f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3

Analysis

max time kernel
133s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe
Size

1.7MB
MD5

9511f0e4ad12ef2e0650cbec3e184858
SHA1

165e6244713e88bbcb2b47e697c729a94f434641
SHA256

f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3
SHA512

8702da1f98650b8b01537117337cd7f89bee6d136444679a85e619549f5ffbb4220920eac259e6ddd8503205ced555fae74ab66287763c0810f942b1c0eb636a
SSDEEP

24576:IxGGo1AZLh9k8xkF/cTJq5C3RYRxoCAUF6XY/G4QgayCYRK+ILTfBLXSY4Qk:tn1+LhO8xkFkTJq5GCo9n9V7+Cdk

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmphp_sl_032.exehp_sl_032.tmpLabanSetHP.exe

pid process

1288 f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
2028 hp_sl_032.exe
756 hp_sl_032.tmp
1104 LabanSetHP.exe

pid	process
1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
2028	hp_sl_032.exe
756	hp_sl_032.tmp
1104	LabanSetHP.exe

Loads dropped DLL 8 IoCs

Processes:

f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exef9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmphp_sl_032.exehp_sl_032.tmp

pid	process
1284	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe
1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
2028	hp_sl_032.exe
756	hp_sl_032.tmp
756	hp_sl_032.tmp
756	hp_sl_032.tmp

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbro = "C:\\Users\\Admin\\AppData\\Local\\laban\\hp_sl_032.exe /VERYSILENT -ro"	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 5 IoCs

Processes:

hp_sl_032.tmp

description	ioc	process
File opened for modification	C:\Program Files (x86)\laban\laban.ico	hp_sl_032.tmp
File created	C:\Program Files (x86)\laban\unins000.dat	hp_sl_032.tmp
File created	C:\Program Files (x86)\laban\is-KUQQO.tmp	hp_sl_032.tmp
File opened for modification	C:\Program Files (x86)\laban\unins000.dat	hp_sl_032.tmp
File created	C:\Program Files (x86)\laban\laban.ico	hp_sl_032.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376183393"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000d760b998d4821c9df89f91c5c941fd640d93bab1c0cad1f855bec1575536220b000000000e80000000020000200000004e3555c14bd04301e2b5248d73bc1cfd627130f40a7860b8135aaab6b1622a8220000000d85d68b305e4fb81eef05d89828eef2f2527567785c8bb38b986cd71cecefb5e40000000f2f7af5a620629edc7e4940e0fff6e43c9c31fbe35eeb8d2aa66d82f6980937f76b4ddf54ace70ecb7799e25799a9077efa7c236900405cbf0f77e199d504fe6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B957BDE1-6D17-11ED-9201-42465D836E7B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\Total = "89"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\Total = "24"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\ = "89"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\ = "24"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "89"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000067bd13eab595b759f8ac98e399cfa0a79982a394a9a358002d81f8f42fcd6e68000000000e800000000200002000000087a783308b7e69b0eda0c4d2c0d08d1ad1613b79e7ef7c5d73f9805f71922637900000006b13966eb1f371008a0e1935ec97acaa5cec8bda7b28621f56d0eec2a221fa03cafcaefb4ca71434fc55b99a3b896cd761318be4585cba7111e346417cb08f4ee18e1e7e522c61e95c0baf562f01e21b7bde389ca2861a18e754cb6cd4e570a6460e4eefc56a6cf514bb889f489e474a2331fa04091bb900068c333d8c2fc7f1c1da3d0ebf481cd49a91e059f8b876a14000000025afe530af20b69fc9b6ca01ea51cd9aaf0a502d23f7d5a44f9d6e08b26fc52b40206a08f21b617cd6eb3aee9593fb406bb3b037b8e868e0f834b27bc9648329	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\laban.vn\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "24"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90cd09982401d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

LabanSetHP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.laban.vn/?utm_source=sl_032&u=8f66ac15363f7d7f0980079e9bc2fc8951c5&utm_campaign=202211"	LabanSetHP.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

hp_sl_032.tmp

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	hp_sl_032.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	hp_sl_032.tmp

