Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1cea24d80129f6ae6e00cead0741f93d.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1cea24d80129f6ae6e00cead0741f93d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
1cea24d80129f6ae6e00cead0741f93d.exe
-
Size
440KB
-
MD5
1cea24d80129f6ae6e00cead0741f93d
-
SHA1
c2bed1de0699d8f1d23d2513f9c06d0aeb5e2474
-
SHA256
d3aaf87cb5536dd1d46de93e08e72cd9db69f7d4848bdd9a4d113d79ca6e8870
-
SHA512
4524da158fadfc79acba682b13fef33d49c2cadce26ba84a7b73a603d064283547a5c7ea132054d611bd322c7ec137dfe1809000ec75ffea38aa3c1feaf1851e
-
SSDEEP
6144:5lbzcYnRNkVsuaRaU6mHGO4rBfL1RCaSC0eZylPwhMX8BOd41NX/+uJ82wl9J+F5:n0aRz6mHGV1R3/ZyWuzdGl/tJkJ+zPr
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1332 c308.exe -
Loads dropped DLL 2 IoCs
pid Process 1332 c308.exe 1332 c308.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSWINSCK.OCX 1cea24d80129f6ae6e00cead0741f93d.exe File opened for modification C:\Windows\SysWOW64\MSINET.OCX 1cea24d80129f6ae6e00cead0741f93d.exe File opened for modification C:\Windows\SysWOW64\c308.exe 1cea24d80129f6ae6e00cead0741f93d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSINET.OCX" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0 c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908} c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" c308.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32 c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents" c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1 c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32 c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version\ = "1.0" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908} c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0 c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSINET.OCX, 1" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\1\ = "132497" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32 c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908} c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus\ = "0" c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\ = "Microsoft Internet Transfer Control 6.0" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}" c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ProgID\ = "InetCtls.Inet.1" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\InprocServer32 c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\HELPDIR\ c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Programmable c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Control c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908} c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS\ = "2" c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSINET.OCX" c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502} c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ = "IInet" c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908}\ = "Internet Control General Property Page Object" c308.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908} c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ = "Microsoft Internet Transfer Control, version 6.0" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CurVer c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\ = "Microsoft Internet Transfer Control, version 6.0" c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908} c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1 c308.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories c308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\Version = "1.0" c308.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59294-9880-11CF-9754-00AA00C00908} c308.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe 4592 1cea24d80129f6ae6e00cead0741f93d.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4592 1cea24d80129f6ae6e00cead0741f93d.exe 1332 c308.exe 1332 c308.exe 1332 c308.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4592 wrote to memory of 1332 4592 1cea24d80129f6ae6e00cead0741f93d.exe 94 PID 4592 wrote to memory of 1332 4592 1cea24d80129f6ae6e00cead0741f93d.exe 94 PID 4592 wrote to memory of 1332 4592 1cea24d80129f6ae6e00cead0741f93d.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cea24d80129f6ae6e00cead0741f93d.exe"C:\Users\Admin\AppData\Local\Temp\1cea24d80129f6ae6e00cead0741f93d.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Windows\SysWOW64\c308.exeC:\Windows\system32\c308.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1332
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD57bec181a21753498b6bd001c42a42722
SHA13249f233657dc66632c0539c47895bfcee5770cc
SHA25673da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
SHA512d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
-
Filesize
34KB
MD56a7ae7e491182a4190209a1c07e3dfd2
SHA1ba0269a7bd9094d1cd84b857c295b4630f68335d
SHA256fa8b650cac98bc85962a38052c94a12c35321950362cedd37ecb8227096176b1
SHA51269cb932fde686c17770d2d62e65c0d39963b92d58aa81a5226be97fca0d8c6c6d9fef848362fac8df412632a6b0bdb8b4b92ef6f4a98b705082ef03eb16bd255