Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 20:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90186660223b10689995f99b9ec1b245.exe
Resource
win7-20231215-en
7 signatures
150 seconds
General
-
Target
90186660223b10689995f99b9ec1b245.exe
-
Size
100KB
-
MD5
90186660223b10689995f99b9ec1b245
-
SHA1
6efc5071a3f131023ece90cab2d4d24de691a35e
-
SHA256
d3a0e46dd708e300cc134bc5081fabb7f7af1f162a17212eaa9428afa85b6373
-
SHA512
7ceb52f8dccd7d6819e6db946d87662de3f3634e3a2f0f418294fe91594962f23ed708ed648436483730ae8b0c67f899b73538cdcc602b30acf7f14121f9446c
-
SSDEEP
3072:T62a/VuaJaEpBD/E56dAGo+f+R004W6/W9PR7GOiBfn4ilf:Tz5eHfi0pWtlI4ef
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2748 cmd.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 90186660223b10689995f99b9ec1b245.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0} 90186660223b10689995f99b9ec1b245.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\duis.txt 90186660223b10689995f99b9ec1b245.exe File created C:\Windows\SysWOW64\msindc.dll 90186660223b10689995f99b9ec1b245.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 90186660223b10689995f99b9ec1b245.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0} 90186660223b10689995f99b9ec1b245.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0}\ = "Min stor proj." 90186660223b10689995f99b9ec1b245.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0}\InprocServer32 90186660223b10689995f99b9ec1b245.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0}\InprocServer32\ThreadingModel = "Apartment" 90186660223b10689995f99b9ec1b245.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0}\InprocServer32\ = "msindc.dll" 90186660223b10689995f99b9ec1b245.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0}\ProgID 90186660223b10689995f99b9ec1b245.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0}\ProgID\ = "RITLAB.1" 90186660223b10689995f99b9ec1b245.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0}\TypeLib 90186660223b10689995f99b9ec1b245.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFFFFFF-D71D-41e4-A699-F506DBD097F0}\TypeLib\ = "{58886F37-3533-445c-9D8F-9AF55A6DE1C5}" 90186660223b10689995f99b9ec1b245.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2748 1888 90186660223b10689995f99b9ec1b245.exe 28 PID 1888 wrote to memory of 2748 1888 90186660223b10689995f99b9ec1b245.exe 28 PID 1888 wrote to memory of 2748 1888 90186660223b10689995f99b9ec1b245.exe 28 PID 1888 wrote to memory of 2748 1888 90186660223b10689995f99b9ec1b245.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\90186660223b10689995f99b9ec1b245.exe"C:\Users\Admin\AppData\Local\Temp\90186660223b10689995f99b9ec1b245.exe"1⤵
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\901866~1.EXE >> NUL2⤵
- Deletes itself
PID:2748
-