Analysis
-
max time kernel
188s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 16:32
Static task
static1
Behavioral task
behavioral1
Sample
c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe
-
Size
392KB
-
MD5
d2d749b725f8d098fc099f65934b4941
-
SHA1
b77099305adc4032d6c3cdd7d2a4c6aa80c10755
-
SHA256
c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec
-
SHA512
91786a89462008559c3ad82ed89286ae4bbb28efc10441079d5a7bfa6c462d6589e6dad11987dfc120655fc82722dccaf01d8b62fde339b550e744645cb2c316
-
SSDEEP
3072:4wij7qxRkJSpCJ6NlSphyZ8qBj24f5gDRNZfPxXEe3RCzT9/L1BJSS2QHvKf:Gj7qiSpCJ63SpXqBj/BgL3x3RCzTB2
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1896 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe 1896 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSINET.OCX c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer\ = "InetCtls.Inet.1" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID\ = "InetCtls.Inet.1" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSINET.OCX" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ThreadingModel = "Apartment" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version\ = "1.0" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSINET.OCX, 1" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSINET.OCX" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\ = "Microsoft Internet Transfer Control 6.0 (SP4)" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSINET.OCX" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\ = "Microsoft Internet Transfer Control 6.0 (SP4)" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR\ c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID\ = "InetCtls.Inet" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908} c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\ = "Microsoft Internet Transfer Control 6.0 (SP4)" c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1896 c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe"C:\Users\Admin\AppData\Local\Temp\c788ed2f397eac13b8cab91ce6480c83e1dacfe76a06a1365204a1f6e5954fec.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1896
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD540d81470a19269d88bf44e766be7f84a
SHA14030e8e94297bc0aa5139fe241e8cf8f8142d8d4
SHA256dd1215f01b484e7842763302d42749d516963d9ac74e2fe8825a5eaba34f6229
SHA512e4a39613cc32885b67f6219281fbf99f50018b5fd2886b5389cfa04dc9dc4ebfc46fca2b9e89586116094fa3a7600c20b2ca0fa3535dd2615739621856506864
-
Filesize
113KB
MD540d81470a19269d88bf44e766be7f84a
SHA14030e8e94297bc0aa5139fe241e8cf8f8142d8d4
SHA256dd1215f01b484e7842763302d42749d516963d9ac74e2fe8825a5eaba34f6229
SHA512e4a39613cc32885b67f6219281fbf99f50018b5fd2886b5389cfa04dc9dc4ebfc46fca2b9e89586116094fa3a7600c20b2ca0fa3535dd2615739621856506864