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

hp_sl_032.tmp

pid process

756 hp_sl_032.tmp
756 hp_sl_032.tmp
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1612 IEXPLORE.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

hp_sl_032.tmpiexplore.exe

pid process

756 hp_sl_032.tmp
548 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

LabanSetHP.exeiexplore.exeIEXPLORE.EXE

pid process

1104 LabanSetHP.exe
1104 LabanSetHP.exe
548 iexplore.exe
548 iexplore.exe
1612 IEXPLORE.EXE
1612 IEXPLORE.EXE
1612 IEXPLORE.EXE
1612 IEXPLORE.EXE

pid	process
756	hp_sl_032.tmp
756	hp_sl_032.tmp

pid	process
1612	IEXPLORE.EXE

pid	process
756	hp_sl_032.tmp
548	iexplore.exe

pid	process
1104	LabanSetHP.exe
1104	LabanSetHP.exe
548	iexplore.exe
548	iexplore.exe
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE
1612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exef9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmphp_sl_032.exehp_sl_032.tmpiexplore.exe

description	pid	process	target process
PID 1284 wrote to memory of 1288	1284	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
PID 1284 wrote to memory of 1288	1284	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
PID 1284 wrote to memory of 1288	1284	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
PID 1284 wrote to memory of 1288	1284	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
PID 1284 wrote to memory of 1288	1284	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
PID 1284 wrote to memory of 1288	1284	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
PID 1284 wrote to memory of 1288	1284	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
PID 1288 wrote to memory of 2028	1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp	hp_sl_032.exe
PID 1288 wrote to memory of 2028	1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp	hp_sl_032.exe
PID 1288 wrote to memory of 2028	1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp	hp_sl_032.exe
PID 1288 wrote to memory of 2028	1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp	hp_sl_032.exe
PID 1288 wrote to memory of 2028	1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp	hp_sl_032.exe
PID 1288 wrote to memory of 2028	1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp	hp_sl_032.exe
PID 1288 wrote to memory of 2028	1288	f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp	hp_sl_032.exe
PID 2028 wrote to memory of 756	2028	hp_sl_032.exe	hp_sl_032.tmp
PID 2028 wrote to memory of 756	2028	hp_sl_032.exe	hp_sl_032.tmp
PID 2028 wrote to memory of 756	2028	hp_sl_032.exe	hp_sl_032.tmp
PID 2028 wrote to memory of 756	2028	hp_sl_032.exe	hp_sl_032.tmp
PID 2028 wrote to memory of 756	2028	hp_sl_032.exe	hp_sl_032.tmp
PID 2028 wrote to memory of 756	2028	hp_sl_032.exe	hp_sl_032.tmp
PID 2028 wrote to memory of 756	2028	hp_sl_032.exe	hp_sl_032.tmp
PID 756 wrote to memory of 1104	756	hp_sl_032.tmp	LabanSetHP.exe
PID 756 wrote to memory of 1104	756	hp_sl_032.tmp	LabanSetHP.exe
PID 756 wrote to memory of 1104	756	hp_sl_032.tmp	LabanSetHP.exe
PID 756 wrote to memory of 1104	756	hp_sl_032.tmp	LabanSetHP.exe
PID 756 wrote to memory of 548	756	hp_sl_032.tmp	iexplore.exe
PID 756 wrote to memory of 548	756	hp_sl_032.tmp	iexplore.exe
PID 756 wrote to memory of 548	756	hp_sl_032.tmp	iexplore.exe
PID 756 wrote to memory of 548	756	hp_sl_032.tmp	iexplore.exe
PID 548 wrote to memory of 1612	548	iexplore.exe	IEXPLORE.EXE
PID 548 wrote to memory of 1612	548	iexplore.exe	IEXPLORE.EXE
PID 548 wrote to memory of 1612	548	iexplore.exe	IEXPLORE.EXE
PID 548 wrote to memory of 1612	548	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe
"C:\Users\Admin\AppData\Local\Temp\f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284

