Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe
Resource
win10v2004-20220812-en
General
-
Target
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe
-
Size
182KB
-
MD5
80bc0154f11ae4eef55b00c464ae1723
-
SHA1
312fe24ecf4c6d84ef7d05a8c3ae85230920b884
-
SHA256
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e
-
SHA512
198de65ec5764acf57223c1e8059786bfe8176145e1ecddd17ffc906ccb05c17d2ff483922f56a45df8f49629e5bc7137e54555c4b2aa193c772e7342d6aa12a
-
SSDEEP
3072:QGO+VHFPy4q+og2XLD9ryWacSMnqBSMVHjRcg:QeVHiJg69GWaSq8Mpdc
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xgvbvy = "C:\\Users\\Admin\\AppData\\Roaming\\Xgvbvy.exe" iexplore.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
iexplore.exedescription ioc process File opened (read-only) \??\D: iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exedescription pid process target process PID 3372 set thread context of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "366490499" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F9FBECF6-6CD2-11ED-AECB-E62BBF623C53} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXepid process 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
IEXPLORE.EXEpid process 1772 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXeiexplore.exedescription pid process Token: SeDebugPrivilege 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe Token: SeDebugPrivilege 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe Token: SeDebugPrivilege 1340 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
IEXPLORE.EXEpid process 1772 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exeIEXPLORE.EXEIEXPLORE.EXEpid process 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 1772 IEXPLORE.EXE 1772 IEXPLORE.EXE 3408 IEXPLORE.EXE 3408 IEXPLORE.EXE 3408 IEXPLORE.EXE 3408 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXeiexplore.exeIEXPLORE.EXEdescription pid process target process PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 3372 wrote to memory of 4956 3372 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe PID 4956 wrote to memory of 1340 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 4956 wrote to memory of 1340 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 4956 wrote to memory of 1340 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 1340 wrote to memory of 1772 1340 iexplore.exe IEXPLORE.EXE PID 1340 wrote to memory of 1772 1340 iexplore.exe IEXPLORE.EXE PID 4956 wrote to memory of 1340 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 4956 wrote to memory of 1340 4956 286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe iexplore.exe PID 1772 wrote to memory of 3408 1772 IEXPLORE.EXE IEXPLORE.EXE PID 1772 wrote to memory of 3408 1772 IEXPLORE.EXE IEXPLORE.EXE PID 1772 wrote to memory of 3408 1772 IEXPLORE.EXE IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe"C:\Users\Admin\AppData\Local\Temp\286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe"C:\Users\Admin\AppData\Local\Temp\286e7722e1e028c61bfe0c886f65798b293ef81b56807373bbdce09800b6c16e.eXe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3372-132-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/4956-135-0x0000000000000000-mapping.dmp
-
memory/4956-136-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4956-138-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4956-139-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4956-140-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4956-141-0x00000000022A0000-0x00000000022EE000-memory.dmpFilesize
312KB