aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02

Analysis

max time kernel
169s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 13:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Size

87KB
MD5

662c0c1974e2f0a8fa14180351da2f49
SHA1

2cf29811f53bca6abc948f3d3978d564ef6da61a
SHA256

aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02
SHA512

eb431e7c24a9602279ee5b2d447a78245a8ff6f54d7d092ff64ebc0d5a820b13d35ec91890356c5de299427c425069c46e03f7b9e6bacd3ce029dec9f6d48367
SSDEEP

1536:BE5EqE/tHCYUE5EqE/ktAi1SQTLkTomuaJRVIoVL4dFG9NUD5icGbe0CFdvTnW:ttHmkiicquFZL4dF7DMbe0CrvT

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts.exe	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe

Loads dropped DLL 2 IoCs

pid	Process
2064	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
2064	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msinet.ocx	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID\ = "InetCtls.Inet"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1\ = "132497"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ = "Microsoft Internet Transfer Control, version 6.0"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\ = "Internet Control General Property Page Object"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSINET.OCX"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer\ = "InetCtls.Inet.1"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS\ = "2"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR\	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSINET.OCX"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\ = "Microsoft Internet Transfer Control, version 6.0"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSINET.OCX, 1"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version\ = "1.0"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID\ = "InetCtls.Inet.1"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Programmable	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\ = "Microsoft Internet Transfer Control 6.0"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSINET.OCX"	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2064	aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe

C:\Users\Admin\AppData\Local\Temp\aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe
"C:\Users\Admin\AppData\Local\Temp\aeb51e6017239f8136fd2bb36ef176750ce4658778d048ab2a0b14f9719b4e02.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\msinet.ocx

Filesize
112KB

MD5
7bec181a21753498b6bd001c42a42722

SHA1
3249f233657dc66632c0539c47895bfcee5770cc

SHA256
73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31

SHA512
d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc

Download Submit
C:\Windows\SysWOW64\msinet.ocx

Filesize
112KB

MD5
7bec181a21753498b6bd001c42a42722

SHA1
3249f233657dc66632c0539c47895bfcee5770cc

SHA256
73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31

SHA512
d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc

Download Submit
memory/2064-132-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2064-137-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download