C:\Users\Admin\AppData\Local\Temp\is-DE9AH.tmp\f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-DE9AH.tmp\f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp" /SL5="$80022,1324747,146432,C:\Users\Admin\AppData\Local\Temp\f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\Temp\is-T313O.tmp\hp_sl_032.exe
"C:\Users\Admin\AppData\Local\Temp\is-T313O.tmp\hp_sl_032.exe" /VERYSILENT
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Local\Temp\is-N458T.tmp\hp_sl_032.tmp
"C:\Users\Admin\AppData\Local\Temp\is-N458T.tmp\hp_sl_032.tmp" /SL5="$20156,792154,146432,C:\Users\Admin\AppData\Local\Temp\is-T313O.tmp\hp_sl_032.exe" /VERYSILENT
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:756

C:\Users\Admin\AppData\Local\Temp\is-GFVDA.tmp\LabanSetHP.exe
"C:\Users\Admin\AppData\Local\Temp\is-GFVDA.tmp\LabanSetHP.exe" -url "http://www.laban.vn/?utm_source=sl_032&u=8f66ac15363f7d7f0980079e9bc2fc8951c5&utm_campaign=202211"
5⤵
- Executes dropped EXE
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
PID:1104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.laban.vn/?utm_source=sl_032&a=1&time=25-11-2022-23-20-18&h=652d43915051bf5be8d06590c89ca568
5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:548 CREDAT:275457 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
cf0b00a0a9fc532840fa7a2b9adf21f2

SHA1
d7127fd9e8d3427c9abb46fee2c52ca32b5912b8

SHA256
ed49b41a1d0decc3fbf9fbf0f22d864c4b7b3c2f18b9a9ebed40ca4062fffab5

SHA512
f86b1c47197e92a7188b96e61d7d3769f3e81b8fe59d264521a332c45b3afa478e1bbfadd416c2791c9d5285ba464e0a7b2cd5946386e42d9183be5e1371dda4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
379014c325293bf8a39e94d89d9a5cec

SHA1
19e44e611cc4e3b57bbedf70352498967ac7c83e

SHA256
71ae9e8a25101d3cd96a37a3df3e9d5ac4e7b759b19d89fe33bdbff06b247013

SHA512
343965727ec67e9240b235c7b449fba601c727807da0acfc7819466e95c71064b94cbb4f8464a768b637c2e88f0f2f5df04c1fa07be3fd1211d22947133e45ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
5KB

MD5
2978d3c8e3dd1b1f0be935192629150e

SHA1
ac1e29caa137ab6676df5eb45262b1a2f176ccf7

SHA256
90568399ab72a890211843aa227d7b8d1de87274fdf2e121700b1398e0ebea87

SHA512
7f5dce60eeb3a173b7951adf132b4a778e6d056075a6c3fbe2dfaf04ddbf2adf6afca01d5f9d128da171173210e6d87697d484008d176861043e50a990db4baf

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DE9AH.tmp\f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GFVDA.tmp\LabanSetHP.exe
Filesize
1.7MB

MD5
d491a742a2a54416a73b67027940a3e7

SHA1
4982d92761b50ff30b2b1ae430202f2d3e41b87e

SHA256
2b8d01c7db378909bf28697bcbe6f31f5bfd6249ec2897ea07695f3f7a323141

SHA512
1ee252bc796587d43150a9587d83a07083444374ac7ae346bbb82013b6b1c270c77a5a654aa55996b20cd049b88af3d1c5c53cb40f0424ece28ba02f25d3aa8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GFVDA.tmp\LabanSetHP.exe
Filesize
1.7MB

MD5
d491a742a2a54416a73b67027940a3e7

SHA1
4982d92761b50ff30b2b1ae430202f2d3e41b87e

SHA256
2b8d01c7db378909bf28697bcbe6f31f5bfd6249ec2897ea07695f3f7a323141

SHA512
1ee252bc796587d43150a9587d83a07083444374ac7ae346bbb82013b6b1c270c77a5a654aa55996b20cd049b88af3d1c5c53cb40f0424ece28ba02f25d3aa8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N458T.tmp\hp_sl_032.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N458T.tmp\hp_sl_032.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T313O.tmp\hp_sl_032.exe
Filesize
1.2MB

MD5
1ad76aa2acbb9ed6c5ab1a7558b7abc9

SHA1
7d8a4e9be8b7f14f2aea3e661103576f98180d6c

SHA256
e50b30e52888befc8e0820ad2c0a0aa99837dfe0a81fe83632b2bd54148cf51a

SHA512
236fc2446564f6a374aca27bbcad682c3e76d2a792d445e8cb62f625592e82e426dc7aa6d23fa4a42ad33d2e74605adc261e3fe18e82611d4e82e2a35fbc0122

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-T313O.tmp\hp_sl_032.exe
Filesize
1.2MB

MD5
1ad76aa2acbb9ed6c5ab1a7558b7abc9

SHA1
7d8a4e9be8b7f14f2aea3e661103576f98180d6c

SHA256
e50b30e52888befc8e0820ad2c0a0aa99837dfe0a81fe83632b2bd54148cf51a

SHA512
236fc2446564f6a374aca27bbcad682c3e76d2a792d445e8cb62f625592e82e426dc7aa6d23fa4a42ad33d2e74605adc261e3fe18e82611d4e82e2a35fbc0122

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WNFDZA5Z.txt
Filesize
607B

MD5
e6cb022255b181786ddc7f8c2aaa875d

SHA1
888d584d0f0962c551246f87c6ee6f3291da1b64

SHA256
fac117718ac22d338e67d0384823c124d1aa0061f12bb80d9cf4ad3f879a4755

SHA512
2f0f48c3a4791cda73d75a57914642f816ba8eb4d63b218dcd40d70fabb7413318cc2483ec48e70e59cecacfe1a4cce63dfd4061aad5ddeddbef9bcc7cc9a1aa

Download Submit
\Users\Admin\AppData\Local\Temp\is-DE9AH.tmp\f9fc23c50b76e436b45ee9def3a8f03ef5c73e817a293d6ffeb92cdda97179a3.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
\Users\Admin\AppData\Local\Temp\is-GFVDA.tmp\LabanSetHP.exe
Filesize
1.7MB

MD5
d491a742a2a54416a73b67027940a3e7

SHA1
4982d92761b50ff30b2b1ae430202f2d3e41b87e

SHA256
2b8d01c7db378909bf28697bcbe6f31f5bfd6249ec2897ea07695f3f7a323141

SHA512
1ee252bc796587d43150a9587d83a07083444374ac7ae346bbb82013b6b1c270c77a5a654aa55996b20cd049b88af3d1c5c53cb40f0424ece28ba02f25d3aa8b

Download Submit
\Users\Admin\AppData\Local\Temp\is-GFVDA.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-GFVDA.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-N458T.tmp\hp_sl_032.tmp
Filesize
1.1MB

MD5
6ecdf734b960fbe44aed1d25d832d474

SHA1
2a4d9f35e753ca019f8c720d124c89b0ec063f35

SHA256
468d8f9a4aa098aa8850e57d483858abd5278cdaf5136cfc0c5c3bb3d93b6178

SHA512
e69c989938a736f584f7613fce62bdd0526b2a220805880807c984245c5fef473bd879341df75ea4f6aae81862caba1ecd297856d25be8ed9661df711cf80202

Download Submit
\Users\Admin\AppData\Local\Temp\is-T313O.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-T313O.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-T313O.tmp\hp_sl_032.exe
Filesize
1.2MB

MD5
1ad76aa2acbb9ed6c5ab1a7558b7abc9

SHA1
7d8a4e9be8b7f14f2aea3e661103576f98180d6c

SHA256
e50b30e52888befc8e0820ad2c0a0aa99837dfe0a81fe83632b2bd54148cf51a

SHA512
236fc2446564f6a374aca27bbcad682c3e76d2a792d445e8cb62f625592e82e426dc7aa6d23fa4a42ad33d2e74605adc261e3fe18e82611d4e82e2a35fbc0122

Download Submit
memory/756-71-0x0000000000000000-mapping.dmp

Download
memory/756-82-0x0000000074C61000-0x0000000074C63000-memory.dmp

Filesize
8KB

Download
memory/1104-79-0x0000000000000000-mapping.dmp

Download
memory/1284-86-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1284-76-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1284-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1284-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1288-58-0x0000000000000000-mapping.dmp

Download
memory/2028-67-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-64-0x0000000000000000-mapping.dmp

Download
memory/2028-85-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2028-77-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download