Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11-01-2024 19:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
54643009b12fa41b6e67403b6eb628de.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
54643009b12fa41b6e67403b6eb628de.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
54643009b12fa41b6e67403b6eb628de.exe
-
Size
28KB
-
MD5
54643009b12fa41b6e67403b6eb628de
-
SHA1
a2564e6ec225af5d1ce906c05d322ba2728fc1cc
-
SHA256
86c9212b7970d70b2d7141fd0ea9178603d149f3d78ffb57496b437f2e60f4a6
-
SHA512
ff5705522b332d762752f1eab2c378e4593dd49fbecc4d2c1d2bd5a12859271df89815d0168956179e168172b0effb31cb7a326e851d2d77081dedd40a866b93
-
SSDEEP
384:nOy0MyjKoJpjS9Os5zgBo3EyCKS/Lp8EId+v9hq8YnX+9aNJawcudoD7U:nRydj+Os5CoUyij1lhXYuAnbcuyD7U
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\54643009b12fa41b6e67403b6eb628de.exe" 54643009b12fa41b6e67403b6eb628de.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 54643009b12fa41b6e67403b6eb628de.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0009000000012274-1.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2780 sbsm.exe -
Loads dropped DLL 3 IoCs
pid Process 2628 54643009b12fa41b6e67403b6eb628de.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2628 54643009b12fa41b6e67403b6eb628de.exe -
resource yara_rule behavioral1/files/0x0009000000012274-1.dat upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\ 54643009b12fa41b6e67403b6eb628de.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 54643009b12fa41b6e67403b6eb628de.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.newsearchgate.com/index.php?b=1&t=0&q={searchTerms}" 54643009b12fa41b6e67403b6eb628de.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.browsergate.com/redirect.php" 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" 54643009b12fa41b6e67403b6eb628de.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Search 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" 54643009b12fa41b6e67403b6eb628de.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" 54643009b12fa41b6e67403b6eb628de.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main 54643009b12fa41b6e67403b6eb628de.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383} 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\xxx = "xxx" 54643009b12fa41b6e67403b6eb628de.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" 54643009b12fa41b6e67403b6eb628de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C2A1C5CB-C0EF-4689-9436-F62CCA1C5383}\InprocServer32\ThreadingModel = "Apartment" 54643009b12fa41b6e67403b6eb628de.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID 54643009b12fa41b6e67403b6eb628de.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe 2628 54643009b12fa41b6e67403b6eb628de.exe 2780 sbsm.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2628 54643009b12fa41b6e67403b6eb628de.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2780 2628 54643009b12fa41b6e67403b6eb628de.exe 28 PID 2628 wrote to memory of 2780 2628 54643009b12fa41b6e67403b6eb628de.exe 28 PID 2628 wrote to memory of 2780 2628 54643009b12fa41b6e67403b6eb628de.exe 28 PID 2628 wrote to memory of 2780 2628 54643009b12fa41b6e67403b6eb628de.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\54643009b12fa41b6e67403b6eb628de.exe"C:\Users\Admin\AppData\Local\Temp\54643009b12fa41b6e67403b6eb628de.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5afab408d86bd4bc60daeebb371fc48d2
SHA15427dd224d018a69164e82bb9f956f8d27b69395
SHA256b87dff577ca85525c7efe71dec32fe107d50854e76d2314eb3352bb43c80b8cc
SHA512d8c85a0953f75ac4cdc5413a5eb020fcea64209d04c7bf1abaca1b576d7d7496e4800c8533ae53d61480b5c712c9a17d79b835787e6d716adf01df9e63484725
-
Filesize
7KB
MD5d5080c753fc432c953253fdf177c47f1
SHA1348838430ec86c187d75c12341d5afe36fa9bcb3
SHA25610a08143a2506eb1dfcb1493a365d957a76efb1ae5440fd941a72176ce9f81d2
SHA51269b6a6ebe073f399062ddddf4ffca404cbe0d0642e8c97a9af998a8e9677f4d5325efa3fcf54ed009b1062d8d12dbe4d227863ed57365ee0e7b482d600735945