Analysis
-
max time kernel
106s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 09:45
Static task
static1
Behavioral task
behavioral1
Sample
4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
Resource
win10v2004-20220901-en
General
-
Target
4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
-
Size
36KB
-
MD5
e284f66f6759911c7c032bd131332a24
-
SHA1
79edba44f0a1a55def326a6c6ba885f2478a4780
-
SHA256
4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d
-
SHA512
a5722e1d07cd61ccded507b97d69d00cd250b42b9a6c75327a7db69e1aceb1b29a58b6fbc0ca2e56aaba200470ae38c70bd18c3fe7b515a9cff6dbfe075178c8
-
SSDEEP
768:n+ssHLUCpqCXhcTW/Y20TlXjU12W3sGctza:n+sRKFc/xTBi1cc
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
Processes:
4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exedescription ioc process File opened for modification C:\WINDOWS\system32\drivers\etc\hosts.ics 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe File opened for modification C:\WINDOWS\system32\drivers\etc\hosts 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cfhack = "C:\\WINDOWS\\admin.exe" 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe -
Processes:
RunDll32.exeRunDll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch RunDll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" RunDll32.exe Key deleted \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage RunDll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomStorageState RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomStorageState\EdpCleanupState = "0" RunDll32.exe -
Modifies data under HKEY_USERS 7 IoCs
Processes:
rundll32.exeRunDll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft rundll32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography rundll32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry RunDll32.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133136712960862773" RunDll32.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry rundll32.exe Key created \REGISTRY\USER\S-1-5-19 rundll32.exe Key created \REGISTRY\USER\S-1-5-19\Software rundll32.exe -
Modifies registry class 24 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DOMStorage rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DomStorageState rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\DomStorageState\EdpCleanupState = "0" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Explorer\EdpDomStorage rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1" rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 1120 rundll32.exe Token: SeDebugPrivilege 1120 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
RunDll32.exeRunDll32.exepid process 3852 RunDll32.exe 2012 RunDll32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exepid process 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exeRunDll32.exeRunDll32.exedescription pid process target process PID 2224 wrote to memory of 3852 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe RunDll32.exe PID 2224 wrote to memory of 3852 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe RunDll32.exe PID 2224 wrote to memory of 3852 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe RunDll32.exe PID 2224 wrote to memory of 2012 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe RunDll32.exe PID 2224 wrote to memory of 2012 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe RunDll32.exe PID 2224 wrote to memory of 2012 2224 4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe RunDll32.exe PID 3852 wrote to memory of 1132 3852 RunDll32.exe rundll32.exe PID 3852 wrote to memory of 1132 3852 RunDll32.exe rundll32.exe PID 3852 wrote to memory of 1132 3852 RunDll32.exe rundll32.exe PID 2012 wrote to memory of 1120 2012 RunDll32.exe rundll32.exe PID 2012 wrote to memory of 1120 2012 RunDll32.exe rundll32.exe PID 2012 wrote to memory of 1120 2012 RunDll32.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe"C:\Users\Admin\AppData\Local\Temp\4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 82⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:000000003⤵
- Modifies registry class
-
C:\Windows\SysWOW64\RunDll32.exeRunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 22⤵
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:2 WinX:0 WinY:0 IEFrame:000000003⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1120-139-0x0000000000000000-mapping.dmp
-
memory/1132-138-0x0000000000000000-mapping.dmp
-
memory/2012-137-0x0000000000000000-mapping.dmp
-
memory/2224-134-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2224-135-0x0000000000030000-0x0000000000033000-memory.dmpFilesize
12KB
-
memory/2224-140-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3852-136-0x0000000000000000-mapping.dmp