Analysis
-
max time kernel
97s -
max time network
98s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 14:38
Static task
static1
Behavioral task
behavioral1
Sample
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe
Resource
win10v2004-20221111-en
General
-
Target
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe
-
Size
893KB
-
MD5
b946250548876715d3538b32d4d8c56e
-
SHA1
31b92ece5a63d7847a5eae046f9e360f71bcab84
-
SHA256
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6
-
SHA512
5dc56ec12a7319e85464607b1bc59fdeb639960126ade0b568978bcc9835ce38e11f1154824fc35f434ff250932afaa9ecb382d426a05c6df5263867adfb97f0
-
SSDEEP
24576:Tl2KWr0+97PAQnGfEMeWqueWmXMLFasNQuTkv:Tl2PQobWqueFMLMsNtwv
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe -
Processes:
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe -
Modifies registry class 36 IoCs
Processes:
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5} 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040} 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326} 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exedescription pid process Token: SeDebugPrivilege 1500 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exepid process 1500 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe 1500 8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe"C:\Users\Admin\AppData\Local\Temp\8b4bd7402b3fd8737b7fa2f3bfd478b2f6b809169627b0ea0dd531af7f5520e6.exe"1⤵
- Registers COM server for autorun
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1500-54-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/1500-55-0x0000000000A70000-0x0000000000BF4000-memory.dmpFilesize
1.5MB
-
memory/1500-62-0x0000000000A70000-0x0000000000BF4000-memory.dmpFilesize
1.5MB
-
memory/1500-63-0x0000000000A70000-0x0000000000BF4000-memory.dmpFilesize
1.5MB
-
memory/1500-64-0x0000000000A70000-0x0000000000BF4000-memory.dmpFilesize
1.5MB