Analysis
-
max time kernel
131s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 08:59
Static task
static1
Behavioral task
behavioral1
Sample
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe
Resource
win10v2004-20220812-en
General
-
Target
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe
-
Size
45KB
-
MD5
4bc849538b01eb61b47c3432c13482e0
-
SHA1
232c7dddcbb3cac9db72c2fa446c5cd39bb35a13
-
SHA256
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767
-
SHA512
362787d9d11ba8c50835050c39b6aa2946f2112bdb4eecc2b6c3bee23fcb786479431210bfba0e95600f684e9c0e917054e62f1df9995435f12bda983d22f7ce
-
SSDEEP
768:nm+G8YMyvdQrvJsnkgJFnvQ4BONDX0rnskgBorVzRHyGnRC2/1H5Vi:nmjxvOzCvvo4BcX01gBorVzciCc
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe -
Executes dropped EXE 1 IoCs
Processes:
Iebogk32.exepid process 604 Iebogk32.exe -
Loads dropped DLL 2 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exepid process 1292 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe 1292 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe -
Drops file in System32 directory 3 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exedescription ioc process File created C:\Windows\SysWOW64\Iebogk32.exe b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe File opened for modification C:\Windows\SysWOW64\Iebogk32.exe b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe File created C:\Windows\SysWOW64\Hfnfhdjc.dll b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
Iebogk32.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess Iebogk32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess = "yes" Iebogk32.exe -
Modifies registry class 6 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfnfhdjc.dll" b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Iebogk32.exepid process 604 Iebogk32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exedescription pid process target process PID 1292 wrote to memory of 604 1292 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Iebogk32.exe PID 1292 wrote to memory of 604 1292 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Iebogk32.exe PID 1292 wrote to memory of 604 1292 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Iebogk32.exe PID 1292 wrote to memory of 604 1292 b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe Iebogk32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe"C:\Users\Admin\AppData\Local\Temp\b13940f41cde4f6b2d967335899cf23a25f41c885669347c636d9cbd9493d767.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Iebogk32.exeC:\Windows\system32\Iebogk32.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Iebogk32.exeFilesize
45KB
MD57f9a971cd59311f7ce66969a1b211b1d
SHA13693485816ad16a6cb1ef1b6ab706731c83d3976
SHA256f3f2cf4caa5f640930113415a4aa79d2085b34bf708871c4eb766fb31cd7a102
SHA5128699c72ab605a7e272026f9ad64819f6d8857e9179ea0b6e112caf5e3b439d2c083e08cabbc0edfa9ab737c62f61dc795966d09b6fd2dc3d505003f7f8268624
-
\Windows\SysWOW64\Iebogk32.exeFilesize
45KB
MD57f9a971cd59311f7ce66969a1b211b1d
SHA13693485816ad16a6cb1ef1b6ab706731c83d3976
SHA256f3f2cf4caa5f640930113415a4aa79d2085b34bf708871c4eb766fb31cd7a102
SHA5128699c72ab605a7e272026f9ad64819f6d8857e9179ea0b6e112caf5e3b439d2c083e08cabbc0edfa9ab737c62f61dc795966d09b6fd2dc3d505003f7f8268624
-
\Windows\SysWOW64\Iebogk32.exeFilesize
45KB
MD57f9a971cd59311f7ce66969a1b211b1d
SHA13693485816ad16a6cb1ef1b6ab706731c83d3976
SHA256f3f2cf4caa5f640930113415a4aa79d2085b34bf708871c4eb766fb31cd7a102
SHA5128699c72ab605a7e272026f9ad64819f6d8857e9179ea0b6e112caf5e3b439d2c083e08cabbc0edfa9ab737c62f61dc795966d09b6fd2dc3d505003f7f8268624
-
memory/604-58-0x0000000000000000-mapping.dmp
-
memory/604-60-0x0000000074FD1000-0x0000000074FD3000-memory.dmpFilesize
8KB
-
memory/604-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/604-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1292-55-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1292-56-0x0000000000220000-0x000000000024F000-memory.dmpFilesize
188KB