Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:51
Static task
static1
Behavioral task
behavioral1
Sample
5ace5208288f2437f4e6b5d7bb2aa5fdbf277f6124d7afe3b3d3f113e6987ec5.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5ace5208288f2437f4e6b5d7bb2aa5fdbf277f6124d7afe3b3d3f113e6987ec5.dll
Resource
win10v2004-20220901-en
General
-
Target
5ace5208288f2437f4e6b5d7bb2aa5fdbf277f6124d7afe3b3d3f113e6987ec5.dll
-
Size
135KB
-
MD5
b42396d9fa5989e9a4b60dad3ab26a92
-
SHA1
a8172766b7091459e974f434ed5e9fb680c4fa62
-
SHA256
5ace5208288f2437f4e6b5d7bb2aa5fdbf277f6124d7afe3b3d3f113e6987ec5
-
SHA512
937bfc9ada850ce6a66b22c8f4b38c6c8544ace525df0106fc90d9f1215bcde9fc3588b5d587ad321464cfa736f40a1fa720898a2d89fe5ae24a1089ecbb2160
-
SSDEEP
3072:48M77Il/0qyLq1uy0Bmlzip0uoCYPaSdmgMV2f+kaT8qaGyI:4l77It0qy213lipJCJmjVO3aT7ad
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5ace5208288f2437f4e6b5d7bb2aa5fdbf277f6124d7afe3b3d3f113e6987ec5 = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\5ace5208288f2437f4e6b5d7bb2aa5fdbf277f6124d7afe3b3d3f113e6987ec5.dll\",RicheditStreamIn" rundll32.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20EB2B01-6CC7-11ED-AE24-CE372EDB0509} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1880 iexplore.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
iexplore.exeIEXPLORE.EXErundll32.exepid process 1880 iexplore.exe 1880 iexplore.exe 1936 IEXPLORE.EXE 1936 IEXPLORE.EXE 2044 rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exeiexplore.exedescription pid process target process PID 1184 wrote to memory of 2044 1184 rundll32.exe rundll32.exe PID 1184 wrote to memory of 2044 1184 rundll32.exe rundll32.exe PID 1184 wrote to memory of 2044 1184 rundll32.exe rundll32.exe PID 1184 wrote to memory of 2044 1184 rundll32.exe rundll32.exe PID 1184 wrote to memory of 2044 1184 rundll32.exe rundll32.exe PID 1184 wrote to memory of 2044 1184 rundll32.exe rundll32.exe PID 1184 wrote to memory of 2044 1184 rundll32.exe rundll32.exe PID 1880 wrote to memory of 1936 1880 iexplore.exe IEXPLORE.EXE PID 1880 wrote to memory of 1936 1880 iexplore.exe IEXPLORE.EXE PID 1880 wrote to memory of 1936 1880 iexplore.exe IEXPLORE.EXE PID 1880 wrote to memory of 1936 1880 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5ace5208288f2437f4e6b5d7bb2aa5fdbf277f6124d7afe3b3d3f113e6987ec5.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5ace5208288f2437f4e6b5d7bb2aa5fdbf277f6124d7afe3b3d3f113e6987ec5.dll,#12⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2044
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1880 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2044-54-0x0000000000000000-mapping.dmp
-
memory/2044-55-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/2044-56-0x0000000000100000-0x0000000000113000-memory.dmpFilesize
76KB
-
memory/2044-57-0x0000000000170000-0x0000000000194000-memory.dmpFilesize
144KB
-
memory/2044-61-0x0000000010000000-0x0000000010024000-memory.dmpFilesize
144KB
-
memory/2044-62-0x0000000000100000-0x0000000000113000-memory.dmpFilesize
76KB