6ed2cd0ad3af207c3b07e8f0ae43df89001f516e4edfab090bb2283a9bf4875d

Analysis

max time kernel
123s
max time network
117s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ed2cd0ad3af207c3b07e8f0ae43df89001f516e4edfab090bb2283a9bf4875d.dll
Size

596KB
MD5

7ba3161d629cc179412835c88c4500f7
SHA1

8773e6711a316100db0f319ee6decd9d433fab1e
SHA256

6ed2cd0ad3af207c3b07e8f0ae43df89001f516e4edfab090bb2283a9bf4875d
SHA512

7ac20b72505ffe2a3d4c09896dc3d41da18d9d199c045ba053cc85de276256d9a53eb5917be362c7b771089adff80603d74a2b68195f6e632ab66ff6b4414776
SSDEEP

12288:bXo450qjYthuCNIm/kqF6a2FjyHIDiroM3kN:y/ku6FjyHe+oM32

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1004	rundll32mgr.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c0000000054a8-56.dat	upx
behavioral1/files/0x000c0000000054a8-57.dat	upx
behavioral1/files/0x000c0000000054a8-59.dat	upx
behavioral1/memory/1004-63-0x0000000000400000-0x0000000000473000-memory.dmp	upx
behavioral1/memory/1004-64-0x0000000000400000-0x0000000000473000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1456	rundll32.exe
1456	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1524	1456	WerFault.exe	27

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27E7BB41-5074-11ED-8C74-D6AAFEFD221A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373034551"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27E9B711-5074-11ED-8C74-D6AAFEFD221A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1004	rundll32mgr.exe
1004	rundll32mgr.exe
1004	rundll32mgr.exe
1004	rundll32mgr.exe
1004	rundll32mgr.exe
1004	rundll32mgr.exe
1004	rundll32mgr.exe
1004	rundll32mgr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	rundll32mgr.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1240	iexplore.exe
1164	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1164	iexplore.exe
1164	iexplore.exe
1240	iexplore.exe
1240	iexplore.exe
820	IEXPLORE.EXE
820	IEXPLORE.EXE
708	IEXPLORE.EXE
708	IEXPLORE.EXE
708	IEXPLORE.EXE
708	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1456	1388	rundll32.exe	27
PID 1388 wrote to memory of 1456	1388	rundll32.exe	27
PID 1388 wrote to memory of 1456	1388	rundll32.exe	27
PID 1388 wrote to memory of 1456	1388	rundll32.exe	27
PID 1388 wrote to memory of 1456	1388	rundll32.exe	27
PID 1388 wrote to memory of 1456	1388	rundll32.exe	27
PID 1388 wrote to memory of 1456	1388	rundll32.exe	27
PID 1456 wrote to memory of 1004	1456	rundll32.exe	28
PID 1456 wrote to memory of 1004	1456	rundll32.exe	28
PID 1456 wrote to memory of 1004	1456	rundll32.exe	28
PID 1456 wrote to memory of 1004	1456	rundll32.exe	28
PID 1456 wrote to memory of 1524	1456	rundll32.exe	29
PID 1456 wrote to memory of 1524	1456	rundll32.exe	29
PID 1456 wrote to memory of 1524	1456	rundll32.exe	29
PID 1456 wrote to memory of 1524	1456	rundll32.exe	29
PID 1004 wrote to memory of 1164	1004	rundll32mgr.exe	30
PID 1004 wrote to memory of 1164	1004	rundll32mgr.exe	30
PID 1004 wrote to memory of 1164	1004	rundll32mgr.exe	30
PID 1004 wrote to memory of 1164	1004	rundll32mgr.exe	30
PID 1004 wrote to memory of 1240	1004	rundll32mgr.exe	31
PID 1004 wrote to memory of 1240	1004	rundll32mgr.exe	31
PID 1004 wrote to memory of 1240	1004	rundll32mgr.exe	31
PID 1004 wrote to memory of 1240	1004	rundll32mgr.exe	31
PID 1164 wrote to memory of 820	1164	iexplore.exe	34
PID 1164 wrote to memory of 820	1164	iexplore.exe	34
PID 1164 wrote to memory of 820	1164	iexplore.exe	34
PID 1240 wrote to memory of 708	1240	iexplore.exe	33
PID 1164 wrote to memory of 820	1164	iexplore.exe	34
PID 1240 wrote to memory of 708	1240	iexplore.exe	33
PID 1240 wrote to memory of 708	1240	iexplore.exe	33
PID 1240 wrote to memory of 708	1240	iexplore.exe	33

