Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 18:28
Static task
static1
Behavioral task
behavioral1
Sample
bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95.exe
Resource
win10v2004-20220901-en
General
-
Target
bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95.exe
-
Size
176KB
-
MD5
378e425030307aad6c8c6f893c7a8e97
-
SHA1
460a24628f079a4cdfa5a8a776796fa14cb901d7
-
SHA256
bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95
-
SHA512
821cf03ab31e36eaa0eb388d8bbad04afcc6c7c9f6fa8a941c0f560568965767db67b32c81fdc5275a024db393fa1e2d6dbd6c28cc7b353ad463800d541fbc97
-
SSDEEP
3072:rHA5Hnpxjp7IFvk1iPo7brqseJQmL2VgLfnnXa0tRYyWcDoRQFQDU47TVPYZmxpC:bALIF81T7Hg2mLfznqIR9NDM0QZBPY
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 4868 rundll32.exe 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mlent = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\mlent.dll\",AGetVolume" rundll32.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1173482356" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1173482356" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1256920969" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000000000000de04000065020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff720000001a000000f80400007f020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1333482100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000439" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000439" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1410513291" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000439" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376878627" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31000439" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{71649DC2-736A-11ED-A0EE-F63A18EFECFD} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1178638300" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000439" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31000439" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3780 iexplore.exe 3780 iexplore.exe 3780 iexplore.exe 3780 iexplore.exe -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 3780 iexplore.exe 3780 iexplore.exe 2368 IEXPLORE.EXE 2368 IEXPLORE.EXE 4868 rundll32.exe 3780 iexplore.exe 3780 iexplore.exe 2772 IEXPLORE.EXE 2772 IEXPLORE.EXE 4868 rundll32.exe 3780 iexplore.exe 3780 iexplore.exe 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE 4868 rundll32.exe 3780 iexplore.exe 3780 iexplore.exe 1656 IEXPLORE.EXE 1656 IEXPLORE.EXE 4868 rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2672 wrote to memory of 4868 2672 bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95.exe 81 PID 2672 wrote to memory of 4868 2672 bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95.exe 81 PID 2672 wrote to memory of 4868 2672 bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95.exe 81 PID 3780 wrote to memory of 2368 3780 iexplore.exe 87 PID 3780 wrote to memory of 2368 3780 iexplore.exe 87 PID 3780 wrote to memory of 2368 3780 iexplore.exe 87 PID 3780 wrote to memory of 2772 3780 iexplore.exe 91 PID 3780 wrote to memory of 2772 3780 iexplore.exe 91 PID 3780 wrote to memory of 2772 3780 iexplore.exe 91 PID 3780 wrote to memory of 1060 3780 iexplore.exe 93 PID 3780 wrote to memory of 1060 3780 iexplore.exe 93 PID 3780 wrote to memory of 1060 3780 iexplore.exe 93 PID 3780 wrote to memory of 1656 3780 iexplore.exe 94 PID 3780 wrote to memory of 1656 3780 iexplore.exe 94 PID 3780 wrote to memory of 1656 3780 iexplore.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95.exe"C:\Users\Admin\AppData\Local\Temp\bf320134340e8ea68572a1dd1804975ed77503f380c512ec00e96ea9b759ef95.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Roaming\mlent.dll",AGetVolume2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4868
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:4348
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3780 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2368
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3780 CREDAT:17414 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2772
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3780 CREDAT:17418 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3780 CREDAT:17422 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1656
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD50ff2da8bfc83bec6bce38ba6a3f7bf58
SHA184c37df7bed08d69f040c289676735c49a9564eb
SHA25691026f24711c435d99a44884c7239ed1265cd17c0259a6c5885f69e4309421ea
SHA51278afdc44d7557b2f14444182085252e8456c91289511d6f2abfd1d7273d05baba9a94206d370add716b9fc30dc326a1a2e1c78f642e926759d962cf216c3a489
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5817169b781f0a013944bef3d91271348
SHA127e3c333a549ff39d0548440d4dfc42607291f19
SHA25624de3dce0d2aad072de51ab1a3b789291b5016cd60af948976d81816153581d4
SHA512ccac3f438215a3af4f36febc2935694801283e7792bfbc0c26dc10796c0ededd1ba8356890818df183e15282eb46cf235cfe1224f2b2148efc86a6f19467253f
-
Filesize
176KB
MD57a82a6c6012081aa8f1c99b1c9bce113
SHA13b5896ea07a5f66b1c79e12135985c79caaf4067
SHA256b3eb71748ea458ce37665ea8618d07e12e31fd06d9a3bfb4038f91f8928ce1fd
SHA5125f1e606a6601bd8ea83c2dcc68c323e93a4e8cbf0a0d9ea335b81cdfb972ac09f20469a9f541c09187671ee3df098e379419ef1b2745ea0254009f110a92a94b
-
Filesize
176KB
MD57a82a6c6012081aa8f1c99b1c9bce113
SHA13b5896ea07a5f66b1c79e12135985c79caaf4067
SHA256b3eb71748ea458ce37665ea8618d07e12e31fd06d9a3bfb4038f91f8928ce1fd
SHA5125f1e606a6601bd8ea83c2dcc68c323e93a4e8cbf0a0d9ea335b81cdfb972ac09f20469a9f541c09187671ee3df098e379419ef1b2745ea0254009f110a92a94b
-
Filesize
176KB
MD57a82a6c6012081aa8f1c99b1c9bce113
SHA13b5896ea07a5f66b1c79e12135985c79caaf4067
SHA256b3eb71748ea458ce37665ea8618d07e12e31fd06d9a3bfb4038f91f8928ce1fd
SHA5125f1e606a6601bd8ea83c2dcc68c323e93a4e8cbf0a0d9ea335b81cdfb972ac09f20469a9f541c09187671ee3df098e379419ef1b2745ea0254009f110a92a94b
-
Filesize
176KB
MD57a82a6c6012081aa8f1c99b1c9bce113
SHA13b5896ea07a5f66b1c79e12135985c79caaf4067
SHA256b3eb71748ea458ce37665ea8618d07e12e31fd06d9a3bfb4038f91f8928ce1fd
SHA5125f1e606a6601bd8ea83c2dcc68c323e93a4e8cbf0a0d9ea335b81cdfb972ac09f20469a9f541c09187671ee3df098e379419ef1b2745ea0254009f110a92a94b