Analysis
-
max time kernel
131s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 23:45
Behavioral task
behavioral1
Sample
a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe
Resource
win7-20220901-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe
-
Size
176KB
-
MD5
76e0e62f1569576b71d76d83ce4a8aa0
-
SHA1
13d2ef143ebf3df93344948f59d061589e843e49
-
SHA256
a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885
-
SHA512
8394a7ea5714ff40206930796fc35957293b46fb0a03915accb11b6df757a5e1350dfff1ead094cdc1a0ef508f2b61772e7c6d71197eb54cb6ef038956ea07fd
-
SSDEEP
768:xH/nnbwsrpEFEuo2GP+faFwv2+8ajKGNGa/DrX0s42nDhej1H:xfMomU2O+faFwjHDDbHnFkH
Score
10/10
Malware Config
Signatures
-
Detect Blackmoon payload 2 IoCs
resource yara_rule behavioral2/memory/1748-133-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1748-135-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YouPin = "C:\\Windows\\system32\\YouPin.exe" a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\YouPin.exe a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe File created C:\Windows\SysWOW64\YouPin.exe a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6B65A9B8-4F26-11ED-B696-5E3721E937B7} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70513e4133e3d801 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80f5324333e3d801 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000fb6eed9b62a25ec60fc5ae5c9850b5b77bfd2a1d7cf4486cbe110453d1d4cd0e000000000e80000000020000200000005ff3213f2448aead917fdacf3c080cbbd119c7ff2382255cea70c0648a9d553f20000000570b5a50505bcff20ca35cf3229d031b0845a8194c9d08d6ede4c940a915267f40000000dcb0ab086855eb6df9ff06675898dabaeb237f22a6f4deac27940655d69864d47316112e8d2d42ac19e134a0fa20ded808ed8188be50f2619bcb71cbb3020885 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1225700790" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1225700790" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991155" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372891171" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b142160000000002000000000010660000000100002000000031fbb5da7f5d67832b1c57ec5f7f99555f542329893917b6085a0df91cbeb073000000000e8000000002000020000000e8111b775dd66d24b7c8c32bbda9213b83e01d45f77311daf2e8eada9f0a09cb20000000f4da9d3fe603775433d6e69bd9419b2a7b256476a619ee436d227c4da431538240000000140e219cd293d18e290a86bee314a6342940eaba4eaef85569e38f09999994285c085dd7de55a4e7b7b0d05346fc830625bff4608b0443c3e3b788c7021feb3f IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991155" IEXPLORE.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1028 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4984 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4984 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4984 IEXPLORE.EXE 4984 IEXPLORE.EXE 1992 IEXPLORE.EXE 1992 IEXPLORE.EXE 1992 IEXPLORE.EXE 1992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1748 wrote to memory of 4984 1748 a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe 80 PID 1748 wrote to memory of 4984 1748 a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe 80 PID 4984 wrote to memory of 1992 4984 IEXPLORE.EXE 81 PID 4984 wrote to memory of 1992 4984 IEXPLORE.EXE 81 PID 4984 wrote to memory of 1992 4984 IEXPLORE.EXE 81 PID 1748 wrote to memory of 1860 1748 a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe 84 PID 1748 wrote to memory of 1860 1748 a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe 84 PID 1748 wrote to memory of 1860 1748 a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe 84 PID 1860 wrote to memory of 1028 1860 cmd.exe 83 PID 1860 wrote to memory of 1028 1860 cmd.exe 83 PID 1860 wrote to memory of 1028 1860 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe"C:\Users\Admin\AppData\Local\Temp\a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://xz.sweetsstory.com/xz.html2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4984 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1992
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3&del "C:\Users\Admin\AppData\Local\Temp\a8b6afcf4b23a235bf9bc0d4bde33a68ead19fbafce3694b3c8ab602c40d5885.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1860
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 31⤵
- Runs ping.exe
PID:1028