Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 06:56
Behavioral task
behavioral1
Sample
7f2ee37e234b72267de44cb7f95b1c15.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f2ee37e234b72267de44cb7f95b1c15.exe
Resource
win10v2004-20231215-en
General
-
Target
7f2ee37e234b72267de44cb7f95b1c15.exe
-
Size
328KB
-
MD5
7f2ee37e234b72267de44cb7f95b1c15
-
SHA1
f3533d190397aebb968ca4ee94ec19d069c56b86
-
SHA256
d55ef0e0279ff0010b7e1abf5be4b5c6a14cb012c51b21ff0e15a9cf711b86a9
-
SHA512
00e0de7bbfda0181ce0e5a4937b25120cf9d80621c2152d656c5535d0683cc307c2dfd5f4fad6419e753adf66c63f63c4f6295c12ebc432e95f36264c914e333
-
SSDEEP
6144:AwpCX7AcqU3QABZiLLriVp3zLI+svyzcqODzkyUr4IxR4SBDoSEV:3C81pA8WVxzLDuyzfKm4IboSEV
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
7f2ee37e234b72267de44cb7f95b1c15.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Users\\Admin\\AppData\\Roaming\\InetAccelerator\\InetAccelerator.exe,Explorer.exe," 7f2ee37e234b72267de44cb7f95b1c15.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\ProgramData\\InetAccelerator\\InetAccelerator.exe,userinit.exe," 7f2ee37e234b72267de44cb7f95b1c15.exe -
Processes:
resource yara_rule behavioral1/memory/2940-0-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral1/memory/2940-2-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral1/memory/2940-4-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral1/memory/2940-5-0x0000000000400000-0x000000000049F000-memory.dmp upx C:\Users\Admin\AppData\Roaming\InetAccelerator\InetAccelerator.exe upx behavioral1/memory/2940-85-0x0000000000400000-0x000000000049F000-memory.dmp upx behavioral1/memory/2940-128-0x0000000000400000-0x000000000049F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7f2ee37e234b72267de44cb7f95b1c15.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\InetAccelerator. = "C:\\ProgramData\\InetAccelerator\\InetAccelerator.exe" 7f2ee37e234b72267de44cb7f95b1c15.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\InetAccelerator = "C:\\Users\\Admin\\AppData\\Roaming\\InetAccelerator\\InetAccelerator.exe" 7f2ee37e234b72267de44cb7f95b1c15.exe -
Drops file in System32 directory 2 IoCs
Processes:
7f2ee37e234b72267de44cb7f95b1c15.exedescription ioc process File created C:\Windows\System32\InetAccelerator.exe 7f2ee37e234b72267de44cb7f95b1c15.exe File opened for modification C:\Windows\System32\InetAccelerator.exe 7f2ee37e234b72267de44cb7f95b1c15.exe -
Drops file in Windows directory 1 IoCs
Processes:
7f2ee37e234b72267de44cb7f95b1c15.exedescription ioc process File opened for modification C:\Windows\win.ini 7f2ee37e234b72267de44cb7f95b1c15.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
7f2ee37e234b72267de44cb7f95b1c15.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main 7f2ee37e234b72267de44cb7f95b1c15.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7f2ee37e234b72267de44cb7f95b1c15.exepid process 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
7f2ee37e234b72267de44cb7f95b1c15.exepid process 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe 2940 7f2ee37e234b72267de44cb7f95b1c15.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f2ee37e234b72267de44cb7f95b1c15.exe"C:\Users\Admin\AppData\Local\Temp\7f2ee37e234b72267de44cb7f95b1c15.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\InetAccelerator\InetAccelerator.exeFilesize
328KB
MD57f2ee37e234b72267de44cb7f95b1c15
SHA1f3533d190397aebb968ca4ee94ec19d069c56b86
SHA256d55ef0e0279ff0010b7e1abf5be4b5c6a14cb012c51b21ff0e15a9cf711b86a9
SHA51200e0de7bbfda0181ce0e5a4937b25120cf9d80621c2152d656c5535d0683cc307c2dfd5f4fad6419e753adf66c63f63c4f6295c12ebc432e95f36264c914e333
-
memory/2940-0-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2940-1-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/2940-2-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2940-4-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2940-5-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2940-85-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB
-
memory/2940-128-0x0000000000400000-0x000000000049F000-memory.dmpFilesize
636KB