e1f00c9ccd64ed7e8030f3ad8ee7250a039589da9c2.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a2ec310ec65184670344e1f00c9ccd64ed7e8030f3ad8ee7250a039589da9c2.dll,#12⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵PID:1496
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:2012
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:1544
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\ctfmon.exectfmon.exe2⤵
- Suspicious use of FindShellTrayWindow
PID:112
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1960
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
606B
MD5cd8fb99b4f31ae51a9709c1aa28194e6
SHA14fa64a930125a7c89092a50dbf868e32d7cd48f0
SHA2569eadcc453d34faf43cc2c9e51aa137912890d46cb79a96c4953dfc633c2f1f3f
SHA5124d4979e4348dc488d44924ee01db68bf0333ba4f5aceb2382d687147a31b4dc73bfb531d472dec8cd82a5ee14bf6455d04a4eb6f78d10d65ddf2e3d63420c934