a8bcaba1ab0b0a808082e2c4e1e8bdc14ad6c4410678f68786744e8d8966a921

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02/10/2023, 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe
Size

1.2MB
MD5

03503a9096e4343e38400278e26f0656
SHA1

3c8d1b1c061e9dbbd23e5d51ca101a1fd46a9dd1
SHA256

e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e
SHA512

b6333d8e7a49a752af216a288100b179b5c505b3a1211ea40ab292e298417129f6763114826b8cdad4ea8100bd14808c177cec3f3aa03edcdea44a3f53c0b601
SSDEEP

24576:ZQZD1zwB3zeT+Ryp63i54T+yzWo0e4eAktxH8wG34ad/E:uZ5zQeKUpzy5zWOUTJE

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2996	SMPCSetup.exe

Loads dropped DLL 4 IoCs

pid	Process
1264	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe
2996	SMPCSetup.exe
2996	SMPCSetup.exe
2996	SMPCSetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 22 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\showmypc.com	SMPCSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\showmypc.com\NumberOfSubdomains = "1"	SMPCSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "32"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\showmypc.com\ = "32"	SMPCSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\showmypc.com\ = "0"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "105"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\showmypc.com\ = "87"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\showmypc.com\Total = "87"	SMPCSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\showmypc.com\Total = "32"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\showmypc.com\Total = "0"	SMPCSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	SMPCSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18"	SMPCSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18"	SMPCSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	SMPCSetup.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2996	SMPCSetup.exe
2996	SMPCSetup.exe
2996	SMPCSetup.exe
2996	SMPCSetup.exe
2996	SMPCSetup.exe
2996	SMPCSetup.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2996	SMPCSetup.exe
2996	SMPCSetup.exe
2996	SMPCSetup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2996	1264	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe	28
PID 1264 wrote to memory of 2996	1264	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe	28
PID 1264 wrote to memory of 2996	1264	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe	28
PID 1264 wrote to memory of 2996	1264	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe	28
PID 1264 wrote to memory of 2996	1264	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe	28
PID 1264 wrote to memory of 2996	1264	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe	28
PID 1264 wrote to memory of 2996	1264	e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe	28

C:\Users\Admin\AppData\Local\Temp\e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe
"C:\Users\Admin\AppData\Local\Temp\e364d644063ba795b6e9db2172056ac1a1239231b56ab6c467b54ea01aba0c8e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4W1MW2HD\www.google[1].xml

Filesize
92B

MD5
c40fa6e083cb1c421db1f1af483d38e6

SHA1
ba903aed2083fbfc8ce5baa8efcb29c158f8059b

SHA256
25a009d172676968a76b3271171bcef401b5b0660123915225cfd50c48133f58

SHA512
24cc10dc9ac411973ca3c94e403514a01f5bf78e3ec0422d7e6c94e36ec9048f6892e85e5d7c82bf056acc424830a283c4a3d2ebc3b5f3177232d8faeec9668f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\SF2RF796\showmypc[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\27V93E5X\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe

Filesize
2.7MB

MD5
c003653bce7798bd05228eb2b40c9595

SHA1
30325667733924fb330f01c74ba2f81b37ced608

SHA256
2756a75e05510d297f4931a83befb8b147310f8cb5a70d3f7703ea296709b42f

SHA512
8b02259e1000681bde4bf263836689bd08183cd51354e4020478f716404e051a139a3fe18c340f03f46aa4b076a8645ac390304169fed0879e1d7bbb19225243

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe

Filesize
2.7MB

MD5
c003653bce7798bd05228eb2b40c9595

SHA1
30325667733924fb330f01c74ba2f81b37ced608

SHA256
2756a75e05510d297f4931a83befb8b147310f8cb5a70d3f7703ea296709b42f

SHA512
8b02259e1000681bde4bf263836689bd08183cd51354e4020478f716404e051a139a3fe18c340f03f46aa4b076a8645ac390304169fed0879e1d7bbb19225243

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\settings.ini

Filesize
109KB

MD5
b9ea7efbf952ecb459393d1022cf5605

SHA1
1fc3fc38d7fd94be2ecd72dc5c772471998e8c1f

SHA256
07db10075ac6f419dd61295acfc49c58eff8970372bafb2191533a1c51c15c87

SHA512
06655fb6be4c2fe4a1baefb6feceee844a9984b24dae12dc0580377b8a7eed752bb829bd17a9393e8abaf939cfbb9a07765dc162acc755335da36fec4765203a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe

Filesize
2.7MB

MD5
c003653bce7798bd05228eb2b40c9595

SHA1
30325667733924fb330f01c74ba2f81b37ced608

SHA256
2756a75e05510d297f4931a83befb8b147310f8cb5a70d3f7703ea296709b42f

SHA512
8b02259e1000681bde4bf263836689bd08183cd51354e4020478f716404e051a139a3fe18c340f03f46aa4b076a8645ac390304169fed0879e1d7bbb19225243

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe

Filesize
2.7MB

MD5
c003653bce7798bd05228eb2b40c9595

SHA1
30325667733924fb330f01c74ba2f81b37ced608

SHA256
2756a75e05510d297f4931a83befb8b147310f8cb5a70d3f7703ea296709b42f

SHA512
8b02259e1000681bde4bf263836689bd08183cd51354e4020478f716404e051a139a3fe18c340f03f46aa4b076a8645ac390304169fed0879e1d7bbb19225243

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe

Filesize
2.7MB

MD5
c003653bce7798bd05228eb2b40c9595

SHA1
30325667733924fb330f01c74ba2f81b37ced608

SHA256
2756a75e05510d297f4931a83befb8b147310f8cb5a70d3f7703ea296709b42f

SHA512
8b02259e1000681bde4bf263836689bd08183cd51354e4020478f716404e051a139a3fe18c340f03f46aa4b076a8645ac390304169fed0879e1d7bbb19225243

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\SMPCSetup.exe

Filesize
2.7MB

MD5
c003653bce7798bd05228eb2b40c9595

SHA1
30325667733924fb330f01c74ba2f81b37ced608

SHA256
2756a75e05510d297f4931a83befb8b147310f8cb5a70d3f7703ea296709b42f

SHA512
8b02259e1000681bde4bf263836689bd08183cd51354e4020478f716404e051a139a3fe18c340f03f46aa4b076a8645ac390304169fed0879e1d7bbb19225243

Download Submit
memory/2996-43-0x00000000046E0000-0x0000000005742000-memory.dmp

Filesize
16.4MB

Download