Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12fa989a3e318c4decb1a6ab26cda01a.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
12fa989a3e318c4decb1a6ab26cda01a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
12fa989a3e318c4decb1a6ab26cda01a.exe
-
Size
333KB
-
MD5
12fa989a3e318c4decb1a6ab26cda01a
-
SHA1
182c5d9d48a68890d800ed75fdad3af00e9c123d
-
SHA256
d004666c5176e398e42966e44c4aea32cbad97d84d35baaff06b5a98f8bcfc39
-
SHA512
c4d63abde5fc477c2e29bfa468583a2d86afa22583a1c36678fcd8a19a45421be90d4bc34329cf50feca030c27d8ad80e03eaa2374cdd3d4db8af9e2556a04e4
-
SSDEEP
6144:o1jFiZvXP9NMR6LVGBpJ1AyvrNm/+WxFBeRCrBA5Hxmv6wnRDx5Gjz7jgoZ3g:ohFI9o6LMX1AGNgeRCrC5Hx70Gj/Eyg
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1824 ghost.exe -
Loads dropped DLL 3 IoCs
pid Process 1824 ghost.exe 532 IEXPLORE.EXE 532 IEXPLORE.EXE -
Program crash 1 IoCs
pid pid_target Process procid_target 4064 532 WerFault.exe 95 -
Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\Favorites IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Low IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Virtualized IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatUaCache\Low IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{163FBCB0-A354-11EE-9BE3-5A2E32B6DBC3}.dat IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\IECompatCache\Low IEXPLORE.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{163FBCAE-A354-11EE-9BE3-5A2E32B6DBC3}.dat IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\Favorites\desktop.ini IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low IEXPLORE.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low IEXPLORE.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 IEXPLORE.EXE -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Outlook Express\ghost.exe 12fa989a3e318c4decb1a6ab26cda01a.exe File created C:\Program Files\Outlook Express\ghost.DLL ghost.exe File opened for modification C:\Program Files\Outlook Express\ghost.DLL ghost.exe File created C:\Program Files\Outlook Express\ghost.exe 12fa989a3e318c4decb1a6ab26cda01a.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\SSSSSS.BAT 12fa989a3e318c4decb1a6ab26cda01a.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Feeds IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{163FBCAE-A354-11EE-9BE3-5A2E32B6DBC3} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingDelete IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Check_Associations = "no" ghost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000440300007c020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main ghost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Zones IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{163FBCB0-A354-11EE-9BE3-5A2E32B6DBC3}.dat = "0" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31078309" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Connection Wizard ghost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SecuritySafe = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MINIE IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\OperationalData = "12" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer IEXPLORE.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Connection Wizard\Completed = 01000000 ghost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap IEXPLORE.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "1991094187" IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\RepService IEXPLORE.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4892 IEXPLORE.EXE 4892 IEXPLORE.EXE 1824 ghost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1296 wrote to memory of 4324 1296 12fa989a3e318c4decb1a6ab26cda01a.exe 92 PID 1296 wrote to memory of 4324 1296 12fa989a3e318c4decb1a6ab26cda01a.exe 92 PID 1296 wrote to memory of 4324 1296 12fa989a3e318c4decb1a6ab26cda01a.exe 92 PID 1824 wrote to memory of 4892 1824 ghost.exe 93 PID 1824 wrote to memory of 4892 1824 ghost.exe 93 PID 4892 wrote to memory of 532 4892 IEXPLORE.EXE 95 PID 4892 wrote to memory of 532 4892 IEXPLORE.EXE 95 PID 4892 wrote to memory of 532 4892 IEXPLORE.EXE 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\12fa989a3e318c4decb1a6ab26cda01a.exe"C:\Users\Admin\AppData\Local\Temp\12fa989a3e318c4decb1a6ab26cda01a.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\SSSSSS.BAT2⤵PID:4324
-
-
C:\Program Files\Outlook Express\ghost.exe"C:\Program Files\Outlook Express\ghost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" about:blank2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4892 CREDAT:17410 /prefetch:23⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:532 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 532 -s 12324⤵
- Program crash
PID:4064
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 532 -ip 5321⤵PID:2108
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5e08f414ba4240f9c767b571dcada7d89
SHA15b9d1f37d142c8aeca009fd95b6f94af4f1af236
SHA256a159ecd511a6250a36d864fbc54acc2ad68cf0dfdaf47ee33a8206aebfa6e349
SHA5121d302d3c476fbb2c622ae2f51f3e19e4f296728e929e63df85dfd247758a046cf1fc3a25cd83933818f49d9f64772d5616cd6e951109b4c631307ebb6e500bb8
-
Filesize
333KB
MD512fa989a3e318c4decb1a6ab26cda01a
SHA1182c5d9d48a68890d800ed75fdad3af00e9c123d
SHA256d004666c5176e398e42966e44c4aea32cbad97d84d35baaff06b5a98f8bcfc39
SHA512c4d63abde5fc477c2e29bfa468583a2d86afa22583a1c36678fcd8a19a45421be90d4bc34329cf50feca030c27d8ad80e03eaa2374cdd3d4db8af9e2556a04e4
-
Filesize
190B
MD51545766dbf4f5308bdab0eade67e8472
SHA131d2b9b8137ab1092f6c53a9a2dfb5ca54b3dc53
SHA256c8fd6b7bfefd5623feeb628b57987bd3e008486a2a949b58442a479f71f1c4f7
SHA5129e3ca11fe0f7fd1aac0ff948ebfe4b1b93e9c428e25494fc2c765fdee360cab4ef0d0361a1c3cb64565de7fd2e4b08d5dffbcfdda493e5517bd9ad619097b736