262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873

Analysis

max time kernel
151s
max time network
186s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe
Size

52KB
MD5

046b1fc565872089f6e214b73df98d50
SHA1

2be5ece40ac090e7ca0211bde525c3aac7186eda
SHA256

262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873
SHA512

92884e1473f87e4e99d8dfb0e5738d1028f7ebe7ac6fa6274499e51f097b34f1fa78c8723a7985b507735b1269fb36d5023d7b08115c75c999103d99fd022e05
SSDEEP

768:aHyEBK+o6yMPqgRDMa6RwudQXQ/6//4Jk8gqCfFC:aHL1Rt2vB/JkkUF

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1748	svchobst.exe

Deletes itself 1 IoCs

pid	Process
1436	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\svchobst.exe"	svchobst.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchobst.exe	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe
File created	C:\Windows\svchobst.exe	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchobst.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchobst.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005e2bf75466e14549bc8666719607cc2c00000000020000000000106600000001000020000000dc5ae897553781ba104f848cfb95c8389d3218256a5909ba445e563dc8ea7aeb000000000e80000000020000200000000cc425a37027b48642008242c7c37b8ca1a9dac94b583e7666f13545be768ca39000000002dd5997fb1d9e12e2dd4e1185c1f6087b20ff7201c7c093032c6f9eb8db8429a158861f290ebc368b44d45b9f838c37de33e81ad789ef0f673a0f46a3061d64a59bcf01ef413daa3e4c17efa30ef2502888346d5978cc78c15f7b843168633ce964e5de1aced3eca5d01d5d189b8578e413dc33265f2f90ab89c69bf245038e04c9d6bd12591a8ae671c7c64a61f07d40000000a7dddccdb818487f21ad8ef6c8b1371e9e27d69f489a69ae4f798878759e253639ba43fcbff016e5c3bcff2d0a648c4595b97d1d7bf1c11d3b7273d5318023af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3043b04e7d03d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55633A21-6F70-11ED-9351-5A21EB137514} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376441368"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005e2bf75466e14549bc8666719607cc2c00000000020000000000106600000001000020000000c8bc0ccb814c9c04f7c0026abdc958e0b1942b1d49bc47b0c7b6acd5dcac40fa000000000e8000000002000020000000c4afe4e5df4169d0f72855f5fb517da807f8536e3ff9b39102e028fc6f6d32fe20000000a07f0502707b135628cf5c7aedfd1ad30c2bbeabe994304ea5ebcf0e330d188440000000e21c1bda2516682295cbf77563879e575595954942165c32b987d9fda6dd46af30fd490d4e96603e11c03db4a63da4eaf30ec3dc6e99b24a5882fc0fce555538	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
956	iexplore.exe
956	iexplore.exe
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE
1932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1748	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe	28
PID 912 wrote to memory of 1748	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe	28
PID 912 wrote to memory of 1748	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe	28
PID 912 wrote to memory of 1748	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe	28
PID 1748 wrote to memory of 956	1748	svchobst.exe	29
PID 1748 wrote to memory of 956	1748	svchobst.exe	29
PID 1748 wrote to memory of 956	1748	svchobst.exe	29
PID 1748 wrote to memory of 956	1748	svchobst.exe	29
PID 912 wrote to memory of 1436	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe	30
PID 912 wrote to memory of 1436	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe	30
PID 912 wrote to memory of 1436	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe	30
PID 912 wrote to memory of 1436	912	262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe	30
PID 956 wrote to memory of 1932	956	iexplore.exe	32
PID 956 wrote to memory of 1932	956	iexplore.exe	32
PID 956 wrote to memory of 1932	956	iexplore.exe	32
PID 956 wrote to memory of 1932	956	iexplore.exe	32

C:\Users\Admin\AppData\Local\Temp\262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe
"C:\Users\Admin\AppData\Local\Temp\262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\svchobst.exe
  "C:\Windows\svchobst.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://dns.aaii.tv/j8.html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:956 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\262E6D~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YJZW5011.txt

Filesize
608B

MD5
98b9943a43f9c69c0e2472bf66e11145

SHA1
afdf634a0e221c123d4b09b64cf3e4ed1e858754

SHA256
fc2eac484a48fe0520bdbabaea546a028a55f85826fbb83da0650b9f3f1682f7

SHA512
a1fe84f160e236953ae1543e1d8cc1b6c77baf25dbe23e720c1319ad9cfc084ed7f1d97f4e2549dc5c7bf4839b96855b0f5634487b484739e786891df9256df7

Download Submit
C:\Windows\svchobst.exe

Filesize
52KB

MD5
046b1fc565872089f6e214b73df98d50

SHA1
2be5ece40ac090e7ca0211bde525c3aac7186eda

SHA256
262e6dc15a4e95d44401aaad2876fe16213092f8552d8a8ef7b4073aec3d6873

SHA512
92884e1473f87e4e99d8dfb0e5738d1028f7ebe7ac6fa6274499e51f097b34f1fa78c8723a7985b507735b1269fb36d5023d7b08115c75c999103d99fd022e05

Download Submit
memory/1436-57-0x0000000000000000-mapping.dmp

Download
memory/1748-54-0x0000000000000000-mapping.dmp

Download
memory/1748-56-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads