Overview
overview
8Static
static
4package/Pr...el.exe
windows7-x64
1package/Pr...el.exe
windows10-2004-x64
1package/Pr...64.exe
windows7-x64
1package/Pr...64.exe
windows10-2004-x64
1package/Pr...ll.dll
windows7-x64
1package/Pr...ll.dll
windows10-2004-x64
1package/Pr...64.dll
windows7-x64
8package/Pr...64.dll
windows10-2004-x64
8package/Pr...re.dll
windows7-x64
1package/Pr...re.dll
windows10-2004-x64
1package/Pr...ix.xml
windows7-x64
1package/Pr...ix.xml
windows10-2004-x64
1package/Pr...se.xml
windows7-x64
1package/Pr...se.xml
windows10-2004-x64
1package/Pr...80.xml
windows7-x64
1package/Pr...80.xml
windows10-2004-x64
1package/Pr...90.xml
windows7-x64
1package/Pr...90.xml
windows10-2004-x64
1package/Pr...01.xml
windows7-x64
1package/Pr...01.xml
windows10-2004-x64
1package/Pr...ve.xml
windows7-x64
1package/Pr...ve.xml
windows10-2004-x64
1package/Pr...et.xml
windows7-x64
1package/Pr...et.xml
windows10-2004-x64
1package/Pr...l7.xml
windows7-x64
1package/Pr...l7.xml
windows10-2004-x64
1package/Pr...00.xml
windows7-x64
1package/Pr...00.xml
windows10-2004-x64
1package/Pr...70.xml
windows7-x64
1package/Pr...70.xml
windows10-2004-x64
1package/Pr...90.xml
windows7-x64
1package/Pr...90.xml
windows10-2004-x64
1Analysis
-
max time kernel
128s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
08-10-2022 05:59
Behavioral task
behavioral1
Sample
package/Program Files (x86)/ASIO4ALL v2/a4apanel.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
package/Program Files (x86)/ASIO4ALL v2/a4apanel.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
package/Program Files (x86)/ASIO4ALL v2/a4apanel64.exe
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
package/Program Files (x86)/ASIO4ALL v2/a4apanel64.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
package/Program Files (x86)/ASIO4ALL v2/asio4all.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
package/Program Files (x86)/ASIO4ALL v2/asio4all.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
package/Program Files (x86)/ASIO4ALL v2/asio4all64.dll
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
package/Program Files (x86)/ASIO4ALL v2/asio4all64.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
package/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
package/Program Files (x86)/Common Files/Propellerhead Software/ReWire/ReWire.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xml
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Informix.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/Sybase.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as80.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xml
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/as90.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xml
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/db2v0801.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xml
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xml
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/msjet.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xml
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/orcl7.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xml
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql2000.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xml
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql70.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xml
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/sql90.xml
Resource
win10v2004-20220812-en
General
-
Target
package/Program Files (x86)/Microsoft Analysis Services/AS OLEDB/110/Cartridges/hive.xml
-
Size
94KB
-
MD5
cad3dd46a534ea5a7e2d165ef2f9cdc0
-
SHA1
47f2982803c0091cd570ffef9d6d44289c4e0aaa
-
SHA256
479892c8f5def1c9a69705766b4dcf62dbb89978ae55c44577dfbfd9145d673b
-
SHA512
f478312589f1f7cf1aacc90ca02a7bcb63583f03b8e68bb491b241c72d62e2a9ad6efb346493ea2036930ae1daf35e0db8be18b615990afe50cbbba6992b483e
-
SSDEEP
1536:eXqkdcyRsSWlSTQf3TlDaqs925Uo1o5omoKomoptUkAv:eXqkdcyRsSWlKQf3TlDawtbAv
Malware Config
Signatures
-
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70622945dcdad801 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371974207" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6F753BD1-46CF-11ED-AAF5-C244376E7EDB} = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000dc36a1043b0010d6e2ee7ea4b8097c8bd2a4e1d889e4ba6851165dd64f7e1bff000000000e80000000020000200000008de9ebf7c950459a8c287534384bd6a3b39861f167e8e514b9616d94ba8dfc48900000003a8fe6dbb3e6bff4ea2b0038d4b3e5a002ee10628fdbf84f6b30b8b006815d72714ee12502bb057e515f2541c939ca5393b1d89f1694ea6a7449827e0549cfecdb2f66fde8fa87f8d4c603ad45b03ba5214040fe6958cb93ce90807b379b2831b599cbd796c711474ba746f927a1f1a12a678c14de713ca0c971d86ecbf90379be72aaec33b05d7572607faab2156dea400000004979f56ed457c0f00cd15f20e7c1623840acc0a4ed526b0331b90c4e4682cec7ac807bda1cd9e1f0030a54c5d22ac3a814a85a25777fffba528e00cd59e95356 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000bd402c8ef755d67476e6211cfa363fea9cd4a1dbcc67f5a0cc3cbc97b2e4b335000000000e80000000020000200000001600003e16ce0bb772170694af22190c2990cd82ed4c199436d734229098682820000000982b953942ae8565af2ce5647ba9a5fbaa032d18f01a1718e336b757e3511dad40000000cd1cb7b426acad9221a5dbeb5a5a51c1d9c6f60cacfcd5a9ce591f004f54f8f8c57082bf87a64db1570ee2330dbfd68f8e36be2959c28650171abff354f73e84 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1548 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1548 IEXPLORE.EXE 1548 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE 1788 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
MSOXMLED.EXEiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1728 wrote to memory of 724 1728 MSOXMLED.EXE iexplore.exe PID 1728 wrote to memory of 724 1728 MSOXMLED.EXE iexplore.exe PID 1728 wrote to memory of 724 1728 MSOXMLED.EXE iexplore.exe PID 1728 wrote to memory of 724 1728 MSOXMLED.EXE iexplore.exe PID 724 wrote to memory of 1548 724 iexplore.exe IEXPLORE.EXE PID 724 wrote to memory of 1548 724 iexplore.exe IEXPLORE.EXE PID 724 wrote to memory of 1548 724 iexplore.exe IEXPLORE.EXE PID 724 wrote to memory of 1548 724 iexplore.exe IEXPLORE.EXE PID 1548 wrote to memory of 1788 1548 IEXPLORE.EXE IEXPLORE.EXE PID 1548 wrote to memory of 1788 1548 IEXPLORE.EXE IEXPLORE.EXE PID 1548 wrote to memory of 1788 1548 IEXPLORE.EXE IEXPLORE.EXE PID 1548 wrote to memory of 1788 1548 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\package\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\Cartridges\hive.xml"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2SLWS01J.txtFilesize
608B
MD554d0ff582c245ef63975c3c850a86227
SHA1ed98b53cc08fdeed9f540423411da411d722c4be
SHA256c71d0a3fad433faceeb215984623bdeaa99911c2a6c0e0fa60e23af13f3df311
SHA5124803f26f949564474e4acb671f62c5e70f8336d2bd7b49da483bbb3ad904bfd1bffbc1c5f5cca9819a174bf368bbaf1df6dae5333094925dbdb04dc574b4891d
-
memory/1728-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB