Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28-01-2024 01:57
Behavioral task
behavioral1
Sample
7bda31d949bdc601d8eed73b96a8d63c.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7bda31d949bdc601d8eed73b96a8d63c.exe
Resource
win10v2004-20231222-en
General
-
Target
7bda31d949bdc601d8eed73b96a8d63c.exe
-
Size
342KB
-
MD5
7bda31d949bdc601d8eed73b96a8d63c
-
SHA1
834d36b4cd84ae8b8890076001bcc03b738cb7b4
-
SHA256
5dcf383f864241b061dc3817a08b833657e01fab9f95e6168ebc093bbf032e30
-
SHA512
ae9c5718b8bf6be6ac4c5df5f03ec47d532f5bba42a115983a2ce240cb48a7898b82bb1e4821c8b2e474f904d75f2293ad5eefc03dd2f780ae222e09752da675
-
SSDEEP
6144:JdLyECo18b6fobHWTXeIBr3beX5htpHMa95xYDCsUQlKu:JdbI6IHSOYKXXtGa9DAzUQl
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\ActiveX32_64lo.exe" 7bda31d949bdc601d8eed73b96a8d63c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\ActiveX32_64lo.exe" 7bda31d949bdc601d8eed73b96a8d63c.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7bda31d949bdc601d8eed73b96a8d63c.exe -
Disables Task Manager via registry modification
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{JJhOKXSl-ZUWD-ubpK-1idX-wzG4eyU41q1K}\olmwKSKlNdgCU6b = "\"C:\\Users\\Admin\\AppData\\Roaming\\ActiveX32_64lo.exe\" /ActiveX" 7bda31d949bdc601d8eed73b96a8d63c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{JJhOKXSl-ZUWD-ubpK-1idX-wzG4eyU41q1K} 7bda31d949bdc601d8eed73b96a8d63c.exe -
Loads dropped DLL 1 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exepid process 2964 7bda31d949bdc601d8eed73b96a8d63c.exe -
Processes:
resource yara_rule behavioral1/memory/2964-0-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-2-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-5-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-4-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-39-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-49-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-54-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-56-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-66-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-80-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-90-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-104-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-114-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-128-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-138-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-148-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-162-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-176-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-186-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral1/memory/2964-200-0x0000000000400000-0x00000000004A6000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\olmwKSKlNdgCU6b = "C:\\Users\\Admin\\AppData\\Roaming\\ActiveX32_64lo.exe" 7bda31d949bdc601d8eed73b96a8d63c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\olmwKSKlNdgCU6b = "C:\\Users\\Admin\\AppData\\Roaming\\ActiveX32_64lo.exe" 7bda31d949bdc601d8eed73b96a8d63c.exe -
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7bda31d949bdc601d8eed73b96a8d63c.exe -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 7bda31d949bdc601d8eed73b96a8d63c.exe -
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main 7bda31d949bdc601d8eed73b96a8d63c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exepid process 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exepid process 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
7bda31d949bdc601d8eed73b96a8d63c.exepid process 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe 2964 7bda31d949bdc601d8eed73b96a8d63c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bda31d949bdc601d8eed73b96a8d63c.exe"C:\Users\Admin\AppData\Local\Temp\7bda31d949bdc601d8eed73b96a8d63c.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5NO18RQU\NewErrorPageTemplate[1]Filesize
1KB
MD5cdf81e591d9cbfb47a7f97a2bcdb70b9
SHA18f12010dfaacdecad77b70a3e781c707cf328496
SHA256204d95c6fb161368c795bb63e538fe0b11f9e406494bb5758b3b0d60c5f651bd
SHA512977dcc2c6488acaf0e5970cef1a7a72c9f9dc6bb82da54f057e0853c8e939e4ab01b163eb7a5058e093a8bc44ecad9d06880fdc883e67e28ac67fee4d070a4cc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CMN2CJMU\dnserrordiagoff[1]Filesize
1KB
MD547f581b112d58eda23ea8b2e08cf0ff0
SHA16ec1df5eaec1439573aef0fb96dabfc953305e5b
SHA256b1c947d00db5fce43314c56c663dbeae0ffa13407c9c16225c17ccefc3afa928
SHA512187383eef3d646091e9f68eff680a11c7947b3d9b54a78cc6de4a04629d7037e9c97673ac054a6f1cf591235c110ca181a6b69ecba0e5032168f56f4486fff92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YAQV8V65\errorPageStrings[2]Filesize
2KB
MD5e3e4a98353f119b80b323302f26b78fa
SHA120ee35a370cdd3a8a7d04b506410300fd0a6a864
SHA2569466d620dc57835a2475f8f71e304f54aee7160e134ba160baae0f19e5e71e66
SHA512d8e4d73c76804a5abebd5dbc3a86dcdb6e73107b873175a8de67332c113fb7c4899890bf7972e467866fa4cd100a7e2a10a770e5a9c41cbf23b54351b771dcee
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YAQV8V65\httpErrorPagesScripts[1]Filesize
8KB
MD53f57b781cb3ef114dd0b665151571b7b
SHA1ce6a63f996df3a1cccb81720e21204b825e0238c
SHA25646e019fa34465f4ed096a9665d1827b54553931ad82e98be01edb1ddbc94d3ad
SHA5128cbf4ef582332ae7ea605f910ad6f8a4bc28513482409fa84f08943a72cac2cf0fa32b6af4c20c697e1fac2c5ba16b5a64a23af0c11eefbf69625b8f9f90c8fa
-
\Users\Admin\AppData\Local\Temp\dwlGina3.dllFilesize
93KB
MD51173123287198dce1eb831f04e28352c
SHA139d650f4297c990a7ffaa7dc3b6d0ef903c9bd14
SHA25665d4582e135c774d9c827ae08de8b77f199ee934f13d1a0537df4f5d18f590ba
SHA512e9fdb6e808b0f3ed850fb364d48609a9726fd41ad138594fc04f8d48d5672aec3aaa76af236f07c4263c053dc539f99009e74491adb03c885190dcce78f0cede
-
memory/2964-10-0x00000000003D0000-0x00000000003EC000-memory.dmpFilesize
112KB
-
memory/2964-66-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-0-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-39-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-40-0x00000000003D0000-0x00000000003EC000-memory.dmpFilesize
112KB
-
memory/2964-4-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-5-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-49-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-2-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-1-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB
-
memory/2964-54-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-56-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-57-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2964-6-0x00000000002C0000-0x00000000002C1000-memory.dmpFilesize
4KB
-
memory/2964-80-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-90-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-104-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-114-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-128-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-138-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-148-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-162-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-176-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-186-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB
-
memory/2964-200-0x0000000000400000-0x00000000004A6000-memory.dmpFilesize
664KB