Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 03:42
Static task
static1
Behavioral task
behavioral1
Sample
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe
Resource
win7-20220812-en
General
-
Target
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe
-
Size
39KB
-
MD5
5c1bd90d71ba00884c436550dec45123
-
SHA1
4d42f73826e82ad32589069b297d7314c7b94c34
-
SHA256
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
-
SHA512
7c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
-
SSDEEP
768:d/tN7XsL5M+KbRJ66l7P4uG2x6ye3vAU5uFl1FKDvlK0NTwzkKoCj+xo:dn78M/J6C4q5Mv0l+wzBoW+a
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
DesktopLayer.exepid process 748 DesktopLayer.exe -
Processes:
resource yara_rule behavioral2/memory/4656-134-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral2/memory/748-136-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
Processes:
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\px6D07.tmp 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1543506798" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381818735" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{868910CF-A058-11ED-B696-72E5C3FA065D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1543506798" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011941" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011941" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe 748 DesktopLayer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 4384 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 4384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 4384 iexplore.exe 4384 iexplore.exe 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 4656 wrote to memory of 748 4656 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe DesktopLayer.exe PID 4656 wrote to memory of 748 4656 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe DesktopLayer.exe PID 4656 wrote to memory of 748 4656 962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe DesktopLayer.exe PID 748 wrote to memory of 4384 748 DesktopLayer.exe iexplore.exe PID 748 wrote to memory of 4384 748 DesktopLayer.exe iexplore.exe PID 4384 wrote to memory of 2280 4384 iexplore.exe IEXPLORE.EXE PID 4384 wrote to memory of 2280 4384 iexplore.exe IEXPLORE.EXE PID 4384 wrote to memory of 2280 4384 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe"C:\Users\Admin\AppData\Local\Temp\962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4384 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
39KB
MD55c1bd90d71ba00884c436550dec45123
SHA14d42f73826e82ad32589069b297d7314c7b94c34
SHA256962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
SHA5127c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exeFilesize
39KB
MD55c1bd90d71ba00884c436550dec45123
SHA14d42f73826e82ad32589069b297d7314c7b94c34
SHA256962b8f9f86a66ba2d0ec47103d669706b00e42a7388b150a925d169bf51c424b
SHA5127c74b5fdbd660a0c5e04010c6530434b80b2e717033ce20011a82da1c849e50e40b8af7f63622f35d9aaf9cc98141b7c72c20a474fc697270bcc9d2112b85313
-
memory/748-132-0x0000000000000000-mapping.dmp
-
memory/748-136-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4656-134-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB