Analysis
-
max time kernel
148s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11-10-2022 12:06
Static task
static1
Behavioral task
behavioral1
Sample
b5e61224db265addd676275e862f41d3732252109c28fc77af911ffd6c6f0a02.dll
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
b5e61224db265addd676275e862f41d3732252109c28fc77af911ffd6c6f0a02.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
b5e61224db265addd676275e862f41d3732252109c28fc77af911ffd6c6f0a02.dll
-
Size
295KB
-
MD5
2ae32607c6b09020477b571ef1a9ac60
-
SHA1
e25eeb39feff465d3f6b258a013bbaf0903c35f4
-
SHA256
b5e61224db265addd676275e862f41d3732252109c28fc77af911ffd6c6f0a02
-
SHA512
484ca2df35ac2811eb678ffbfd1f01c89c1473e3a3fc21f80b4baae3ef16b4004b203183108abe7d550056418bad5ed06d365aea9b297bf163ba379f930c27e0
-
SSDEEP
3072:E7qxa8NoYr6w5S8o6epM++v/cfLWvPT8IvQIhFupyufsm53fioxrz0PWuHGBcwKd:E+vNoYYcvhvPpv7hgpy+pVfioxc+la
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1396 rundll32mgr.exe -
resource yara_rule behavioral1/files/0x00140000000054ab-56.dat upx behavioral1/files/0x00140000000054ab-57.dat upx behavioral1/files/0x00140000000054ab-59.dat upx behavioral1/memory/1396-60-0x0000000000400000-0x0000000000476000-memory.dmp upx behavioral1/memory/1396-61-0x0000000000400000-0x0000000000476000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1780 rundll32.exe 1780 rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372278703" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{606F3E20-4994-11ED-9AD4-7A3897842414} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{606F6530-4994-11ED-9AD4-7A3897842414} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1396 rundll32mgr.exe 1396 rundll32mgr.exe 1396 rundll32mgr.exe 1396 rundll32mgr.exe 1396 rundll32mgr.exe 1396 rundll32mgr.exe 1396 rundll32mgr.exe 1396 rundll32mgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1396 rundll32mgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1740 iexplore.exe 1748 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1748 iexplore.exe 1748 iexplore.exe 1740 iexplore.exe 1740 iexplore.exe 1556 IEXPLORE.EXE 1556 IEXPLORE.EXE 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE 1572 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1780 1884 rundll32.exe 28 PID 1884 wrote to memory of 1780 1884 rundll32.exe 28 PID 1884 wrote to memory of 1780 1884 rundll32.exe 28 PID 1884 wrote to memory of 1780 1884 rundll32.exe 28 PID 1884 wrote to memory of 1780 1884 rundll32.exe 28 PID 1884 wrote to memory of 1780 1884 rundll32.exe 28 PID 1884 wrote to memory of 1780 1884 rundll32.exe 28 PID 1780 wrote to memory of 1396 1780 rundll32.exe 29 PID 1780 wrote to memory of 1396 1780 rundll32.exe 29 PID 1780 wrote to memory of 1396 1780 rundll32.exe 29 PID 1780 wrote to memory of 1396 1780 rundll32.exe 29 PID 1396 wrote to memory of 1740 1396 rundll32mgr.exe 30 PID 1396 wrote to memory of 1740 1396 rundll32mgr.exe 30 PID 1396 wrote to memory of 1740 1396 rundll32mgr.exe 30 PID 1396 wrote to memory of 1740 1396 rundll32mgr.exe 30 PID 1396 wrote to memory of 1748 1396 rundll32mgr.exe 31 PID 1396 wrote to memory of 1748 1396 rundll32mgr.exe 31 PID 1396 wrote to memory of 1748 1396 rundll32mgr.exe 31 PID 1396 wrote to memory of 1748 1396 rundll32mgr.exe 31 PID 1748 wrote to memory of 1556 1748 iexplore.exe 33 PID 1740 wrote to memory of 1572 1740 iexplore.exe 34 PID 1740 wrote to memory of 1572 1740 iexplore.exe 34 PID 1740 wrote to memory of 1572 1740 iexplore.exe 34 PID 1748 wrote to memory of 1556 1748 iexplore.exe 33 PID 1748 wrote to memory of 1556 1748 iexplore.exe 33 PID 1740 wrote to memory of 1572 1740 iexplore.exe 34 PID 1748 wrote to memory of 1556 1748 iexplore.exe 33
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5e61224db265addd676275e862f41d3732252109c28fc77af911ffd6c6f0a02.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5e61224db265addd676275e862f41d3732252109c28fc77af911ffd6c6f0a02.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1740 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1556
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{606F3E20-4994-11ED-9AD4-7A3897842414}.dat
Filesize5KB
MD5af62a0d7414ba8075c320037e2580bad
SHA144cfbb6d8be905f95c56392988781a0b42023823
SHA256911316f7f4c9d2e0ed05d212917325e1e58caabb2cc118de721f28f93d523d55
SHA51247299fa92f4a57f24d613a686848bf8fbaa932034615a6c5d8d4f712fd95963e354f58633d899ea1a8117f950bba310cca2d10122a8b2c8540459249fbf0aac3
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{606F6530-4994-11ED-9AD4-7A3897842414}.dat
Filesize5KB
MD562d680021f58dabce4f97c9ae44dfc0a
SHA127a69cc4473bb8f8733cead9fba2116885a0eab0
SHA2563bec9abe8998cc14b16ba8ccb84bde2ca561f53d11bbd47bb23d566269ac6f85
SHA512ce179fd9bf313f8a5845572ee1e453acd76e958ef356e9c649ccd92c62704c70e75ed702c90095666d6c44936e4fdabd4bf7faf64e47a6bae3b532e6a2b66673
-
Filesize
603B
MD514623e82452509c1706449e6adec3852
SHA1fc1df25cb2f96ce097bf4b7274b781cecd53a88f
SHA256c2e8e60cb1d1e096f21f3fe09804a9e10934a3a551fab429d37ec0b9de1134b8
SHA51284ab374b7111091b8e0085d50e830937a5ce1babe4827259e041ae624d0da92d45f76af66c19caa8d8dd8aa973110f4e4f445c9a1a639d5d53cecb887d65747a
-
Filesize
201KB
MD5281b8e24fc062f50e31155b12df9678d
SHA19375588dd0442f8ef49282d46b1d72cfe080f30e
SHA2566b89da851bd071f909df7ba1c5378e162ae0e517940afeff07817990101e0e29
SHA512dc90e87c9d92c4620fb3f1222f09dd59e51d24b0c867f508c26305703ca83dc5357a10823f77ac1d026fe64b59729eee260c64a00398235b3a15e540a8460740
-
Filesize
201KB
MD5281b8e24fc062f50e31155b12df9678d
SHA19375588dd0442f8ef49282d46b1d72cfe080f30e
SHA2566b89da851bd071f909df7ba1c5378e162ae0e517940afeff07817990101e0e29
SHA512dc90e87c9d92c4620fb3f1222f09dd59e51d24b0c867f508c26305703ca83dc5357a10823f77ac1d026fe64b59729eee260c64a00398235b3a15e540a8460740
-
Filesize
201KB
MD5281b8e24fc062f50e31155b12df9678d
SHA19375588dd0442f8ef49282d46b1d72cfe080f30e
SHA2566b89da851bd071f909df7ba1c5378e162ae0e517940afeff07817990101e0e29
SHA512dc90e87c9d92c4620fb3f1222f09dd59e51d24b0c867f508c26305703ca83dc5357a10823f77ac1d026fe64b59729eee260c64a00398235b3a15e540a8460740