Analysis

  • max time kernel
    93s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 02:35

General

  • Target

    7bebfc732b2fd9295c93a1a843d02043.exe

  • Size

    168KB

  • MD5

    7bebfc732b2fd9295c93a1a843d02043

  • SHA1

    19a1a0cfabef55d3362b8c82e8f36482c477fea2

  • SHA256

    238317018f3c43e2a4bba5e1c5de7c0a8461444affafa3530985be6769d40aa9

  • SHA512

    81763dd29dc62ac8116167963d0e12baf4a4d69d44c43745174663a1458ecaf703291f71fc5bb476f2917d04c4264bfc818d26eef4d671983259cebe8301b0f2

  • SSDEEP

    3072:Jym3I7VpdizShu3NRYEEaH1qwRKWoV7pOBJ/ttHMb9CdZ/bux:H3epdizuu3NRbEaHXrq7kJlub9wyx

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe
    "C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe
      C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2752
      • C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe
        "C:\Users\Admin\AppData\Local\Temp\7bebfc732b2fd9295c93a1a843d02043.exe"
        3⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2896
        • C:\Users\Admin\AppData\Roaming\Nsnbno.exe
          "C:\Users\Admin\AppData\Roaming\Nsnbno.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2388
          • C:\Users\Admin\AppData\Roaming\Nsnbno.exe
            C:\Users\Admin\AppData\Roaming\Nsnbno.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4856
            • C:\Users\Admin\AppData\Roaming\Nsnbno.exe
              "C:\Users\Admin\AppData\Roaming\Nsnbno.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4756
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:964
                • C:\Program Files\Internet Explorer\IEXPLORE.EXE
                  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
                  8⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1456
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1456 CREDAT:17410 /prefetch:2
                    9⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    55adff48fbcd7763c70a0d51d485d24f

    SHA1

    8ba66cb09d8e16d22c35931083d443155d3a04fa

    SHA256

    801c05af90120efdf31e4dfdcc5e7f2b76b9ca0e0746f58fdf12bf99287d8aca

    SHA512

    a3151d562469fd2412c237bb5646bb214a9a9f8664be4eb48fdf704d9710872e41947669f770ac74d9d1eb5d6ea5953e40cc5a85d57e56fc82708341154eee7b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    9f4aa597503f168bfd4f0280c0bfe5f1

    SHA1

    4c7d897444c7dd141c2436dcb67057710ed8931c

    SHA256

    4381fc0e61136dade4a6780ae3c2f838f1b25a1b815f3e958fe6ce9466bc3b27

    SHA512

    e95838a6dddd756fb1c0fb75734757ba3931271a90672f35d29d21a3c04d46d2850a17a8f82affc48b5ea74ca5dc8545646321723e79cf64edb0c62215a0515c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NSWVVUXL\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Roaming\Nsnbno.exe

    Filesize

    168KB

    MD5

    7bebfc732b2fd9295c93a1a843d02043

    SHA1

    19a1a0cfabef55d3362b8c82e8f36482c477fea2

    SHA256

    238317018f3c43e2a4bba5e1c5de7c0a8461444affafa3530985be6769d40aa9

    SHA512

    81763dd29dc62ac8116167963d0e12baf4a4d69d44c43745174663a1458ecaf703291f71fc5bb476f2917d04c4264bfc818d26eef4d671983259cebe8301b0f2

  • memory/2752-4-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2752-5-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2752-2-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB

  • memory/2896-6-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2896-17-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2896-11-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/2896-10-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4756-32-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4756-33-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/4856-25-0x0000000000400000-0x000000000041A000-memory.dmp

    Filesize

    104KB