Analysis
-
max time kernel
73s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-01-2023 03:42
Static task
static1
Behavioral task
behavioral1
Sample
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe
Resource
win7-20220812-en
General
-
Target
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe
-
Size
39KB
-
MD5
5c1bd90d71ba00884c436550dec45123
-
SHA1
4d42f73826e82ad32589069b297d7314c7b94c34
-
SHA256
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
-
SHA512
7c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
-
SSDEEP
768:d/tN7XsL5M+KbRJ66l7P4uG2x6ye3vAU5uFl1FKDvlK0NTwzkKoCj+xo:dn78M/J6C4q5Mv0l+wzBoW+a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DesktopLayer.exepid process 872 DesktopLayer.exe -
Processes:
resource yara_rule behavioral1/memory/108-58-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/872-60-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exepid process 108 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe 108 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe -
Drops file in Program Files directory 3 IoCs
Processes:
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\pxFEF8.tmp 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85BEE5C1-A058-11ED-B390-DA7E66F9F45D} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381818739" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
DesktopLayer.exepid process 872 DesktopLayer.exe 872 DesktopLayer.exe 872 DesktopLayer.exe 872 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1292 iexplore.exe 1292 iexplore.exe 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 108 wrote to memory of 872 108 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe DesktopLayer.exe PID 108 wrote to memory of 872 108 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe DesktopLayer.exe PID 108 wrote to memory of 872 108 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe DesktopLayer.exe PID 108 wrote to memory of 872 108 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe DesktopLayer.exe PID 872 wrote to memory of 1292 872 DesktopLayer.exe iexplore.exe PID 872 wrote to memory of 1292 872 DesktopLayer.exe iexplore.exe PID 872 wrote to memory of 1292 872 DesktopLayer.exe iexplore.exe PID 872 wrote to memory of 1292 872 DesktopLayer.exe iexplore.exe PID 1292 wrote to memory of 1976 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 1976 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 1976 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 1976 1292 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe"C:\Users\Admin\AppData\Local\Temp\962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
39KB
MD55c1bd90d71ba00884c436550dec45123
SHA14d42f73826e82ad32589069b297d7314c7b94c34
SHA256962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
SHA5127c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
39KB
MD55c1bd90d71ba00884c436550dec45123
SHA14d42f73826e82ad32589069b297d7314c7b94c34
SHA256962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
SHA5127c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TCJE9RZR.txtFilesize
604B
MD535267ef18f3634008db28957fe4536bc
SHA13be3bb8ef1d46aa8c1e097301ce00f95134b0982
SHA25677eb0ea9bac7f46b0af144c938eb8dbfee5cca538c65310e1cf0cdc9f100e3bc
SHA5123952c23fd0c85086ca275d21d2d8835ec53a7d7d82feb09f08232b33cfc423465ac9c04e87d08ce29c4e828269004bd4cac690ad3b5344d23517c206b03e3e6a
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
39KB
MD55c1bd90d71ba00884c436550dec45123
SHA14d42f73826e82ad32589069b297d7314c7b94c34
SHA256962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
SHA5127c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
-
\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
39KB
MD55c1bd90d71ba00884c436550dec45123
SHA14d42f73826e82ad32589069b297d7314c7b94c34
SHA256962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
SHA5127c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
-
memory/108-58-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/872-56-0x0000000000000000-mapping.dmp
-
memory/872-60-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB