Analysis
-
max time kernel
144s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 11:04
Behavioral task
behavioral1
Sample
cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe
-
Size
123KB
-
MD5
b822960a6013136be6243d3688206513
-
SHA1
8acda5afa58b23dd495f7d1e40f1a1f9fbf26c80
-
SHA256
cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e
-
SHA512
f02a98ea1f876f0695876b5e8fdc22a026dc3fc246e43c61d8f4fb681a84f66ea1649812f2c09e17e91ac519de812f27fe16c6a6b11e7be04200701f4d83cd04
-
SSDEEP
3072:WJ1ctfDURoutPl7MFrNPfDUTomaUg3g45+1t:XtwRoSd7OzKom6G7
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4224-137-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4224 set thread context of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "666488218" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "666488218" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{35807AB4-77E4-11ED-B696-C2DBB15B3A76} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001585" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377370735" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001585" IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe Token: SeDebugPrivilege 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe Token: SeDebugPrivilege 4456 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4320 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 4320 IEXPLORE.EXE 4320 IEXPLORE.EXE 4456 IEXPLORE.EXE 4456 IEXPLORE.EXE 4456 IEXPLORE.EXE 4456 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4224 wrote to memory of 4808 4224 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 80 PID 4808 wrote to memory of 4360 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 82 PID 4808 wrote to memory of 4360 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 82 PID 4808 wrote to memory of 4360 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 82 PID 4360 wrote to memory of 4320 4360 iexplore.exe 83 PID 4360 wrote to memory of 4320 4360 iexplore.exe 83 PID 4320 wrote to memory of 4456 4320 IEXPLORE.EXE 84 PID 4320 wrote to memory of 4456 4320 IEXPLORE.EXE 84 PID 4320 wrote to memory of 4456 4320 IEXPLORE.EXE 84 PID 4808 wrote to memory of 4456 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 84 PID 4808 wrote to memory of 4456 4808 cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe"C:\Users\Admin\AppData\Local\Temp\cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe"C:\Users\Admin\AppData\Local\Temp\cdec78fcf37315ca4e0f8db6dcb1893d743cd8a08dd905f4e584e0a929984e5e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4320 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4456
-
-
-
-