232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe
Size

1.7MB
MD5

cfc93e127ae1ad3c96ede8c1ae851adc
SHA1

5533de5de014062a1b6aecad05f07d73435ebb3b
SHA256

232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d
SHA512

8ac3b6e400bb172533713e14afc93fc242d3305104464600b2ffa101f05998f26db606ae6740d92518e8ee9de599f613deee7ee4da94c6070b49d3131f96f85c
SSDEEP

49152:th1cpLXWaZ0VGPJqv9jxdyQngUbV7+Cdk:d0UVGPJmdxdzngUl+Cdk

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmphp_ssh.exehp_ssh.tmpLabanSetHP.exe

pid process

944 232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
892 hp_ssh.exe
1248 hp_ssh.tmp
1120 LabanSetHP.exe

pid	process
944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
892	hp_ssh.exe
1248	hp_ssh.tmp
1120	LabanSetHP.exe

Loads dropped DLL 8 IoCs

Processes:

232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmphp_ssh.exehp_ssh.tmp

pid	process
1368	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe
944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
892	hp_ssh.exe
1248	hp_ssh.tmp
1248	hp_ssh.tmp
1248	hp_ssh.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbro = "C:\\Users\\Admin\\AppData\\Local\\laban\\hp_ssh.exe /VERYSILENT -ro"	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

Processes:

hp_ssh.tmp

description	ioc	process
File created	C:\Program Files (x86)\laban\unins000.dat	hp_ssh.tmp
File created	C:\Program Files (x86)\laban\is-43T5O.tmp	hp_ssh.tmp
File opened for modification	C:\Program Files (x86)\laban\unins000.dat	hp_ssh.tmp
File created	C:\Program Files (x86)\laban\laban.ico	hp_ssh.tmp
File opened for modification	C:\Program Files (x86)\laban\laban.ico	hp_ssh.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8EDC111-6D17-11ED-954F-D29BCC0F3FEF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000002757b132c31eaba59703ed3753cda21c3c2aa544481183e2fc0083854b4b6b3a000000000e8000000002000020000000b293d60004940a40fae9ba98ef43cad7fcff9f166ea54e06cd339ae2530dfbd3200000006909a36d2f84bef75a7faf19c84741f5aa215e94b5dadc1069c2c63ff099c823400000001da5410ba61a544ee8aaf9b60e2701c5f25cf1a5c4a5d306d79a589586b340cceeedfcaebbd10810af43f02559f0a74f332e5067a634b07919f029eb37ac6a29	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b756a32401d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\ = "24"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "24"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\Total = "89"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\Total = "24"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "89"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000008bb1fe32ce8e931935e33da2ba025cae5933a868eb2d0f455cbc6be6f90244000000000e800000000200002000000078ee120cb119541731d6349a07bc7ec190b9e2141735644753d5d24e587e13d990000000fadf6ed0233fa7c8ecb3842f82a483e0f3655f18400a7c71ae1f51b63299d8ee3378bc9b533f04ee91445b60c98b3aef3e92d2ffd6d659bf3bf093ca7125dbfa3b0812d5d9086604e34725e404ee28a39b79dad76d412a9989e52e656c2d4205a224dc029653d78ba63a528bae36569820575f0ea3df827aac72e690894ba0e84e6bb0703d5d80b07d8688769ac3f99e40000000e559f76e58dc8b8735ce1fd549153f51a594937b31a649c9e8eef535e86f514a8abd2cfafb45428f6bedc54e92116f6bfa1d9ea1d63e36e69f155076a97b8551	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\ = "89"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376183393"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

LabanSetHP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.laban.vn/?utm_source=ssh&u=868d3416c46bcaa3cd659fed756115e01913&utm_campaign=202211"	LabanSetHP.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

hp_ssh.tmp

pid process

1248 hp_ssh.tmp
1248 hp_ssh.tmp
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2040 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

hp_ssh.tmpiexplore.exe

pid process

1248 hp_ssh.tmp
1692 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

LabanSetHP.exeiexplore.exeIEXPLORE.EXE

pid process

1120 LabanSetHP.exe
1120 LabanSetHP.exe
1692 iexplore.exe
1692 iexplore.exe
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE

pid	process
1248	hp_ssh.tmp
1248	hp_ssh.tmp

pid	process
2040	IEXPLORE.EXE

pid	process
1248	hp_ssh.tmp
1692	iexplore.exe

pid	process
1120	LabanSetHP.exe
1120	LabanSetHP.exe
1692	iexplore.exe
1692	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmphp_ssh.exehp_ssh.tmpiexplore.exe

description	pid	process	target process
PID 1368 wrote to memory of 944	1368	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
PID 1368 wrote to memory of 944	1368	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
PID 1368 wrote to memory of 944	1368	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
PID 1368 wrote to memory of 944	1368	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
PID 1368 wrote to memory of 944	1368	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
PID 1368 wrote to memory of 944	1368	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
PID 1368 wrote to memory of 944	1368	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
PID 944 wrote to memory of 892	944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp	hp_ssh.exe
PID 944 wrote to memory of 892	944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp	hp_ssh.exe
PID 944 wrote to memory of 892	944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp	hp_ssh.exe
PID 944 wrote to memory of 892	944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp	hp_ssh.exe
PID 944 wrote to memory of 892	944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp	hp_ssh.exe
PID 944 wrote to memory of 892	944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp	hp_ssh.exe
PID 944 wrote to memory of 892	944	232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp	hp_ssh.exe
PID 892 wrote to memory of 1248	892	hp_ssh.exe	hp_ssh.tmp
PID 892 wrote to memory of 1248	892	hp_ssh.exe	hp_ssh.tmp
PID 892 wrote to memory of 1248	892	hp_ssh.exe	hp_ssh.tmp
PID 892 wrote to memory of 1248	892	hp_ssh.exe	hp_ssh.tmp
PID 892 wrote to memory of 1248	892	hp_ssh.exe	hp_ssh.tmp
PID 892 wrote to memory of 1248	892	hp_ssh.exe	hp_ssh.tmp
PID 892 wrote to memory of 1248	892	hp_ssh.exe	hp_ssh.tmp
PID 1248 wrote to memory of 1120	1248	hp_ssh.tmp	LabanSetHP.exe
PID 1248 wrote to memory of 1120	1248	hp_ssh.tmp	LabanSetHP.exe
PID 1248 wrote to memory of 1120	1248	hp_ssh.tmp	LabanSetHP.exe
PID 1248 wrote to memory of 1120	1248	hp_ssh.tmp	LabanSetHP.exe
PID 1248 wrote to memory of 1692	1248	hp_ssh.tmp	iexplore.exe
PID 1248 wrote to memory of 1692	1248	hp_ssh.tmp	iexplore.exe
PID 1248 wrote to memory of 1692	1248	hp_ssh.tmp	iexplore.exe
PID 1248 wrote to memory of 1692	1248	hp_ssh.tmp	iexplore.exe
PID 1692 wrote to memory of 2040	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2040	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2040	1692	iexplore.exe	IEXPLORE.EXE
PID 1692 wrote to memory of 2040	1692	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe
"C:\Users\Admin\AppData\Local\Temp\232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Local\Temp\is-E8AUO.tmp\232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
"C:\Users\Admin\AppData\Local\Temp\is-E8AUO.tmp\232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp" /SL5="$70120,1325315,146432,C:\Users\Admin\AppData\Local\Temp\232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:944

C:\Users\Admin\AppData\Local\Temp\is-T76CB.tmp\hp_ssh.exe
"C:\Users\Admin\AppData\Local\Temp\is-T76CB.tmp\hp_ssh.exe" /VERYSILENT -tk -fid
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:892

C:\Users\Admin\AppData\Local\Temp\is-J69VR.tmp\hp_ssh.tmp
"C:\Users\Admin\AppData\Local\Temp\is-J69VR.tmp\hp_ssh.tmp" /SL5="$90158,792154,146432,C:\Users\Admin\AppData\Local\Temp\is-T76CB.tmp\hp_ssh.exe" /VERYSILENT -tk -fid
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\is-OJONI.tmp\LabanSetHP.exe
"C:\Users\Admin\AppData\Local\Temp\is-OJONI.tmp\LabanSetHP.exe" -url "http://www.laban.vn/?utm_source=ssh&u=868d3416c46bcaa3cd659fed756115e01913&utm_campaign=202211"
5⤵
- Executes dropped EXE
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:1120

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.laban.vn/?utm_source=ssh&a=1&time=25-11-2022-23-20-18&h=061bc155a4860503249241922a98caea
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
eef24660b268b2b8d073ba353673977b

SHA1
fca92a163935e81bc0b4645bb28ec477396f177c

SHA256
4ef3350ed9a0bee9de55113f1dd6abda300eb33247c32a7ce207b0d354d0df1c

SHA512
9c629e4ccc7ea328ce44885c08f4a57e5edc0e55e5769efb247e182d957b6f0ef9ab2d551b889a47aea4ec0173b078de9a30d29563b0e07f19374f0e353cb816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
5KB

MD5
f947bcf5d657ccdae7405ad46ee37fc8

SHA1
0a4dd19fda806c43cff2bb402a20dc27c9b378d3

SHA256
5f2c6683d9f14cb15d7bb80cebf2490b9c1cce48cb3d020fd5593bd8fa411de2

SHA512
688ea30ba08b8c06bc48319740eb205a8960f09c3065876e8bf88f865616c44334e84f1f6b8d5002a71dcb44ff4ac06b5e92ee8c0b277f2980b8f4355816c282

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-E8AUO.tmp\232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J69VR.tmp\hp_ssh.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-J69VR.tmp\hp_ssh.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OJONI.tmp\LabanSetHP.exe
Filesize
1.7MB

