Analysis

  • max time kernel
    143s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 22:55

General

  • Target

    VirusShare-00c7e24b52d0f69c114772ed0a27f912.exe

  • Size

    334KB

  • MD5

    00c7e24b52d0f69c114772ed0a27f912

  • SHA1

    25e09824323c31d4fb278acb57a35e65c753ec64

  • SHA256

    0577ada4871e64c61659a7d5a3d84074a40cfcef27a61eec48e5d19f78d3b127

  • SHA512

    93485e74dd1c17f1a0dbede36d76825a0b74683dc5f50e13f6d4fe078eaf9de7071d7ff20ba710d4a9920278aab8e906bfe954060643a24e70a2a0bda8b71946

  • SSDEEP

    6144:0e3446lL8yVZolmUyMGYXFrlSdjsFodY+qTOO8g/Xb/PmQKa3dAtnJls:D6p35FMsOozqT7/L3FKa3dAtJu

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 8 IoCs
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 6 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Maps connected drives based on registry 3 TTPs 6 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Modifies registry class 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare-00c7e24b52d0f69c114772ed0a27f912.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare-00c7e24b52d0f69c114772ed0a27f912.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Installs/modifies Browser Helper Object
    • Maps connected drives based on registry
    • Drops file in System32 directory
    • Modifies Internet Explorer Protected Mode
    • Modifies Internet Explorer Protected Mode Banner
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\xavuhwncke.dll"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Installs/modifies Browser Helper Object
      • Maps connected drives based on registry
      • Modifies registry class
      PID:2348
  • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
    "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
    1⤵
      PID:940
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:17410 /prefetch:2
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1084

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            471B

            MD5

            cb99b6d5040641081530ef8f6049f1aa

            SHA1

            3fa9e3148cbee0e561da3787919043483ee5e5c0

            SHA256

            3e1607026f332ae19539f0621c8b18c820245d196febf8bf258253667ebc94d8

            SHA512

            13cdc5995fa4741d474c00491ea55b26101a88ee3495327950249e8bef1e16de29f46d0c1ffef3682eac0e041f0b06545d51ef8152a33606f0e13fe35e6a1d83

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

            Filesize

            404B

            MD5

            9c54f170946dd2b3c68dc95037aa9807

            SHA1

            6bec595daa95ce9417143d7a2a78f663a1af5350

            SHA256

            86c50d6f5c9904609386d8c7efd9023de8e62d66b4fed7f8918722d0b6cdf30b

            SHA512

            3d21d7b6f04998f0b2cda0949b2958d0543b504d35f5bdc5461aededce6d4c6e7df3a0d6cbcabac5855da1dda11079c90f96dd1f167db1a2fe5758c5778f3b38

          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC63E.tmp

            Filesize

            15KB

            MD5

            1a545d0052b581fbb2ab4c52133846bc

            SHA1

            62f3266a9b9925cd6d98658b92adec673cbe3dd3

            SHA256

            557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

            SHA512

            bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q15AV1NQ\suggestions[1].en-US

            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

          • C:\Users\Admin\AppData\Local\Temp\nsd4E03.tmp.dll

            Filesize

            282KB

            MD5

            3f2d4a9f33af3e0d07158391f141fbac

            SHA1

            49cafcca1de589fcf2906abf4d39769f36cd6e30

            SHA256

            4af4544a7186f81c4a0b6a77eb25540824ab261bd75db18874003498a04edaa8

            SHA512

            597896131750dd276d4d2c5ec84dffdad0d5c65507a18fd616ce841bb8ee3ec7ffcf27698b4f419a89d1805b796c675698945186202958edb977aadaf20a0650

          • C:\Users\Admin\AppData\Local\Temp\nsz4612.tmp\System.dll

            Filesize

            11KB

            MD5

            c17103ae9072a06da581dec998343fc1

            SHA1

            b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

            SHA256

            dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

            SHA512

            d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

          • memory/1620-22-0x00000000028A0000-0x0000000002960000-memory.dmp

            Filesize

            768KB

          • memory/1620-26-0x00000000406E0000-0x00000000407A0000-memory.dmp

            Filesize

            768KB

          • memory/1620-23-0x00000000028A0000-0x0000000002960000-memory.dmp

            Filesize

            768KB

          • memory/1620-14-0x00000000406E0000-0x00000000407A0000-memory.dmp

            Filesize

            768KB

          • memory/2348-30-0x00000000406E0000-0x00000000407A0000-memory.dmp

            Filesize

            768KB

          • memory/2348-29-0x00000000406E0000-0x00000000407A0000-memory.dmp

            Filesize

            768KB

          • memory/2348-46-0x00000000406E0000-0x00000000407A0000-memory.dmp

            Filesize

            768KB

          • memory/2348-65-0x00000000406E0000-0x00000000407A0000-memory.dmp

            Filesize

            768KB

          • memory/2348-66-0x00000000406E0000-0x00000000407A0000-memory.dmp

            Filesize

            768KB