d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b

Analysis

max time kernel
148s
max time network
134s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe
Size

243KB
MD5

3217ed4815c945be24b12ca75f4d00e0
SHA1

932a8f7c65a66283f92c2440d20de77004037c4a
SHA256

d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b
SHA512

94b3e0074d9459c71c600dba6b2e347c1a7fc1452feea954d79e1e6eb9973275cc082cce82396b5d91eca08d92f462b1de0b727e6a7d682869aeb5455a147e56
SSDEEP

6144:hw7/D/XeQgV1Chc2ZN7h9fwBbv1TvgvZtiucFH5gTpi3zJZoS:CWHOhc2Lh9abv1LyMucfApi3znoS

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1176	tesktog.exe
1492	tesktog.exe

Deletes itself 1 IoCs

pid	Process
1740	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe
1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\errorPageStrings[1]	tesktog.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[1]	tesktog.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	tesktog.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\dnserrordiagoff[1]	tesktog.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NewErrorPageTemplate[1]	tesktog.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\httpErrorPagesScripts[1]	tesktog.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\dnserrordiagoff[1]	tesktog.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NewErrorPageTemplate[1]	tesktog.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\errorPageStrings[1]	tesktog.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	tesktog.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0097000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tesktog.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e7-08-c0-5e-00\WpadDecisionReason = "1"	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	tesktog.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2175973F-0B97-43A1-B698-DAD6A958A603}\WpadDecisionReason = "1"	tesktog.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2175973F-0B97-43A1-B698-DAD6A958A603}\WpadDecision = "0"	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e7-08-c0-5e-00	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps	tesktog.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2175973F-0B97-43A1-B698-DAD6A958A603}\fe-e7-08-c0-5e-00	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	tesktog.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1601 = "0"	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	tesktog.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2175973F-0B97-43A1-B698-DAD6A958A603}\WpadDecisionTime = a0b3d17ab7d7d801	tesktog.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2175973F-0B97-43A1-B698-DAD6A958A603}\WpadNetworkName = "Network 3"	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer	tesktog.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	tesktog.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	tesktog.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tesktog.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	tesktog.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	tesktog.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2175973F-0B97-43A1-B698-DAD6A958A603}	tesktog.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e7-08-c0-5e-00\WpadDecisionTime = a0b3d17ab7d7d801	tesktog.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fe-e7-08-c0-5e-00\WpadDecision = "0"	tesktog.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating\.Current	tesktog.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1492	tesktog.exe
1492	tesktog.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 1176	1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe	27
PID 1188 wrote to memory of 1176	1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe	27
PID 1188 wrote to memory of 1176	1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe	27
PID 1188 wrote to memory of 1176	1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe	27
PID 1188 wrote to memory of 1740	1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe	29
PID 1188 wrote to memory of 1740	1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe	29
PID 1188 wrote to memory of 1740	1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe	29
PID 1188 wrote to memory of 1740	1188	d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe	29

C:\Users\Admin\AppData\Local\Temp\d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe
"C:\Users\Admin\AppData\Local\Temp\d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1188
- \??\c:\RECYCLER\tesktog.exe
  c:\RECYCLER\tesktog.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.bat
  2⤵
  - Deletes itself
  PID:1740

\??\c:\RECYCLER\tesktog.exe
c:\RECYCLER\tesktog.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\RECYCLER\tesktog.exe

Filesize
243KB

MD5
3217ed4815c945be24b12ca75f4d00e0

SHA1
932a8f7c65a66283f92c2440d20de77004037c4a

SHA256
d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b

SHA512
94b3e0074d9459c71c600dba6b2e347c1a7fc1452feea954d79e1e6eb9973275cc082cce82396b5d91eca08d92f462b1de0b727e6a7d682869aeb5455a147e56

Download Submit
C:\RECYCLER\tesktog.exe

Filesize
243KB

MD5
3217ed4815c945be24b12ca75f4d00e0

SHA1
932a8f7c65a66283f92c2440d20de77004037c4a

SHA256
d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b

SHA512
94b3e0074d9459c71c600dba6b2e347c1a7fc1452feea954d79e1e6eb9973275cc082cce82396b5d91eca08d92f462b1de0b727e6a7d682869aeb5455a147e56

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b.bat

Filesize
260B

MD5
7244df819fa35b7497c153bcec845d4c

SHA1
02b4df578aa42c706e41cfdc8569aa4bc8cb1a32

SHA256
ecd7227e0f0ee32558a9fe233e537786c79f737d0f207707049697649196ea29

SHA512
8c6d05ad3bcd3c95911dd5824c4d4d694b46dc92ee8f2bd3dceaed96321ee3ef08c2936cec212d05383c38ddfbc5f0b19539f131009711040e3bd273146fc218

Download Submit
\??\c:\RECYCLER\tesktog.exe

Filesize
243KB

MD5
3217ed4815c945be24b12ca75f4d00e0

SHA1
932a8f7c65a66283f92c2440d20de77004037c4a

SHA256
d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b

SHA512
94b3e0074d9459c71c600dba6b2e347c1a7fc1452feea954d79e1e6eb9973275cc082cce82396b5d91eca08d92f462b1de0b727e6a7d682869aeb5455a147e56

Download Submit
\RECYCLER\tesktog.exe

Filesize
243KB

MD5
3217ed4815c945be24b12ca75f4d00e0

SHA1
932a8f7c65a66283f92c2440d20de77004037c4a

SHA256
d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b

SHA512
94b3e0074d9459c71c600dba6b2e347c1a7fc1452feea954d79e1e6eb9973275cc082cce82396b5d91eca08d92f462b1de0b727e6a7d682869aeb5455a147e56

Download Submit
\RECYCLER\tesktog.exe

Filesize
243KB

MD5
3217ed4815c945be24b12ca75f4d00e0

SHA1
932a8f7c65a66283f92c2440d20de77004037c4a

SHA256
d3192e9a4813460082290ca81edb21da2ba0e1b2f27fa1e00b78c6d54dd2b36b

SHA512
94b3e0074d9459c71c600dba6b2e347c1a7fc1452feea954d79e1e6eb9973275cc082cce82396b5d91eca08d92f462b1de0b727e6a7d682869aeb5455a147e56

Download Submit
memory/1176-61-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1188-54-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1188-64-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1492-63-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1492-66-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download
memory/1492-72-0x0000000000400000-0x0000000000485000-memory.dmp

Filesize
532KB

Download