Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-01-2024 23:22
Static task
static1
Behavioral task
behavioral1
Sample
6bc16e03ad9eff1a5d11c5413199a5a0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6bc16e03ad9eff1a5d11c5413199a5a0.exe
Resource
win10v2004-20231215-en
General
-
Target
6bc16e03ad9eff1a5d11c5413199a5a0.exe
-
Size
330KB
-
MD5
6bc16e03ad9eff1a5d11c5413199a5a0
-
SHA1
37a0f5d0e9bbee066f21d651c61ad63f032f74f2
-
SHA256
1031b5832e8ed5b892e65e8f1152da3e1c65db4103f635e2b98abc7d6536ef59
-
SHA512
9df4ad6e782b0b0e211505faded1bea221a90f5c4745210ec0e0b606d8abcdb63213823b25f46bda6210c0844394f2b8c26377fa13ef063e1e7c21e0ffa3b5e9
-
SSDEEP
6144:XQoVo4o/otAQuLj5SCfbEB7gVNosIH132hlSNPgfVqzxWcC:X57ruLN+gVusIH1kSRgcxXC
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
6bc16e03ad9eff1a5d11c5413199a5a0.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\ProgramData\\InetAccelerator\\InetAccelerator.exe,userinit.exe," 6bc16e03ad9eff1a5d11c5413199a5a0.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\InetAccelerator\\InetAccelerator.exe,Explorer.exe," 6bc16e03ad9eff1a5d11c5413199a5a0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
6bc16e03ad9eff1a5d11c5413199a5a0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\InetAccelerator = "C:\\Users\\Admin\\AppData\\Roaming\\InetAccelerator\\InetAccelerator.exe" 6bc16e03ad9eff1a5d11c5413199a5a0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\InetAccelerator. = "C:\\ProgramData\\InetAccelerator\\InetAccelerator.exe" 6bc16e03ad9eff1a5d11c5413199a5a0.exe -
Drops file in System32 directory 2 IoCs
Processes:
6bc16e03ad9eff1a5d11c5413199a5a0.exedescription ioc process File created C:\Windows\System32\InetAccelerator.exe 6bc16e03ad9eff1a5d11c5413199a5a0.exe File opened for modification C:\Windows\System32\InetAccelerator.exe 6bc16e03ad9eff1a5d11c5413199a5a0.exe -
Drops file in Windows directory 1 IoCs
Processes:
6bc16e03ad9eff1a5d11c5413199a5a0.exedescription ioc process File opened for modification C:\Windows\win.ini 6bc16e03ad9eff1a5d11c5413199a5a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
6bc16e03ad9eff1a5d11c5413199a5a0.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main 6bc16e03ad9eff1a5d11c5413199a5a0.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
6bc16e03ad9eff1a5d11c5413199a5a0.exepid process 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
6bc16e03ad9eff1a5d11c5413199a5a0.exepid process 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe 2212 6bc16e03ad9eff1a5d11c5413199a5a0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bc16e03ad9eff1a5d11c5413199a5a0.exe"C:\Users\Admin\AppData\Local\Temp\6bc16e03ad9eff1a5d11c5413199a5a0.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\InetAccelerator\InetAccelerator.exeFilesize
330KB
MD56bc16e03ad9eff1a5d11c5413199a5a0
SHA137a0f5d0e9bbee066f21d651c61ad63f032f74f2
SHA2561031b5832e8ed5b892e65e8f1152da3e1c65db4103f635e2b98abc7d6536ef59
SHA5129df4ad6e782b0b0e211505faded1bea221a90f5c4745210ec0e0b606d8abcdb63213823b25f46bda6210c0844394f2b8c26377fa13ef063e1e7c21e0ffa3b5e9