Overview
overview
10Static
static
3CareAbout.exe
windows7-x64
10CareAbout.exe
windows10-2004-x64
10HTCTL32.dll
windows7-x64
3HTCTL32.dll
windows10-2004-x64
3ExtExport.exe
windows7-x64
ExtExport.exe
windows10-2004-x64
1iediagcmd.exe
windows7-x64
8iediagcmd.exe
windows10-2004-x64
8ieinstal.exe
windows7-x64
ieinstal.exe
windows10-2004-x64
1ielowutil.exe
windows7-x64
ielowutil.exe
windows10-2004-x64
1PCICHEK.dll
windows7-x64
1PCICHEK.dll
windows10-2004-x64
1PCICL32.dll
windows7-x64
1PCICL32.dll
windows10-2004-x64
1TCCTL32.dll
windows7-x64
1TCCTL32.dll
windows10-2004-x64
1msvcr100.dll
windows7-x64
3msvcr100.dll
windows10-2004-x64
3pcicapi.dll
windows7-x64
1pcicapi.dll
windows10-2004-x64
1remcmdstub.exe
windows7-x64
1remcmdstub.exe
windows10-2004-x64
1Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2023 01:13
Static task
static1
Behavioral task
behavioral1
Sample
CareAbout.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
CareAbout.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral3
Sample
HTCTL32.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
HTCTL32.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral5
Sample
ExtExport.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
ExtExport.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral7
Sample
iediagcmd.exe
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
iediagcmd.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral9
Sample
ieinstal.exe
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
ieinstal.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral11
Sample
ielowutil.exe
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
ielowutil.exe
Resource
win10v2004-20230831-en
Behavioral task
behavioral13
Sample
PCICHEK.dll
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
PCICHEK.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral15
Sample
PCICL32.dll
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
PCICL32.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral17
Sample
TCCTL32.dll
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
TCCTL32.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral19
Sample
msvcr100.dll
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
msvcr100.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral21
Sample
pcicapi.dll
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
pcicapi.dll
Resource
win10v2004-20230831-en
Behavioral task
behavioral23
Sample
remcmdstub.exe
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
remcmdstub.exe
Resource
win10v2004-20230831-en
General
-
Target
ieinstal.exe
-
Size
493KB
-
MD5
c9edd394eb4d0996ee43cb67563df50c
-
SHA1
6888a6b34a6b2bdac0096a453c4e6f8d10e810f3
-
SHA256
cc57d54c0d17f5e786a75bc28ce2133499672fe378b6f62c8117f2f0c191e932
-
SHA512
eaabc79b810edcb7ec0c99011eb0f87f8b45c7ea3cea17a7c2bee4bbb4c9e811040977415936cc45de8adfcea1f2367b72ac17812d510172954641d5899b97d2
-
SSDEEP
6144:XXR616NN5sBwNw1rOt9pdYamXnrdbMKw7w1rOt9pdYamXnrdbMKw:XXRtRF+5OLpdNIrd4Ds5OLpdNIrd4D
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 744 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\ieinstal.exe"1⤵PID:940
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:3628
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:744
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD582aa8d6cf21f265b17a37d855e47db0b
SHA1dbe287c5e02a0f9f53100f4386af89b56d716913
SHA25686bc07fbe83ad1f8ff82a32c1ad3c4f18f314efaff17e71883e60e1562fca6c3
SHA512758fe8544e81c31c336eaf216ca16b8b378370aea74b944d9afefa255d5dfd5baf248b2d4b37fa628cc76a086dcad7b4c592ecbb0a6b7b87d01ae617a8fc2cc2