Analysis
-
max time kernel
108s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
21/11/2022, 10:54
Behavioral task
behavioral1
Sample
620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe
-
Size
1.4MB
-
MD5
10e8a85ba5327f6d208e85739d01fa30
-
SHA1
d1c944239f30170a894562e80a089aa78911fd35
-
SHA256
620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd
-
SHA512
106ebd8bbaf888826b222ed6bc45c4ef0d7a8861a004c084bbc3a05163e251251e9ca45e8e65bf36546fcae1229cf6860d991db72c329c9e10d4ab40a9473de6
-
SSDEEP
24576:7N0oczSGASBs7Qq0JHVfhiKrnOThTcRtIkaFgT/kts8IzkJjX4n:7upWbSBs7u9riThQtI0T/O5IzkJjw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe -
resource yara_rule behavioral1/files/0x000b0000000122ef-55.dat upx behavioral1/files/0x000b0000000122ef-56.dat upx behavioral1/files/0x000b0000000122ef-58.dat upx behavioral1/memory/1456-61-0x0000000000400000-0x000000000087A000-memory.dmp upx behavioral1/memory/1612-64-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1612-65-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1456-66-0x0000000000400000-0x000000000087A000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 1456 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe 1456 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375796670" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A57CB11-6993-11ED-A8EF-5A9C998014C3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A57F221-6993-11ED-A8EF-5A9C998014C3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1452 iexplore.exe 832 iexplore.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1456 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe 1456 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe 1452 iexplore.exe 1452 iexplore.exe 832 iexplore.exe 832 iexplore.exe 1884 IEXPLORE.EXE 1884 IEXPLORE.EXE 1800 IEXPLORE.EXE 1800 IEXPLORE.EXE 1800 IEXPLORE.EXE 1800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1456 wrote to memory of 1612 1456 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe 28 PID 1456 wrote to memory of 1612 1456 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe 28 PID 1456 wrote to memory of 1612 1456 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe 28 PID 1456 wrote to memory of 1612 1456 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe 28 PID 1612 wrote to memory of 1452 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 30 PID 1612 wrote to memory of 1452 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 30 PID 1612 wrote to memory of 1452 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 30 PID 1612 wrote to memory of 1452 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 30 PID 1612 wrote to memory of 832 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 29 PID 1612 wrote to memory of 832 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 29 PID 1612 wrote to memory of 832 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 29 PID 1612 wrote to memory of 832 1612 620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe 29 PID 832 wrote to memory of 1800 832 iexplore.exe 33 PID 1452 wrote to memory of 1884 1452 iexplore.exe 32 PID 832 wrote to memory of 1800 832 iexplore.exe 33 PID 832 wrote to memory of 1800 832 iexplore.exe 33 PID 832 wrote to memory of 1800 832 iexplore.exe 33 PID 1452 wrote to memory of 1884 1452 iexplore.exe 32 PID 1452 wrote to memory of 1884 1452 iexplore.exe 32 PID 1452 wrote to memory of 1884 1452 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe"C:\Users\Admin\AppData\Local\Temp\620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bd.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exeC:\Users\Admin\AppData\Local\Temp\620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:832 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1884
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4A57CB11-6993-11ED-A8EF-5A9C998014C3}.dat
Filesize3KB
MD57bc3e7409ac2e379be07d292cb7a34db
SHA113ff566af51c112fe5f37b7c6d1db23a3abfd58c
SHA2562b7f73e11c3c6f604c6a4099465bf8b147fb0cd70dfb20fdfb24d699d3aa29b4
SHA5126624197b655ab4dfaa10a4265721fb37a8db81d6e7a11ade0ba2a70f344b84c4c9776218b581e7e6d81236da60b6702e573ff0c17c488fe88d9a70d2497a2a2f
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4A57F221-6993-11ED-A8EF-5A9C998014C3}.dat
Filesize5KB
MD5ce81f701754c99f2a0f75341f8dad701
SHA1c721283879309b0b6d422083579967b0d8c9323e
SHA256abf7990c5286a7f527f517c6c0e9960bc49a168b99975c51703750e3f7cce391
SHA5125152d0b1e130bd0b4bba9a74fcc347cbdab3654617f5586fc1bd6e6b940194df79547d642714dd60067d9993f04165f6f30adaeb7c2c715e0a12d9556d8d110b
-
C:\Users\Admin\AppData\Local\Temp\620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe
Filesize132KB
MD503458f75016342531765a7def629c6fe
SHA17e14e6534123ce7e51aafa2ccda4688a4524eeaf
SHA256860fdd78a1ca6dd68db4d64b918ef1fea1734a0650d4aad8c159eaf1e41ba98f
SHA5122db0af32ab82875e50d630798ee81b8a6fef9d1fccd6953fb891e6fc07fc048b30e65fd934ad8f6bd1531d7dcb73129043a219e28f82f55497a84b8b5e9ec198
-
Filesize
601B
MD56e8a2ef0ac9500c44e28576e611cedd6
SHA13929c661335e253b203a7a90fc6996359ccdabd0
SHA256b36c2d51e3823749fe07a27f5b734275815d875f3a8f1808fa60b552f264cd53
SHA5123afb1907d7506039938573296654172430e212af7976ceb1d933636c9aaf745b65ac761ec6c915abd3b9dee0cfb84facf58058f357c3a04552e17968ab738b91
-
\Users\Admin\AppData\Local\Temp\620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe
Filesize132KB
MD503458f75016342531765a7def629c6fe
SHA17e14e6534123ce7e51aafa2ccda4688a4524eeaf
SHA256860fdd78a1ca6dd68db4d64b918ef1fea1734a0650d4aad8c159eaf1e41ba98f
SHA5122db0af32ab82875e50d630798ee81b8a6fef9d1fccd6953fb891e6fc07fc048b30e65fd934ad8f6bd1531d7dcb73129043a219e28f82f55497a84b8b5e9ec198
-
\Users\Admin\AppData\Local\Temp\620c7879cb34dd4b36d7210d577e9da2b083a13e80906d1954b12388b6e2d2bdmgr.exe
Filesize132KB
MD503458f75016342531765a7def629c6fe
SHA17e14e6534123ce7e51aafa2ccda4688a4524eeaf
SHA256860fdd78a1ca6dd68db4d64b918ef1fea1734a0650d4aad8c159eaf1e41ba98f
SHA5122db0af32ab82875e50d630798ee81b8a6fef9d1fccd6953fb891e6fc07fc048b30e65fd934ad8f6bd1531d7dcb73129043a219e28f82f55497a84b8b5e9ec198