Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 18:07
Static task
static1
Behavioral task
behavioral1
Sample
e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe
-
Size
48KB
-
MD5
01662672f2bf97ba2619fc7bcdc1da08
-
SHA1
527189c9bf09c5dbabbdab8205877baed4cd646a
-
SHA256
e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a
-
SHA512
2bbb5b8ea26cce7dd8b2d12d37f656677333938760f29c8aa6971aeab57cdc0a83e06f812f5cbbdc515243ffcc915d3e095fad486d551fef53c57fc5f8a0436a
-
SSDEEP
1536:Vox768RPlyoeSyN6/J86HRwwHJBpetl5A00WP1:q7Lf3yN6/J4SMtl5Aw
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\dao.ico e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.on86.com/?581" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.on86.com/?581" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe -
Modifies registry class 53 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)\Command e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "0" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8} e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\Attributes = "0" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O) e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.on86.com/?581" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D)\Command e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\HideFolderVerbs e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.on86.com/?581" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\1 = "20221108" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688} e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\HideOnDesktopPerUser e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\9 = "1" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ɾ³ý(&D) e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O) e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R) e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ = "ÍøÖ·µ¼º½" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R) e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\Open(&O)\Command e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\DefaultIcon e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M) e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder\WantsParseDisplayName e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ÖØÃüÃû(&M)\Command e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\ShellFolder e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\dao.ico" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D)\Command e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE38-8596-11D1-B16A-00C0F0283688}\Shell\ɾ³ý(&D) e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M) e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\PlayFlashDXA\cdafile2 = "51330" e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4572 wrote to memory of 2168 4572 e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe 81 PID 4572 wrote to memory of 2168 4572 e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe 81 PID 4572 wrote to memory of 2168 4572 e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe"C:\Users\Admin\AppData\Local\Temp\e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exeC:\Users\Admin\AppData\Local\Temp\e51f547e367af9477442f30e5a3cfe7038b752fe3e3536d1c522b289f61e604a.exe2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:2168
-