Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28-01-2024 20:43
Behavioral task
behavioral1
Sample
7df365fd721d0afe14921c46b7cc7f18.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
7df365fd721d0afe14921c46b7cc7f18.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
7df365fd721d0afe14921c46b7cc7f18.exe
-
Size
19KB
-
MD5
7df365fd721d0afe14921c46b7cc7f18
-
SHA1
3a1db3ec7c1f88aa10b97bcfc05eda3e49ac42f3
-
SHA256
f9f0f56bc391706dc7df7bf9f68643483f0429af9c9616f1784b4cc7eaf6d7e6
-
SHA512
5283faa4d86d2610d4ec8b2a0bcc3813415d3ab79f183a7f7923c8642c716c8f94861d10579f4d0e3a8a2fb551099b3ef96e65515e508e4268db0e3a01b2be7a
-
SSDEEP
384:MTXkLYWqvxnLelXLjXVwCD4VV3sf3eke8iykT+NiCv6saNJawcudoD7UQ:HMvBLeFL5wY4VV8fu73L8iCSlnbcuyDY
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7df365fd721d0afe14921c46b7cc7f18.exe" 7df365fd721d0afe14921c46b7cc7f18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 7df365fd721d0afe14921c46b7cc7f18.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0009000000012287-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2488 sbsm.exe -
Loads dropped DLL 3 IoCs
pid Process 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe -
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/files/0x0009000000012287-2.dat upx behavioral1/memory/2972-4-0x0000000010000000-0x000000001000B000-memory.dmp upx behavioral1/memory/2972-13-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88} 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{7C109800-A5D5-438F-9640-18D17E168B88}\ 7df365fd721d0afe14921c46b7cc7f18.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 7df365fd721d0afe14921c46b7cc7f18.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" 7df365fd721d0afe14921c46b7cc7f18.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Search 7df365fd721d0afe14921c46b7cc7f18.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.searchagate.com/index.php?b=1&t=0&q={searchTerms}" 7df365fd721d0afe14921c46b7cc7f18.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.gateietool.com/redirect.php" 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" 7df365fd721d0afe14921c46b7cc7f18.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" 7df365fd721d0afe14921c46b7cc7f18.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88} 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\xxx = "xxx" 7df365fd721d0afe14921c46b7cc7f18.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sbmdl.dll" 7df365fd721d0afe14921c46b7cc7f18.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7C109800-A5D5-438F-9640-18D17E168B88}\InprocServer32\ThreadingModel = "Apartment" 7df365fd721d0afe14921c46b7cc7f18.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID 7df365fd721d0afe14921c46b7cc7f18.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe 2972 7df365fd721d0afe14921c46b7cc7f18.exe 2488 sbsm.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2488 2972 7df365fd721d0afe14921c46b7cc7f18.exe 28 PID 2972 wrote to memory of 2488 2972 7df365fd721d0afe14921c46b7cc7f18.exe 28 PID 2972 wrote to memory of 2488 2972 7df365fd721d0afe14921c46b7cc7f18.exe 28 PID 2972 wrote to memory of 2488 2972 7df365fd721d0afe14921c46b7cc7f18.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7df365fd721d0afe14921c46b7cc7f18.exe"C:\Users\Admin\AppData\Local\Temp\7df365fd721d0afe14921c46b7cc7f18.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\sbsm.exeC:\Users\Admin\AppData\Local\Temp\sbsm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2488
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5e2695d814a34633f14f4fc39d0262298
SHA1c98429e44969912c5104bcc203efe89b7d0dcd05
SHA256e3661798b1f3425f8948b2f03334ac5a121b408e1103ca58d252b39c916649dd
SHA512728db69916b16b6e14263a24fcea14b196d4583c0a31cf7cf970ff5fe3dbbda8aa4c75d96038af416b567e384db55c1d390ccedc3f3c881630d0d0613da2b14c
-
Filesize
5KB
MD520c0807b8cd18e71448a45e3a381193b
SHA11cb67d5940162f2df65f9a883e75152968fa68f1
SHA25662531b6ef0db8378cf9339a9ce1df786903ada5a95418490de2b875d486971dd
SHA51231b7e9b22c002eca1e8d89c00f70859970974a3a8daf9ba45d7088a13a71e2a31de9ec79533eeaf5652b9d60b99f79d38cb298aa1dc3e8af0ce29c0a74003cf9