Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 04:24
Static task
static1
Behavioral task
behavioral1
Sample
280c3da5ea65c959067f8ab553037370.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
280c3da5ea65c959067f8ab553037370.exe
Resource
win10v2004-20231215-en
General
-
Target
280c3da5ea65c959067f8ab553037370.exe
-
Size
320KB
-
MD5
280c3da5ea65c959067f8ab553037370
-
SHA1
7941c2b2118fd30c2b8c65a1beab08d9331203c9
-
SHA256
c390e62943f6c3cd8a21a5aed7b9d8528b30cae4bad6a5ba26f817d9bbf68d5f
-
SHA512
628bf2984f38a82cda34f4b1afbe6f1a810201a29b9ce2e0f6a9daee31b7a86fa60dd114888d3c0f77cb10d5a539b2cc0b255c29abeb58a13613f4fdc0447041
-
SSDEEP
6144:ym/o/vvofih8jWlw7WtoPkvVOfzUE8uoglOs5WY94/JzZwLZ5rLLVIqxE+1qg:5o/UWIkNOfzUEQgFGJNmjKqxE+1
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\sbcvvhost_win86.exe" 280c3da5ea65c959067f8ab553037370.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\sbcvvhost_win86.exe" 280c3da5ea65c959067f8ab553037370.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 280c3da5ea65c959067f8ab553037370.exe -
Disables Task Manager via registry modification
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6ScJzIf0-kevt-RkjF-pr7R-UIAZ3ihJ5KXN}\WBhXTAWuFpmNyON = "\"C:\\Users\\Admin\\AppData\\Roaming\\sbcvvhost_win86.exe\" /ActiveX" 280c3da5ea65c959067f8ab553037370.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{6ScJzIf0-kevt-RkjF-pr7R-UIAZ3ihJ5KXN} 280c3da5ea65c959067f8ab553037370.exe -
Loads dropped DLL 1 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exepid process 2512 280c3da5ea65c959067f8ab553037370.exe -
Processes:
resource yara_rule behavioral1/memory/2512-4-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-6-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-9-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-11-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-12-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-14-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-15-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-49-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-59-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-64-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-66-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-76-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-86-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-100-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-114-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-124-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-138-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-148-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-186-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-196-0x0000000000400000-0x000000000049A000-memory.dmp upx behavioral1/memory/2512-206-0x0000000000400000-0x000000000049A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\WBhXTAWuFpmNyON = "C:\\Users\\Admin\\AppData\\Roaming\\sbcvvhost_win86.exe" 280c3da5ea65c959067f8ab553037370.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WBhXTAWuFpmNyON = "C:\\Users\\Admin\\AppData\\Roaming\\sbcvvhost_win86.exe" 280c3da5ea65c959067f8ab553037370.exe -
Processes:
280c3da5ea65c959067f8ab553037370.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 280c3da5ea65c959067f8ab553037370.exe -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 280c3da5ea65c959067f8ab553037370.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exedescription pid process target process PID 2040 set thread context of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe -
Processes:
280c3da5ea65c959067f8ab553037370.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main 280c3da5ea65c959067f8ab553037370.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exepid process 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exepid process 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exe280c3da5ea65c959067f8ab553037370.exepid process 2040 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe 2512 280c3da5ea65c959067f8ab553037370.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
280c3da5ea65c959067f8ab553037370.exedescription pid process target process PID 2040 wrote to memory of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe PID 2040 wrote to memory of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe PID 2040 wrote to memory of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe PID 2040 wrote to memory of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe PID 2040 wrote to memory of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe PID 2040 wrote to memory of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe PID 2040 wrote to memory of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe PID 2040 wrote to memory of 2512 2040 280c3da5ea65c959067f8ab553037370.exe 280c3da5ea65c959067f8ab553037370.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\280c3da5ea65c959067f8ab553037370.exe"C:\Users\Admin\AppData\Local\Temp\280c3da5ea65c959067f8ab553037370.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\280c3da5ea65c959067f8ab553037370.exeC:\Users\Admin\AppData\Local\Temp\280c3da5ea65c959067f8ab553037370.exe2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\errorPageStrings[2]Filesize
2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\53STNJLW\httpErrorPagesScripts[1]Filesize
8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\dnserrordiagoff[1]Filesize
1KB
MD547f581b112d58eda23ea8b2e08cf0ff0
SHA16ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M2VO416U\NewErrorPageTemplate[1]Filesize
1KB
MD5cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA18f12010dfaacdecad77b70a3e781c707cf328496
SHA256204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc
-
\Users\Admin\AppData\Local\Temp\dwlGina3.dllFilesize
93KB
MD51173123287198dce1eb831f04e28352c
SHA139d650f4297c990a7ffaa7dc3b6d0ef903c9bd14
SHA25665d4582e135c774d9c827ae08de8b77f199ee934f13d1a0537df4f5d18f590ba
SHA512e9fdb6e808b0f3ed850fb364d48609a9726fd41ad138594fc04f8d48d5672aec3aaa76af236f07c4263c053dc539f99009e74491adb03c885190dcce78f0cede
-
memory/2512-59-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-4-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-14-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-15-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-16-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2512-11-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-20-0x0000000000550000-0x000000000056C000-memory.dmpFilesize
112KB
-
memory/2512-50-0x0000000000550000-0x000000000056C000-memory.dmpFilesize
112KB
-
memory/2512-49-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-9-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2512-2-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-6-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-12-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-64-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-66-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-67-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2512-76-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-86-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-100-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-114-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-124-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-138-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-148-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-186-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-196-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/2512-206-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB