Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-01-2023 19:33
Static task
static1
Behavioral task
behavioral1
Sample
process.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
process.exe
-
Size
258KB
-
MD5
4b845f07de6d5d8ad72a57d9169f69be
-
SHA1
cfec4bce14ce9c85350f8f943c1ab8068be9e42b
-
SHA256
0dd112b4f23ce4ad0d6619dc2686b58f686ad47509c4e9a66b045a7385ebda64
-
SHA512
b15b8b57ea5bdbbb4f1fda0036560d1f0ee89d0122dac92ddd816897312fd5d6c0219e7898d85a88649283790887ef74fa5b317cdf1cb6452fb9484f441854fe
-
SSDEEP
6144:4I4vO0B+oVTIn0UAaH0neolFc6hoPnJEdRcgY5STm:yvpBRBInQ7bc6hMJEdRcgY
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
pid Process 1600 process.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE7C3CF0-4B15-11D1-ABED-709549C10000} process.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4312 sc.exe 4328 sc.exe 3388 sc.exe -
Modifies registry class 42 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\ = "IEHlprObj Class" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\ = "IEHelper 1.0 Type Library" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ProxyStubClsid32 process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib\Version = "1.0" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID\ = "{CE7C3CF0-4B15-11D1-ABED-709549C10000}" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\InprocServer32 process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0 process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\HELPDIR process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ = "IIEHlprObj" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ = "IIEHlprObj" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib\ = "{CE7C3CE2-4B15-11D1-ABED-709549C10000}" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\Programmable process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\ProgID process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\FLAGS\ = "0" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ProxyStubClsid32 process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\ = "IEHlprObj Class" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\ = "IEHlprObj Class" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000} process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\ProgID\ = "IEHlprObj.IEHlprObj.1" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\InprocServer32\ThreadingModel = "Apartment" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEHelper.dll" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib\ = "{CE7C3CE2-4B15-11D1-ABED-709549C10000}" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer\ = "IEHlprObj.IEHlprObj.1" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib\Version = "1.0" process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IEHelper.dll" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000} process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\FLAGS process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\0 process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE7C3CE2-4B15-11D1-ABED-709549C10000}\1.0\0\win32 process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000} process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1 process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\VersionIndependentProgID process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\VersionIndependentProgID\ = "IEHlprObj.IEHlprObj" process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\TypeLib process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000} process.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj process.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CE7C3CEF-4B15-11D1-ABED-709549C10000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" process.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2532 Process not Found -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1600 process.exe Token: SeShutdownPrivilege 2532 Process not Found Token: SeCreatePagefilePrivilege 2532 Process not Found Token: SeShutdownPrivilege 2532 Process not Found Token: SeCreatePagefilePrivilege 2532 Process not Found -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1600 wrote to memory of 4932 1600 process.exe 83 PID 1600 wrote to memory of 4932 1600 process.exe 83 PID 1600 wrote to memory of 4932 1600 process.exe 83 PID 4932 wrote to memory of 4312 4932 cmd.exe 84 PID 4932 wrote to memory of 4312 4932 cmd.exe 84 PID 4932 wrote to memory of 4312 4932 cmd.exe 84 PID 1600 wrote to memory of 5108 1600 process.exe 86 PID 1600 wrote to memory of 5108 1600 process.exe 86 PID 1600 wrote to memory of 5108 1600 process.exe 86 PID 5108 wrote to memory of 4328 5108 cmd.exe 87 PID 5108 wrote to memory of 4328 5108 cmd.exe 87 PID 5108 wrote to memory of 4328 5108 cmd.exe 87 PID 1600 wrote to memory of 644 1600 process.exe 90 PID 1600 wrote to memory of 644 1600 process.exe 90 PID 1600 wrote to memory of 644 1600 process.exe 90 PID 644 wrote to memory of 3388 644 cmd.exe 91 PID 644 wrote to memory of 3388 644 cmd.exe 91 PID 644 wrote to memory of 3388 644 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\process.exe"C:\Users\Admin\AppData\Local\Temp\process.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start stisvc2⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\sc.exesc start stisvc3⤵
- Launches sc.exe
PID:4312
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop wuauserv2⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\SysWOW64\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:4328
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start wuauserv2⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\sc.exesc start wuauserv3⤵
- Launches sc.exe
PID:3388
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:4432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154KB
MD500b5bc89db9eb0a2bf915c834e2c31f5
SHA150367913472880e8b533750027de37d727cb5043
SHA25690523dfb329e6e732e5e7032bf316c806e8ff303f531a10461a1ab14639933e0
SHA5127ec041d61c581388a50f853a909e30bebdc6fdd8e39d2c5c9d9af1af4f707d480ae5f1a6eddea595d6538e5a25b0b55a6a9b7a3f3aba862c3702d496e3ae712c