Analysis
-
max time kernel
93s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 02:35
Static task
static1
Behavioral task
behavioral1
Sample
7bebfc732b2fd9295c93a1a843d02043.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7bebfc732b2fd9295c93a1a843d02043.exe
Resource
win10v2004-20231222-en
General
-
Target
7bebfc732b2fd9295c93a1a843d02043.exe
-
Size
168KB
-
MD5
7bebfc732b2fd9295c93a1a843d02043
-
SHA1
19a1a0cfabef55d3362b8c82e8f36482c477fea2
-
SHA256
238317018f3c43e2a4bba5e1c5de7c0a8461444affafa3530985be6769d40aa9
-
SHA512
81763dd29dc62ac8116167963d0e12baf4a4d69d44c43745174663a1458ecaf703291f71fc5bb476f2917d04c4264bfc818d26eef4d671983259cebe8301b0f2
-
SSDEEP
3072:Jym3I7VpdizShu3NRYEEaH1qwRKWoV7pOBJ/ttHMb9CdZ/bux:H3epdizuu3NRbEaHXrq7kJlub9wyx
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2388 Nsnbno.exe 4856 Nsnbno.exe 4756 Nsnbno.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nsnbno = "C:\\Users\\Admin\\AppData\\Roaming\\Nsnbno.exe" 7bebfc732b2fd9295c93a1a843d02043.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2428 set thread context of 2752 2428 7bebfc732b2fd9295c93a1a843d02043.exe 86 PID 2752 set thread context of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2388 set thread context of 4856 2388 Nsnbno.exe 97 PID 4856 set thread context of 4756 4856 Nsnbno.exe 98 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084946" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084946" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3635200359" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3635200359" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413174353" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{044596BC-BD86-11EE-A0B6-DAD4CCDE76B8} = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084946" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3637699839" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2896 7bebfc732b2fd9295c93a1a843d02043.exe 2896 7bebfc732b2fd9295c93a1a843d02043.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4756 Nsnbno.exe Token: SeDebugPrivilege 3040 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1456 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2428 7bebfc732b2fd9295c93a1a843d02043.exe 2388 Nsnbno.exe 1456 IEXPLORE.EXE 1456 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE 3040 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2752 2428 7bebfc732b2fd9295c93a1a843d02043.exe 86 PID 2428 wrote to memory of 2752 2428 7bebfc732b2fd9295c93a1a843d02043.exe 86 PID 2428 wrote to memory of 2752 2428 7bebfc732b2fd9295c93a1a843d02043.exe 86 PID 2428 wrote to memory of 2752 2428 7bebfc732b2fd9295c93a1a843d02043.exe 86 PID 2428 wrote to memory of 2752 2428 7bebfc732b2fd9295c93a1a843d02043.exe 86 PID 2428 wrote to memory of 2752 2428 7bebfc732b2fd9295c93a1a843d02043.exe 86 PID 2428 wrote to memory of 2752 2428 7bebfc732b2fd9295c93a1a843d02043.exe 86 PID 2752 wrote to memory of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2752 wrote to memory of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2752 wrote to memory of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2752 wrote to memory of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2752 wrote to memory of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2752 wrote to memory of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2752 wrote to memory of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2752 wrote to memory of 2896 2752 7bebfc732b2fd9295c93a1a843d02043.exe 87 PID 2896 wrote to memory of 2388 2896 7bebfc732b2fd9295c93a1a843d02043.exe 96 PID 2896 wrote to memory of 2388 2896 7bebfc732b2fd9295c93a1a843d02043.exe 96 PID 2896 wrote to memory of 2388 2896 7bebfc732b2fd9295c93a1a843d02043.exe 96 PID 2388 wrote to memory of 4856 2388 Nsnbno.exe 97 PID 2388 wrote to memory of 4856 2388 Nsnbno.exe 97 PID 2388 wrote to memory of 4856 2388 Nsnbno.exe 97 PID 2388 wrote to memory of 4856 2388 Nsnbno.exe 97 PID 2388 wrote to memory of 4856 2388 Nsnbno.exe 97 PID 2388 wrote to memory of 4856 2388 Nsnbno.exe 97 PID 2388 wrote to memory of 4856 2388 Nsnbno.exe 97 PID 4856 wrote to memory of 4756 4856 Nsnbno.exe 98 PID 4856 wrote to memory of 4756 4856 Nsnbno.exe 98 PID 4856 wrote to memory of 4756 4856 Nsnbno.exe 98 PID 4856 wrote to memory of 4756 4856 Nsnbno.exe 98 PID 4856 wrote to memory of 4756 4856 Nsnbno.exe 98 PID 4856 wrote to memory of 4756 4856 Nsnbno.exe 98 PID 4856 wrote to memory of 4756 4856 Nsnbno.exe 98 PID 4856 wrote to memory of 4756 4856 Nsnbno.exe 98 PID 4756 wrote to memory of 964 4756 Nsnbno.exe 101 PID 4756 wrote to memory of 964 4756 Nsnbno.exe 101 PID 4756 wrote to memory of 964 4756 Nsnbno.exe 101 PID 964 wrote to memory of 1456 964 iexplore.exe 102 PID 964 wrote to memory of 1456 964 iexplore.exe 102 PID 1456 wrote to memory of 3040 1456 IEXPLORE.EXE 103 PID 1456 wrote to memory of 3040 1456 IEXPLORE.EXE 103 PID 1456 wrote to memory of 3040 1456 IEXPLORE.EXE 103 PID 4756 wrote to memory of 3040 4756 Nsnbno.exe 103 PID 4756 wrote to memory of 3040 4756 Nsnbno.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe"C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exeC:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe"C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Roaming\Nsnbno.exe"C:\Users\Admin\AppData\Roaming\Nsnbno.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Roaming\Nsnbno.exeC:\Users\Admin\AppData\Roaming\Nsnbno.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Roaming\Nsnbno.exe"C:\Users\Admin\AppData\Roaming\Nsnbno.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"8⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:17410 /prefetch:29⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3040
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD555adff48fbcd7763c70a0d51d485d24f
SHA18ba66cb09d8e16d22c35931083d443155d3a04fa
SHA256801c05af90120efdf31e4dfdcc5e7f2b76b9ca0e0746f58fdf12bf99287d8aca
SHA512a3151d562469fd2412c237bb5646bb214a9a9f8664be4eb48fdf704d9710872e41947669f770ac74d9d1eb5d6ea5953e40cc5a85d57e56fc82708341154eee7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD59f4aa597503f168bfd4f0280c0bfe5f1
SHA14c7d897444c7dd141c2436dcb67057710ed8931c
SHA2564381fc0e61136dade4a6780ae3c2f838f1b25a1b815f3e958fe6ce9466bc3b27
SHA512e95838a6dddd756fb1c0fb75734757ba3931271a90672f35d29d21a3c04d46d2850a17a8f82affc48b5ea74ca5dc8545646321723e79cf64edb0c62215a0515c
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
168KB
MD57bebfc732b2fd9295c93a1a843d02043
SHA119a1a0cfabef55d3362b8c82e8f36482c477fea2
SHA256238317018f3c43e2a4bba5e1c5de7c0a8461444affafa3530985be6769d40aa9
SHA51281763dd29dc62ac8116167963d0e12baf4a4d69d44c43745174663a1458ecaf703291f71fc5bb476f2917d04c4264bfc818d26eef4d671983259cebe8301b0f2