Analysis
- max time kernel
139s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
30/01/2023, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
General
- Target 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe
- Size 39KB
- Sample230130-d9manshc8t
- SHA256 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
- MD5 5c1bd90d71ba00884c436550dec45123
- SHA1 4d42f73826e82ad32589069b297d7314c7b94c34
- SHA512 7c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
- SSDEEP 768:d/tN7XsL5M+KbRJ66l7P4uG2x6ye3vAU5uFl1FKDvlK0NTwzkKoCj+xo:dn78M/J6C4q5Mv0l+wzBoW+a
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 748 DesktopLayer.exe -
resource yara_rule behavioral2/memory/4656-134-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/748-136-0x0000000000400000-0x0000000000439000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\px6D07.tmp 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1543506798" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381818735" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{868910CF-A058-11ED-B696-72E5C3FA065D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1543506798" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011941" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011941" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4384 iexplore.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4384 iexplore.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4384 iexplore.exe 4384 iexplore.exe 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4656 wrote to memory of 748 4656 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe 81 PID 4656 wrote to memory of 748 4656 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe 81 PID 4656 wrote to memory of 748 4656 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe 81 PID 748 wrote to memory of 4384 748 DesktopLayer.exe 82 PID 748 wrote to memory of 4384 748 DesktopLayer.exe 82 PID 4384 wrote to memory of 2280 4384 iexplore.exe 83 PID 4384 wrote to memory of 2280 4384 iexplore.exe 83 PID 4384 wrote to memory of 2280 4384 iexplore.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe"C:\Users\Admin\AppData\Local\Temp\962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4384 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2280
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\DesktopLayer.exe
- Size 39KB
- SHA256 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
- MD5 5c1bd90d71ba00884c436550dec45123
- SHA1 4d42f73826e82ad32589069b297d7314c7b94c34
- SHA512 7c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
- SSDEEP 768:d/tN7XsL5M+KbRJ66l7P4uG2x6ye3vAU5uFl1FKDvlK0NTwzkKoCj+xo:dn78M/J6C4q5Mv0l+wzBoW+a
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft\DesktopLayer.exe
- Size 39KB
- SHA256 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
- MD5 5c1bd90d71ba00884c436550dec45123
- SHA1 4d42f73826e82ad32589069b297d7314c7b94c34
- SHA512 7c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
- SSDEEP 768:d/tN7XsL5M+KbRJ66l7P4uG2x6ye3vAU5uFl1FKDvlK0NTwzkKoCj+xo:dn78M/J6C4q5Mv0l+wzBoW+a
- MD5 SHA1 SHA512 SSDEEP