Analysis
-
max time kernel
140s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 08:59
Static task
static1
Behavioral task
behavioral1
Sample
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe
Resource
win10v2004-20220812-en
General
-
Target
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe
-
Size
45KB
-
MD5
ae0322d5bec92f0f3f9d8f82075418a0
-
SHA1
b1b92bf3443b58cc7d19c36b39335dab1722db4a
-
SHA256
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9
-
SHA512
ea4bc0ac10c8c5697e511b5fbe30e3df8ae8bf7a251281095d551f1e37d82294e4371165669856369767aaf1a6d55f8623f9eacedb2a4ca6fe8a6f58d6e2b993
-
SSDEEP
768:4gjHnA1QTUe39+p5HbTawMoEsoGFynnaS/FO/1H5/:4gkGTUe39a5HHzQshMahh
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe -
Executes dropped EXE 1 IoCs
Processes:
Kcbbfgcj.exepid process 1148 Kcbbfgcj.exe -
Loads dropped DLL 2 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exepid process 1744 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe 1744 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe -
Drops file in System32 directory 3 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exedescription ioc process File created C:\Windows\SysWOW64\Kcbbfgcj.exe 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe File opened for modification C:\Windows\SysWOW64\Kcbbfgcj.exe 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe File created C:\Windows\SysWOW64\Ijhdfe32.dll 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
Kcbbfgcj.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess Kcbbfgcj.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess = "yes" Kcbbfgcj.exe -
Modifies registry class 6 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijhdfe32.dll" 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Kcbbfgcj.exepid process 1148 Kcbbfgcj.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exedescription pid process target process PID 1744 wrote to memory of 1148 1744 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Kcbbfgcj.exe PID 1744 wrote to memory of 1148 1744 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Kcbbfgcj.exe PID 1744 wrote to memory of 1148 1744 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Kcbbfgcj.exe PID 1744 wrote to memory of 1148 1744 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Kcbbfgcj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe"C:\Users\Admin\AppData\Local\Temp\1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Kcbbfgcj.exeC:\Windows\system32\Kcbbfgcj.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Kcbbfgcj.exeFilesize
45KB
MD54f1cf26ae82ce838a105b2edcb99ba56
SHA1fb6fc42c0d50fa1e4ba2f60346be3e7b4c24978b
SHA2565504c7b66749c681d0a592785d7693beeb28c1ac74de0d9e728ff41afd7d5449
SHA512ff097284238acae737952e972ed0f45491c60cd7ad7b5ad3d65408e197dc9b020812ea5c35dc9ceff896cb6cf9cf18eeb4863baaee23315b9ab36f44e35ed293
-
\Windows\SysWOW64\Kcbbfgcj.exeFilesize
45KB
MD54f1cf26ae82ce838a105b2edcb99ba56
SHA1fb6fc42c0d50fa1e4ba2f60346be3e7b4c24978b
SHA2565504c7b66749c681d0a592785d7693beeb28c1ac74de0d9e728ff41afd7d5449
SHA512ff097284238acae737952e972ed0f45491c60cd7ad7b5ad3d65408e197dc9b020812ea5c35dc9ceff896cb6cf9cf18eeb4863baaee23315b9ab36f44e35ed293
-
\Windows\SysWOW64\Kcbbfgcj.exeFilesize
45KB
MD54f1cf26ae82ce838a105b2edcb99ba56
SHA1fb6fc42c0d50fa1e4ba2f60346be3e7b4c24978b
SHA2565504c7b66749c681d0a592785d7693beeb28c1ac74de0d9e728ff41afd7d5449
SHA512ff097284238acae737952e972ed0f45491c60cd7ad7b5ad3d65408e197dc9b020812ea5c35dc9ceff896cb6cf9cf18eeb4863baaee23315b9ab36f44e35ed293
-
memory/1148-56-0x0000000000000000-mapping.dmp
-
memory/1148-59-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/1148-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1148-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1744-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB