Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
8f9cc18d3743f189e0702d941c4423da.exe
Resource
win7-20231215-en
General
-
Target
8f9cc18d3743f189e0702d941c4423da.exe
-
Size
866KB
-
MD5
8f9cc18d3743f189e0702d941c4423da
-
SHA1
249578de07ac2ec3ffc2ffd400e0a4f72afff0bc
-
SHA256
3efc4518a663cc15ee2022ec284fbcf7ce41a562ce45c2380e6c1cf9822edaab
-
SHA512
ba04fb24288772d2ff625555674d62a4723389fc892aa5c1e01553aabcdc18c1342aa0c9dccb4d4cf58963359550749c26b6472eeeee2efda33c8271909c053d
-
SSDEEP
24576:38GwXmL0hk0v0XW/xVfCyHH1VQJxhGjS0:38Jhkw/xVfCy1iJeO0
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 8f9cc18d3743f189e0702d941c4423da.exe -
Executes dropped EXE 2 IoCs
pid Process 4756 setup2.exe 5104 setup1.exe -
Loads dropped DLL 1 IoCs
pid Process 4756 setup2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5E2402A0-5F99-4188-B30D-D8743996B340}\ = "LuckyTender" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5E2402A0-5F99-4188-B30D-D8743996B340} setup2.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\LuckyTender\1.3.0\LuckyTender.dll setup2.exe File created C:\Program Files (x86)\LuckyTender\uninst.exe setup2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x0006000000023212-6.dat nsis_installer_1 -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832} setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832} setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32 setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32 setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\NumMethods\ = "7" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\0 setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70} setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\InProcServer32\ = "C:\\Program Files (x86)\\LuckyTender\\1.3.0\\LuckyTender.dll" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ProxyStubClsid32 setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2} setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\NumMethods setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\NumMethods\ = "11" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\HELPDIR setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ = "ISliderShowCtrl" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ = "ISliderWindowAx" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\InProcServer32 setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl\CurVer\ = "SliderShow.SliderShowCtrl.1" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32\ = "{3794345D-C731-4FBB-8471-73DDC8DFFDD2}" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0 setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\VersionIndependentProgID setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ = "ISliderShowCtrl" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib\Version = "1.0" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib\Version = "1.0" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\ = "SliderShowCtrl Class" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\NumMethods setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\LuckyTender\\1.3.0\\" setup2.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\WOW6432Node\Interface setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\ = "SliderShow 1.0 Type Library" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl.1\CLSID setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl\ = "SliderShowCtrl Class" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl\CLSID\ = "{5E2402A0-5F99-4188-B30D-D8743996B340}" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl\CurVer setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\ProxyStubClsid32\ = "{3794345D-C731-4FBB-8471-73DDC8DFFDD2}" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7656BFE4-2AAE-4E04-98B6-5912E99FBE38} setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl.1\CLSID\ = "{5E2402A0-5F99-4188-B30D-D8743996B340}" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\TypeLib setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ = "ISliderWindowAx" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl.1 setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SliderShow.SliderShowCtrl.1\ = "SliderShowCtrl Class" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\FLAGS setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\FLAGS\ = "0" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\TypeLib setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ProxyStubClsid32 setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\ = "ISliderWindow" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7656BFE4-2AAE-4E04-98B6-5912E99FBE38}\ = "SliderShow" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\ProgID\ = "SliderShow.SliderShowCtrl.1" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\0\win32 setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70} setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\ = "PSFactoryBuffer" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3794345D-C731-4FBB-8471-73DDC8DFFDD2}\ProxyStubClsid32 setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SliderShow.DLL setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\VersionIndependentProgID\ = "SliderShow.SliderShowCtrl" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE85A67A-3F04-4ABA-A10B-A37B220AFB70}\TypeLib\ = "{96EDCF67-4637-4288-9A0D-4282EBF26D62}" setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340} setup2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E2402A0-5F99-4188-B30D-D8743996B340}\Programmable setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96EDCF67-4637-4288-9A0D-4282EBF26D62}\1.0\0\win32\ = "C:\\Program Files (x86)\\LuckyTender\\1.3.0\\LuckyTender.dll" setup2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{13E3FF74-B861-4E69-B223-43D711686832}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" setup2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2740 wrote to memory of 4756 2740 8f9cc18d3743f189e0702d941c4423da.exe 84 PID 2740 wrote to memory of 4756 2740 8f9cc18d3743f189e0702d941c4423da.exe 84 PID 2740 wrote to memory of 4756 2740 8f9cc18d3743f189e0702d941c4423da.exe 84 PID 2740 wrote to memory of 5104 2740 8f9cc18d3743f189e0702d941c4423da.exe 85 PID 2740 wrote to memory of 5104 2740 8f9cc18d3743f189e0702d941c4423da.exe 85 PID 2740 wrote to memory of 5104 2740 8f9cc18d3743f189e0702d941c4423da.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f9cc18d3743f189e0702d941c4423da.exe"C:\Users\Admin\AppData\Local\Temp\8f9cc18d3743f189e0702d941c4423da.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
PID:4756
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup1.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup1.exe"2⤵
- Executes dropped EXE
PID:5104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5fbbd36fc9f5de933753a1b855944e04a
SHA16aff38e2228f86233e103da286381da37feff0ce
SHA256ff68a2096413a90a3505610353307a88355e1f34d9417acdd4f2d4855db33b62
SHA5127bc90a7084cfeb60d6abe4c4d4ac641c9b65fd477c8d57c5b4fa0d84b9a797b6c4b207b5ac9fb503b42b12212dbefc9507eddf73ef984eb2d4a9cf6b064dbace
-
Filesize
1.7MB
MD56eb8b23d51279bb8585fc88731001d80
SHA1b993ba10af96d7db79ec4fd4771511d880255604
SHA256b58d68b9c4488c7a2137582ae26c7e743f8a8c1bbbef1f9f1cd9f8a03f03ccdd
SHA51274683daefdc3095fe298dcfe0b7596fd91526f4281974f14bf39c04f0e19343e3792b34c114d4c8bcc418b7b5d9cdc201eebe06538347337abcb1231af60ef0a
-
Filesize
148KB
MD55b4a528aff5726712c3c4714492fc71a
SHA1e60a68d8ffb33a81957199e7fa2720a5b74c6ae0
SHA256bd0bd14950691bbbd1a8c791b6cecc0136b7f361d3d3617f97ab8aec4bfaee8e
SHA51211cae2ad6dc83762c48d30703f0e404d7c708c2c19eb58d32ab557474271c816b08141ffd7588fc0b220728ed00d8e4c1a287becf9451bdcce3d201c098179b9