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ed2cd0ad3af207c3b07e8f0ae43df89001f516e4edfab090bb2283a9bf4875d.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6ed2cd0ad3af207c3b07e8f0ae43df89001f516e4edfab090bb2283a9bf4875d.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1164
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:820
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1240
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1240 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 280
    3⤵
    - Program crash
    PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{27E7BB41-5074-11ED-8C74-D6AAFEFD221A}.dat

Filesize
3KB

MD5
10f534afb9e4a2e246dceb4b4f83c461

SHA1
d5895a048c36b00a98ec6d5a11ad9db74e79248f

SHA256
f02a622d0bd7362f04497808b5a1af3a23625406f7c5069084f9fe24153197f1

SHA512
dfeec57e68d9d1f60edc1a2891116d7b3d6091e24dfa14c408b241188f67b02aa30689fe6b12b2f326c5266fd61539e9416be3107459c0b67d175a7a350c28bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{27E9B711-5074-11ED-8C74-D6AAFEFD221A}.dat

Filesize
3KB

MD5
4110f59d4bbfab94229276b0addcef33

SHA1
600fafa5f6bb32eefdfc5aefd65405e34db6b8a2

SHA256
0aba3084f033975edc0ed54a632503a146f71c556d063a4b8e73b1e422fe2d97

SHA512
8258033498f5761fc0ab7c6374e18f11d0ce3b06478efea71561413fd4e44c6cc33d8683b087e93eac5a98bad8767389e6772081891f83cf3b1b037a29b1ef6e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YRKOHOX7.txt

Filesize
599B

MD5
ad837ba6d357f8659017e1631834ea3e

SHA1
51f32f11b2a757f048a6a2038d5b1dd50d1a8531

SHA256
e55ab272f0ef60c575b73404d2be77dbe4060592944d8f60f19927203a1e7257

SHA512
d3eec65fdc5ec35b9d822fb2c7c8e8519e4eeecff8c7dd22eab1e701b8b0f51570a4b128b65bf90123e601a8cf6d978a71c09bb2ebba47948c9b3d6cf6433ca9

Download Submit
C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
221KB

MD5
ce0c184845b7fcfffeb671f7f992a177

SHA1
41f7d4b9ddac19ba5cd10e4a4aff5168d4443171

SHA256
2c576d543410c985df7b044ef8dc203c0846016d16a5785d67556d3a85b86a96

SHA512
f41dc07ba2fa14a612dbf2d17b511b34413d6eae6af82ec5d5c44bf7c2b9a29b74e4eb436853c0618451f06a75f0b96078a66f715a6041f55fb697aef7d160ac

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
221KB

MD5
ce0c184845b7fcfffeb671f7f992a177

SHA1
41f7d4b9ddac19ba5cd10e4a4aff5168d4443171

SHA256
2c576d543410c985df7b044ef8dc203c0846016d16a5785d67556d3a85b86a96

SHA512
f41dc07ba2fa14a612dbf2d17b511b34413d6eae6af82ec5d5c44bf7c2b9a29b74e4eb436853c0618451f06a75f0b96078a66f715a6041f55fb697aef7d160ac

Download Submit
\Windows\SysWOW64\rundll32mgr.exe

Filesize
221KB

MD5
ce0c184845b7fcfffeb671f7f992a177

SHA1
41f7d4b9ddac19ba5cd10e4a4aff5168d4443171

SHA256
2c576d543410c985df7b044ef8dc203c0846016d16a5785d67556d3a85b86a96

SHA512
f41dc07ba2fa14a612dbf2d17b511b34413d6eae6af82ec5d5c44bf7c2b9a29b74e4eb436853c0618451f06a75f0b96078a66f715a6041f55fb697aef7d160ac

Download Submit
memory/1004-63-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1004-64-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1456-61-0x0000000010000000-0x00000000126CD000-memory.dmp

Filesize
38.8MB

Download
memory/1456-62-0x0000000000670000-0x00000000006E3000-memory.dmp

Filesize
460KB

Download
memory/1456-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download