Analysis
- max time kernel
129s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
11/01/2024, 03:20
Behavioral task
behavioral1
Sample
52650bab5d15ccc2ae9e3f11a3d88b4d.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
52650bab5d15ccc2ae9e3f11a3d88b4d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 52650bab5d15ccc2ae9e3f11a3d88b4d.exe
- Size 680KB
- Sample240111-dv937adfbp
- SHA256 e88aeada998cb4bf2200b04b6b648333aaa4b133d84334deb9eefb8196f966e0
- MD5 52650bab5d15ccc2ae9e3f11a3d88b4d
- SHA1 447e10cbcc09f951aa822b8a694c41ba5797fe09
- SHA512 a85d45df34945924ea38c3872c47b54fe438f40d63aac3a333ef06a70ad98278ca1a07f8ce89329b00f17ee7d3ca730751924b863ef77be567d1209894abb704
- SSDEEP 12288:GEmSguwN6z0RVONw5TjuT4mBYcqufl+4GRmNHCcewM:Pq6z0RVOm5/uT4mOcTI4GXcer
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
pid Process 3856 52650bab5d15ccc2ae9e3f11a3d88b4d.exe 3856 52650bab5d15ccc2ae9e3f11a3d88b4d.exe 3856 52650bab5d15ccc2ae9e3f11a3d88b4d.exe 3856 52650bab5d15ccc2ae9e3f11a3d88b4d.exe -
resource yara_rule behavioral2/memory/3856-0-0x0000000000400000-0x0000000000541000-memory.dmp vmprotect behavioral2/memory/3856-1-0x0000000000400000-0x0000000000541000-memory.dmp vmprotect behavioral2/memory/3856-33-0x0000000000400000-0x0000000000541000-memory.dmp vmprotect - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3856 52650bab5d15ccc2ae9e3f11a3d88b4d.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\0\win32 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID\ = "MSWinsock.Winsock" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\ToolboxBitmap32 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID\ = "InetCtls.Inet" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\ = "Microsoft Internet Transfer Control, version 6.0" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Control 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSINET.OCX" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\TypeLib\ = "{48E59290-9880-11CF-9754-00AA00C00908}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version\ = "1.0" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{48E59290-9880-11CF-9754-00AA00C00908}\1.0\FLAGS\ = "2" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\VersionIndependentProgID 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\MiscStatus 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\ = "Internet Control URL Property Page Object" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59295-9880-11CF-9754-00AA00C00908}\InprocServer32 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59291-9880-11CF-9754-00AA00C00908}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D} 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E59292-9880-11CF-9754-00AA00C00908}\ = "DInetEvents" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Version\ = "1.0" 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib 52650bab5d15ccc2ae9e3f11a3d88b4d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet.1\CLSID 52650bab5d15ccc2ae9e3f11a3d88b4d.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3856 52650bab5d15ccc2ae9e3f11a3d88b4d.exe 3856 52650bab5d15ccc2ae9e3f11a3d88b4d.exe 3856 52650bab5d15ccc2ae9e3f11a3d88b4d.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MSINET.OCX
- Size 112KB
- SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
- MD5 7bec181a21753498b6bd001c42a42722
- SHA1 3249f233657dc66632c0539c47895bfcee5770cc
- SHA512 d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
- SSDEEP 3072:i4QYXpLZaH+kCp1RCaSCF/6UMiySQYPfrj:i4rBfL1RCaSC0ej
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MSWINSCK.ocx
- Size 105KB
- SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
- MD5 9484c04258830aa3c2f2a70eb041414c
- SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
- SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
- SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
- MD5 SHA1 SHA512 SSDEEP