Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 18:30
Static task
static1
Behavioral task
behavioral1
Sample
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe
Resource
win10v2004-20221111-en
General
-
Target
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe
-
Size
152KB
-
MD5
42d3f8095ee81957884ace52a36da770
-
SHA1
576d8e441be5159240c8a42568518f09a8f7963c
-
SHA256
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0
-
SHA512
be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d
-
SSDEEP
1536:ryUhRUuyTgLMk2DaTvLvpH+hhTQ2+7Sn7qdZ9h4MVSDoL:rBsh0gJavYv+7oqdZ3HVS
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Zyxixh.exeZyxixh.exepid process 1648 Zyxixh.exe 580 Zyxixh.exe -
Loads dropped DLL 2 IoCs
Processes:
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exepid process 872 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe 872 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zyxixh = "C:\\Users\\Admin\\AppData\\Roaming\\Zyxixh.exe" d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exeZyxixh.exedescription pid process target process PID 1748 set thread context of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1648 set thread context of 580 1648 Zyxixh.exe Zyxixh.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B9E813A1-6B77-11ED-B875-663367632C22} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376004743" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exepid process 872 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Zyxixh.exeIEXPLORE.EXEdescription pid process Token: SeDebugPrivilege 580 Zyxixh.exe Token: SeDebugPrivilege 940 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1776 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEpid process 1776 IEXPLORE.EXE 1776 IEXPLORE.EXE 940 IEXPLORE.EXE 940 IEXPLORE.EXE 940 IEXPLORE.EXE 940 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exed8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exeZyxixh.exeZyxixh.exeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 1748 wrote to memory of 872 1748 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe PID 872 wrote to memory of 1648 872 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe Zyxixh.exe PID 872 wrote to memory of 1648 872 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe Zyxixh.exe PID 872 wrote to memory of 1648 872 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe Zyxixh.exe PID 872 wrote to memory of 1648 872 d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 1648 wrote to memory of 580 1648 Zyxixh.exe Zyxixh.exe PID 580 wrote to memory of 1108 580 Zyxixh.exe iexplore.exe PID 580 wrote to memory of 1108 580 Zyxixh.exe iexplore.exe PID 580 wrote to memory of 1108 580 Zyxixh.exe iexplore.exe PID 580 wrote to memory of 1108 580 Zyxixh.exe iexplore.exe PID 1108 wrote to memory of 1776 1108 iexplore.exe IEXPLORE.EXE PID 1108 wrote to memory of 1776 1108 iexplore.exe IEXPLORE.EXE PID 1108 wrote to memory of 1776 1108 iexplore.exe IEXPLORE.EXE PID 1108 wrote to memory of 1776 1108 iexplore.exe IEXPLORE.EXE PID 1776 wrote to memory of 940 1776 IEXPLORE.EXE IEXPLORE.EXE PID 1776 wrote to memory of 940 1776 IEXPLORE.EXE IEXPLORE.EXE PID 1776 wrote to memory of 940 1776 IEXPLORE.EXE IEXPLORE.EXE PID 1776 wrote to memory of 940 1776 IEXPLORE.EXE IEXPLORE.EXE PID 580 wrote to memory of 940 580 Zyxixh.exe IEXPLORE.EXE PID 580 wrote to memory of 940 580 Zyxixh.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe"C:\Users\Admin\AppData\Local\Temp\d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe"C:\Users\Admin\AppData\Local\Temp\d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Roaming\Zyxixh.exe"C:\Users\Admin\AppData\Roaming\Zyxixh.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Users\Admin\AppData\Roaming\Zyxixh.exe"C:\Users\Admin\AppData\Roaming\Zyxixh.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:27⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:940
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD57315b79b19811d018793155f0c4be36e
SHA18ae4959a6a7650b77cd13c71793e252d00eb2235
SHA256acfd0bff5b629bb533258a64a8010d6ccb5640977d1546be8bbdac6073982974
SHA512f88952099d8d09c2399e92adde59ff01cbd092c533d520436096c3c12aa92e3df3d741098fb76f6f4ec669f2fa9e54769b11c3117bded4a63ffee0339f879b3b
-
Filesize
152KB
MD542d3f8095ee81957884ace52a36da770
SHA1576d8e441be5159240c8a42568518f09a8f7963c
SHA256d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0
SHA512be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d
-
Filesize
152KB
MD542d3f8095ee81957884ace52a36da770
SHA1576d8e441be5159240c8a42568518f09a8f7963c
SHA256d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0
SHA512be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d
-
Filesize
152KB
MD542d3f8095ee81957884ace52a36da770
SHA1576d8e441be5159240c8a42568518f09a8f7963c
SHA256d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0
SHA512be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d
-
Filesize
152KB
MD542d3f8095ee81957884ace52a36da770
SHA1576d8e441be5159240c8a42568518f09a8f7963c
SHA256d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0
SHA512be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d
-
Filesize
152KB
MD542d3f8095ee81957884ace52a36da770
SHA1576d8e441be5159240c8a42568518f09a8f7963c
SHA256d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0
SHA512be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d