0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
Size

2.1MB
MD5

4108f3cd0ae3cb1e3695f59e6bf0aaa9
SHA1

0a49f30b3b1356b9b0fecfac85cada488e2dfbd8
SHA256

0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e
SHA512

4437ab7d086d94bc9a999ceb882f4b1fd1e268013d0dc47e61c32535239a985166eb56534e6d230514d0251b5eac843542887e2666e6d43e3a85d2c10ae52e07
SSDEEP

49152:i4cMJBvpsZPiJLxwGvU45G35tvpsZPiJLxwFTy:iqJBRXw0U95tRXwly

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4200	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
4200	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
4200	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\818695\dp1.fne	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
File opened for modification	C:\Windows\SysWOW64\818695\dp1.fne	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
File created	C:\Windows\SysWOW64\818695\krnln.fnr	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
File created	C:\Windows\SysWOW64\818695\WAE0FEC.TXT	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000005457d891100041646d696e003c0009000400efbe545754885c578a9d2e000000dbe1010000000100000000000000000000000000000037e41601410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 500031000000000054574b8b10004c6f63616c003c0009000400efbe545754885c578a9d2e000000f9e10100000001000000000000000000000000000000088a81004c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000005457548812004170704461746100400009000400efbe545754885c578a9d2e000000e6e10100000001000000000000000000000000000000a9f1b5004100700070004400610074006100000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000545754881100557365727300640009000400efbe874f77485c578a9d2e000000c70500000000010000000000000000003a0000000000df8ed20055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000005c578a9d100054656d7000003a0009000400efbe545754885c578a9d2e000000fae10100000001000000000000000000000000000000354a7500540065006d007000000014000000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4936	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4936	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4200	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
4200	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
4936	explorer.exe
4936	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 1556	4200	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe	86
PID 4200 wrote to memory of 1556	4200	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe	86
PID 4200 wrote to memory of 1556	4200	0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe	86

C:\Users\Admin\AppData\Local\Temp\0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe
"C:\Users\Admin\AppData\Local\Temp\0d1bc4fed492bec1ab80aecaf364d2db1236898baa3266bc29f606895f1dea4e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1556

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4936

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\E_N4\dp1.fne

Filesize
124KB

MD5
f274a62dd5d0cad4cebfe3ca860faa88

SHA1
673d7e882bc762312554f7b2d5430abbc5eeb10a

SHA256
429aea54799e028e192063cdd574d3dea79ba60cde9da2fe8a7ef89c5ca5fd03

SHA512
9aa65b022cf58ee57cdaf1ecb3daff8b9eb4f91e2faeb5b51382cab93a85da16b4e6a5883e31d266181767b42962278059b8afef3634d710e3ff411a0fb22a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\dp1.fne

Filesize
124KB

MD5
f274a62dd5d0cad4cebfe3ca860faa88

SHA1
673d7e882bc762312554f7b2d5430abbc5eeb10a

SHA256
429aea54799e028e192063cdd574d3dea79ba60cde9da2fe8a7ef89c5ca5fd03

SHA512
9aa65b022cf58ee57cdaf1ecb3daff8b9eb4f91e2faeb5b51382cab93a85da16b4e6a5883e31d266181767b42962278059b8afef3634d710e3ff411a0fb22a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\dp1.fne

Filesize
124KB

MD5
f274a62dd5d0cad4cebfe3ca860faa88

SHA1
673d7e882bc762312554f7b2d5430abbc5eeb10a

SHA256
429aea54799e028e192063cdd574d3dea79ba60cde9da2fe8a7ef89c5ca5fd03

SHA512
9aa65b022cf58ee57cdaf1ecb3daff8b9eb4f91e2faeb5b51382cab93a85da16b4e6a5883e31d266181767b42962278059b8afef3634d710e3ff411a0fb22a61

Download Submit
C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr

Filesize
1.1MB

MD5
42c0a3a09f8bae806fe205b88acedd1a

SHA1
2d1fb548ca8a0b82729167f657936ed065799244

SHA256
80e991c46cdc1830a8b16256a04ef74ea906158531b8139b1f52de704c6a7ca5

SHA512
a020ab237573c740d16fb8ba87203d6309fbdb13b32abb395cbd661e29554e4b9f924aea0bdbf02dcb31c699e214dc3b524e08a571bd75a3a7621fa345a8aeb7

Download Submit
C:\Windows\SysWOW64\818695\krnln.fnr

Filesize
1.1MB

MD5
42c0a3a09f8bae806fe205b88acedd1a

SHA1
2d1fb548ca8a0b82729167f657936ed065799244

SHA256
80e991c46cdc1830a8b16256a04ef74ea906158531b8139b1f52de704c6a7ca5

SHA512
a020ab237573c740d16fb8ba87203d6309fbdb13b32abb395cbd661e29554e4b9f924aea0bdbf02dcb31c699e214dc3b524e08a571bd75a3a7621fa345a8aeb7

Download Submit
memory/4200-0-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4200-4-0x0000000010000000-0x000000001011D000-memory.dmp

Filesize
1.1MB

Download
memory/4200-19-0x00000000021F0000-0x0000000002211000-memory.dmp

Filesize
132KB

Download
memory/4200-20-0x00000000021F0000-0x0000000002211000-memory.dmp

Filesize
132KB

Download
memory/4200-22-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4200-23-0x0000000010000000-0x000000001011D000-memory.dmp

Filesize
1.1MB

Download