Analysis
-
max time kernel
175s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 10:47
Static task
static1
Behavioral task
behavioral1
Sample
0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe
-
Size
280KB
-
MD5
12dd15c9f7cfb47a66b1dac85538a1c8
-
SHA1
90632644dce5818b5a4c4e582a6ba58b0a713662
-
SHA256
0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728
-
SHA512
09f619b1e5b98355f59d2a9723786723cc92fd755e6804a3ef4f0f004042293f89f451d8964f2bbef001c825d88cf633552fb3fb4639702655131849bf46515b
-
SSDEEP
6144:SbRKBQFcxM2msySPRIX8lSr8dahmYqKPNYYrADbfETqU6Qmuk3P:EIuOxM4RIslSQdBKNJrA3flFuE
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe -
Drops file in Windows directory 1 IoCs
Processes:
0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exedescription ioc process File opened for modification C:\Windows\jpfw2642.dll 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe -
Modifies registry class 2 IoCs
Processes:
0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PerkyNews.clsPerkyNews\Clsid 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PerkyNews.clsPerkyNews 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exepid process 4468 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.execmd.exedescription pid process target process PID 4468 wrote to memory of 2384 4468 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe cmd.exe PID 4468 wrote to memory of 2384 4468 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe cmd.exe PID 4468 wrote to memory of 2384 4468 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe cmd.exe PID 2384 wrote to memory of 116 2384 cmd.exe reg.exe PID 2384 wrote to memory of 116 2384 cmd.exe reg.exe PID 2384 wrote to memory of 116 2384 cmd.exe reg.exe PID 4468 wrote to memory of 1476 4468 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe regsvr32.exe PID 4468 wrote to memory of 1476 4468 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe regsvr32.exe PID 4468 wrote to memory of 1476 4468 0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe regsvr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe"C:\Users\Admin\AppData\Local\Temp\0faa3ec8135ca39680f49453f9168e6306a8ee6c70d9a7d1def1a30108671728.exe"1⤵
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADDHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System/v EnableLUA /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADDHKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System/v EnableLUA /t REG_DWORD /d 0 /f3⤵PID:116
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s C:\Windows\jpfw2642.dll2⤵PID:1476