Overview

overview

8

Static

static

4aeb072fee...cf.dll

windows7-x64

8

4aeb072fee...cf.dll

windows10-2004-x64

8

Analysis

  • max time kernel
    107s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 20:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    4aeb072fee9ccdfcf388bdc1c4a1174eeaecc5448062bf79ebd3faef5b0325cf.dll

  • Size

    148KB

  • MD5

    6c7a459f20046145b160c84b69d8fdbf

  • SHA1

    2aafce329881a1d72c84355be0634fcf6ea5010e

  • SHA256

    4aeb072fee9ccdfcf388bdc1c4a1174eeaecc5448062bf79ebd3faef5b0325cf

  • SHA512

    6c2dfa652e592ccff7e29872be5e8955509b19ee85cff30b42a4fb4ad8090e4fce8f9f5b54c86e6534e1a06b997ce97102c13f566709d4c8d0582dfbe49ff806

  • SSDEEP

    3072:3bf/YTXnjn1gCVMSJXbA3B49CuZaMLzbxVwB5pdkP3cOqI10JK:rITXjnzZxA3Bfu0ixSBnjwb

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 53 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4aeb072fee9ccdfcf388bdc1c4a1174eeaecc5448062bf79ebd3faef5b0325cf.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\4aeb072fee9ccdfcf388bdc1c4a1174eeaecc5448062bf79ebd3faef5b0325cf.dll
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\SysWOW64\regsvr32mgr.exe
        C:\Windows\SysWOW64\regsvr32mgr.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:816
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:872
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:872 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1164
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:952
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:1160

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EE770081-42BA-11ED-9C7C-660C31E8D015}.dat
          Filesize

          4KB

          MD5

          37ebe1ce1a75636c041dee42e6fd99d5

          SHA1

          a0387d5aab2807217dfe5ad84409665b83e0ad5d

          SHA256

          c6c90924ad0f4f5ea174967d7c822d5884f2ccbf1479bc5cab3537223bbc89b7

          SHA512

          e076d86319f0af2855c489f1033b00b954c5767d6c0f75a0e46bffde53db9b70d7d8474083db12c7654ed46fad5fb4d45c77b5c7c7adf92a694c9b15a7ef4e7e

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{EE772791-42BA-11ED-9C7C-660C31E8D015}.dat
          Filesize

          5KB

          MD5

          b5384ff37fbbd6c410683a6fabca9763

          SHA1

          0a808388d369fe1b4ed6bbd726076a7a68c18f79

          SHA256

          460b2e93d14f42eef33f33b6436ea62f213bbed7dbe538a5e5a40fed6ccf10a7

          SHA512

          d404f860d429af49c18b8880366f3f3f9a7077f6e557d4e1a37eef7e53aab1bd64c01217f14fb5a259613f3781e1ce8e759eab4abe7666e4858b66c95db641cd

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UOWOE44N.txt
          Filesize

          608B

          MD5

          0189539737d047cceeeb47ee5b4e9efb

          SHA1

          06f25f7b4e1ad85c342d305c56aff0811c226627

          SHA256

          b9a170a616ddca8b7252d27e98ec74dbe34d1f143a4512ae6ed14c76cc95ebf2

          SHA512

          0e857b655d3e0cd23ee84cd2f915e9518bbeaff8bd4c337b974030099a1412f49dee68851af5ff72701fabed46cc806ecac05ad560ddfbdf8aa4f1c1804a8bd0

          Download Submit

        • C:\Windows\SysWOW64\regsvr32mgr.exe
          Filesize

          99KB

          MD5

          f57eee1185dee33198b752dd1f66ad55

          SHA1

          b60f88d65f8805bf2ca095ecd1727b15eed4ff12

          SHA256

          6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

          SHA512

          cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

          Download Submit

        • \Windows\SysWOW64\regsvr32mgr.exe
          Filesize

          99KB

          MD5

          f57eee1185dee33198b752dd1f66ad55

          SHA1

          b60f88d65f8805bf2ca095ecd1727b15eed4ff12

          SHA256

          6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

          SHA512

          cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

          Download Submit

        • \Windows\SysWOW64\regsvr32mgr.exe
          Filesize

          99KB

          MD5

          f57eee1185dee33198b752dd1f66ad55

          SHA1

          b60f88d65f8805bf2ca095ecd1727b15eed4ff12

          SHA256

          6bb93bea58d84b9c6a562a6b888ec84ba0ecb7575b6c8f3264a9e9fb44ee37f7

          SHA512

          cd97a2207d7ad6178cc7c9fb13fda7015bc30a924aa43b6e8ba07961ef878a841e6d025047a35e3b60ef23a3ab9b59b16d1abe09f39dc0cd6e5515d46630ad40

          Download Submit

        • memory/816-63-0x0000000000400000-0x0000000000454000-memory.dmp

          Filesize

          336KB

          Download

        • memory/816-64-0x0000000000400000-0x0000000000454000-memory.dmp

          Filesize

          336KB

          Download

        • memory/1212-54-0x000007FEFC581000-0x000007FEFC583000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1224-56-0x0000000076711000-0x0000000076713000-memory.dmp

          Filesize

          8KB

          Download