MD5
d491a742a2a54416a73b67027940a3e7

SHA1
4982d92761b50ff30b2b1ae430202f2d3e41b87e

SHA256
2b8d01c7db378909bf28697bcbe6f31f5bfd6249ec2897ea07695f3f7a323141

SHA512
1ee252bc796587d43150a9587d83a07083444374ac7ae346bbb82013b6b1c270c77a5a654aa55996b20cd049b88af3d1c5c53cb40f0424ece28ba02f25d3aa8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OJONI.tmp\LabanSetHP.exe
Filesize
1.7MB

MD5
d491a742a2a54416a73b67027940a3e7

SHA1
4982d92761b50ff30b2b1ae430202f2d3e41b87e

SHA256
2b8d01c7db378909bf28697bcbe6f31f5bfd6249ec2897ea07695f3f7a323141

SHA512
1ee252bc796587d43150a9587d83a07083444374ac7ae346bbb82013b6b1c270c77a5a654aa55996b20cd049b88af3d1c5c53cb40f0424ece28ba02f25d3aa8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T76CB.tmp\hp_ssh.exe
Filesize
1.2MB

MD5
b986bb23472a690424f26f91ecd0e536

SHA1
67c5e517be834aea2be45a114bd016462ed76bbd

SHA256
76c35b5fd8bbf9406a457f5dd62071b76e72d6844d5b6ee7c4374bedb8a1ca21

SHA512
a5962c88e88b7c5260efa50ff6563a31f20d1a80913c9ecfc6e2c6d0c765fc3d35bea663afeecaf843c4a12dd7c54748179fa0bcaca020b0e3652a483da05147

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T76CB.tmp\hp_ssh.exe
Filesize
1.2MB

MD5
b986bb23472a690424f26f91ecd0e536

SHA1
67c5e517be834aea2be45a114bd016462ed76bbd

SHA256
76c35b5fd8bbf9406a457f5dd62071b76e72d6844d5b6ee7c4374bedb8a1ca21

SHA512
a5962c88e88b7c5260efa50ff6563a31f20d1a80913c9ecfc6e2c6d0c765fc3d35bea663afeecaf843c4a12dd7c54748179fa0bcaca020b0e3652a483da05147

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8D0UI72P.txt
Filesize
607B

MD5
e7a9b43a01015d6c7e5b0ee297e043d2

SHA1
6662505ff5920f81dde23cd440f0904c1f6fcf2b

SHA256
6be4cea22701e01e6e4c6451260c307550afdc7afb4a8e0f98bed2460bb1c286

SHA512
85db244c5da1548713bd4ebb1a7750b08638b8531bdc7b17d0584b198cf04fd8be90fb787c93005f5d6d36834762aace361d0593a276d397054fd13cafbd496d

Download Submit
\Users\Admin\AppData\Local\Temp\is-E8AUO.tmp\232b4e58becd79be3ce78ff0e244e6b193fb0f2feb80880274e04291d029813d.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
\Users\Admin\AppData\Local\Temp\is-J69VR.tmp\hp_ssh.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
\Users\Admin\AppData\Local\Temp\is-OJONI.tmp\LabanSetHP.exe
Filesize
1.7MB

MD5
d491a742a2a54416a73b67027940a3e7

SHA1
4982d92761b50ff30b2b1ae430202f2d3e41b87e

SHA256
2b8d01c7db378909bf28697bcbe6f31f5bfd6249ec2897ea07695f3f7a323141

SHA512
1ee252bc796587d43150a9587d83a07083444374ac7ae346bbb82013b6b1c270c77a5a654aa55996b20cd049b88af3d1c5c53cb40f0424ece28ba02f25d3aa8b

Download Submit
\Users\Admin\AppData\Local\Temp\is-OJONI.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-OJONI.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-T76CB.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-T76CB.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-T76CB.tmp\hp_ssh.exe
Filesize
1.2MB

MD5
b986bb23472a690424f26f91ecd0e536

SHA1
67c5e517be834aea2be45a114bd016462ed76bbd

SHA256
76c35b5fd8bbf9406a457f5dd62071b76e72d6844d5b6ee7c4374bedb8a1ca21

SHA512
a5962c88e88b7c5260efa50ff6563a31f20d1a80913c9ecfc6e2c6d0c765fc3d35bea663afeecaf843c4a12dd7c54748179fa0bcaca020b0e3652a483da05147

Download Submit
memory/892-77-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/892-67-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/892-85-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/892-64-0x0000000000000000-mapping.dmp

Download
memory/944-58-0x0000000000000000-mapping.dmp

Download
memory/1120-79-0x0000000000000000-mapping.dmp

Download
memory/1248-82-0x0000000074021000-0x0000000074023000-memory.dmp

Filesize
8KB

Download
memory/1248-71-0x0000000000000000-mapping.dmp

Download
memory/1368-76-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1368-86-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download