Analysis

  • max time kernel
    130s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 21:29

General

  • Target

    8a941b3741b3b84f032df3fa8df05f38.dll

  • Size

    473KB

  • MD5

    8a941b3741b3b84f032df3fa8df05f38

  • SHA1

    709f907993134a655d996978a9e800f4168de1c4

  • SHA256

    86478dde55423ea79373c7717db21ed3f16998b88d4c2f14c029b0e4f05e8a2a

  • SHA512

    8fa577f4217816fc86fdbff9a052473a8de43cccaedbb81ccd26b2b187908dcee6416f191a2671b9617b61e40a00f113b3377af5f82366967f4f0c6daf4ec592

  • SSDEEP

    12288:KEyS9OOCHzSCcVflpCLPnLTeeeAlj6o4A:k/HuCcZHCLLTq4f4A

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Modifies Internet Explorer settings 1 TTPs 45 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8a941b3741b3b84f032df3fa8df05f38.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\8a941b3741b3b84f032df3fa8df05f38.dll
      2⤵
      • Adds Run key to start application
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      PID:4528
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:3704
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4684
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4684 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3216

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            471B

            MD5

            cb99b6d5040641081530ef8f6049f1aa

            SHA1

            3fa9e3148cbee0e561da3787919043483ee5e5c0

            SHA256

            3e1607026f332ae19539f0621c8b18c820245d196febf8bf258253667ebc94d8

            SHA512

            13cdc5995fa4741d474c00491ea55b26101a88ee3495327950249e8bef1e16de29f46d0c1ffef3682eac0e041f0b06545d51ef8152a33606f0e13fe35e6a1d83

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            404B

            MD5

            552a65f15928a9b10754de336408c493

            SHA1

            10c43af1c72462c22e65e08c3bc6ef25039304aa

            SHA256

            0c305345a67f5005297bcff546fb7f67030568ef9b93d7ac5e4341b3366d7853

            SHA512

            fb9b90454c3952dcd4c0c342e2437b5a67ddbd8a7aece549331106a0dd2972849ae56368d3aacb6716fb4e8c640133c1de43f39290965d0de5aa1e27da200e50

          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verBAD4.tmp

            Filesize

            15KB

            MD5

            1a545d0052b581fbb2ab4c52133846bc

            SHA1

            62f3266a9b9925cd6d98658b92adec673cbe3dd3

            SHA256

            557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

            SHA512

            bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\httpErrorPagesScripts[1]

            Filesize

            11KB

            MD5

            9234071287e637f85d721463c488704c

            SHA1

            cca09b1e0fba38ba29d3972ed8dcecefdef8c152

            SHA256

            65cc039890c7ceb927ce40f6f199d74e49b8058c3f8a6e22e8f916ad90ea8649

            SHA512

            87d691987e7a2f69ad8605f35f94241ab7e68ad4f55ad384f1f0d40dc59ffd1432c758123661ee39443d624c881b01dcd228a67afb8700fe5e66fc794a6c0384

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1RIAF1U2\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SB302YPZ\errorPageStrings[1]

            Filesize

            4KB

            MD5

            d65ec06f21c379c87040b83cc1abac6b

            SHA1

            208d0a0bb775661758394be7e4afb18357e46c8b

            SHA256

            a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f

            SHA512

            8a166d26b49a5d95aea49bc649e5ea58786a2191f4d2adac6f5fbb7523940ce4482d6a2502aa870a931224f215cb2010a8c9b99a2c1820150e4d365cab28299e