Analysis
-
max time kernel
135s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 01:27
Static task
static1
Behavioral task
behavioral1
Sample
c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe
Resource
win7-20220414-en
General
-
Target
c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe
-
Size
756KB
-
MD5
abe779482d3e8d51381ca04cd84d2cd4
-
SHA1
2751f1b89bdb639e0e00e44b8ebc6b7ff3744817
-
SHA256
c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d
-
SHA512
fa8eea2f63d37db30b35bc8a5a731b0120c5b4e676dd8ccd02f3b3c3b729d6fe396950c736b5fe75c735e46fd4c3191db73181917c14a7d24b8ad1d44e39a4a0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exeDesktopLayer.exepid process 4636 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe 4224 DesktopLayer.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe upx C:\Users\Admin\AppData\Local\Temp\c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx C:\Program Files (x86)\Microsoft\DesktopLayer.exe upx behavioral2/memory/4636-138-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral2/memory/4224-139-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px7F61.tmp c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30967875" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3392243938" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30967875" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3392243938" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3364893228" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3364893228" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30967875" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "362892714" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F2976531-F436-11EC-B274-6E95B8993B04} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30967875" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 4224 DesktopLayer.exe 4224 DesktopLayer.exe 4224 DesktopLayer.exe 4224 DesktopLayer.exe 4224 DesktopLayer.exe 4224 DesktopLayer.exe 4224 DesktopLayer.exe 4224 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exepid process 3040 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1920 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1920 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4208 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exeiexplore.exeIEXPLORE.EXEpid process 3040 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe 4208 iexplore.exe 4208 iexplore.exe 3040 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe 3040 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe 1100 IEXPLORE.EXE 1100 IEXPLORE.EXE 1100 IEXPLORE.EXE 1100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exec2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 3040 wrote to memory of 4636 3040 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe PID 3040 wrote to memory of 4636 3040 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe PID 3040 wrote to memory of 4636 3040 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe PID 4636 wrote to memory of 4224 4636 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe DesktopLayer.exe PID 4636 wrote to memory of 4224 4636 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe DesktopLayer.exe PID 4636 wrote to memory of 4224 4636 c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe DesktopLayer.exe PID 4224 wrote to memory of 4208 4224 DesktopLayer.exe iexplore.exe PID 4224 wrote to memory of 4208 4224 DesktopLayer.exe iexplore.exe PID 4208 wrote to memory of 1100 4208 iexplore.exe IEXPLORE.EXE PID 4208 wrote to memory of 1100 4208 iexplore.exe IEXPLORE.EXE PID 4208 wrote to memory of 1100 4208 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe"C:\Users\Admin\AppData\Local\Temp\c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40d.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exeC:\Users\Admin\AppData\Local\Temp\c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4208 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1100
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x508 0x2f01⤵
- Suspicious use of AdjustPrivilegeToken
PID:1920
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD54b5f63131c2ad19a1b25b9c790cb101f
SHA123ffbecbbc2c90699e632a1bb789f5e6c6975fbe
SHA256f712507488d39ee6f3913255fa4e3f64b7f8d7be0c920c02546e3647f87603da
SHA512dc1d4c9b5157e79230fa05b1bde5e76f1ab2bdb08883ec74cccedc3ef88b1dff05fe91b36ab72086be6899d70fa9056d7c19fa0f285578b7cfa141f9e2cb6240
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD574e7ac5155d395003a94fe2d1c68ca48
SHA17a6a9638c859a306bb8c0508fc09bec91c18ec91
SHA256d97af7a49776cb5975eb0e4401fdcd8426755566893e84f3f9989a23b027b88f
SHA5128375a6263777dfb0148812f70690489db328beb2af0da0cadf072b2ef463b99c00b78eff8038759f20a2f2b62f554332f2302bfcfbb773a3cd70add7bb4610ee
-
C:\Users\Admin\AppData\Local\Temp\c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
C:\Users\Admin\AppData\Local\Temp\c2e5aeb33d6a4d197dd1bf3381463c1c2b43826c0ad14200edf4b98f8f6bc40dSrv.exeFilesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a
-
memory/3040-130-0x0000000000400000-0x000000000051F000-memory.dmpFilesize
1.1MB
-
memory/3040-131-0x0000000000400000-0x000000000051F000-memory.dmpFilesize
1.1MB
-
memory/4224-135-0x0000000000000000-mapping.dmp
-
memory/4224-139-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4636-132-0x0000000000000000-mapping.dmp
-
memory/4636-138-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB