Analysis
-
max time kernel
218s -
max time network
298s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 18:19
Static task
static1
Behavioral task
behavioral1
Sample
f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe
-
Size
136KB
-
MD5
db0f66d9ca9a87a48ba047379445d025
-
SHA1
127333e0af9b414d180ab76cf29c7c8cca255f38
-
SHA256
f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472
-
SHA512
24f1d44b5a9fd05f0fbe72d75eab475591df70854a8e0bf25f385856c1dc2c3ebb5e4202db7fe4ce28178fff919c31991eb495dbd5e209948e2d55f97db6e867
-
SSDEEP
3072:hGwy9VsbzMbxso+m+dYOGpfHsKv5AgIA73D41msDvK5G:O9VsP0Ko+mrpftv5AfA7umAvB
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1500 iexplore.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vzfmfh = "C:\\Users\\Admin\\AppData\\Roaming\\Vzfmfh.exe" iexplore.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1524 set thread context of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05085C10-7842-11ED-8A0C-D60BF964997B} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 652 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 652 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe Token: SeDebugPrivilege 1500 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1456 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 1456 IEXPLORE.EXE 1456 IEXPLORE.EXE 1812 IEXPLORE.EXE 1812 IEXPLORE.EXE 1812 IEXPLORE.EXE 1812 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 1524 wrote to memory of 652 1524 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 28 PID 652 wrote to memory of 1500 652 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 29 PID 652 wrote to memory of 1500 652 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 29 PID 652 wrote to memory of 1500 652 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 29 PID 652 wrote to memory of 1500 652 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 29 PID 1500 wrote to memory of 1456 1500 iexplore.exe 30 PID 1500 wrote to memory of 1456 1500 iexplore.exe 30 PID 1500 wrote to memory of 1456 1500 iexplore.exe 30 PID 1500 wrote to memory of 1456 1500 iexplore.exe 30 PID 652 wrote to memory of 1500 652 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 29 PID 652 wrote to memory of 1500 652 f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe 29 PID 1456 wrote to memory of 1812 1456 IEXPLORE.EXE 32 PID 1456 wrote to memory of 1812 1456 IEXPLORE.EXE 32 PID 1456 wrote to memory of 1812 1456 IEXPLORE.EXE 32 PID 1456 wrote to memory of 1812 1456 IEXPLORE.EXE 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe"C:\Users\Admin\AppData\Local\Temp\f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe"C:\Users\Admin\AppData\Local\Temp\f13a49932d476d093c2bfefb08f29803da458245be33f4ad06698f9ace310472.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1812
-
-
-
-