Analysis
- max time kernel
141s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
05/02/2024, 09:38
Behavioral task
behavioral1
Sample
91a7402179b970c0e1f7804f2f19d8fe.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
91a7402179b970c0e1f7804f2f19d8fe.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 91a7402179b970c0e1f7804f2f19d8fe.exe
- Size 20KB
- Sample240205-ll6cmsehen
- SHA256 d636832aabad1f273a02bcaf4f5776347958760f23154f10c85088e4269d5d32
- MD5 91a7402179b970c0e1f7804f2f19d8fe
- SHA1 87fd46c4061d2818ee4c0e32d2be6903d72d624f
- SHA512 e56aa331d8c32d7fec3fbfd407a47781639564fbe3afe7dd86e21392022071aecf9c6c3d9f27b623016c3fbf7994b0038db81f248b502c8ccc55ce949abdf45a
- SSDEEP 384:oOuL1Eqs/IVpCTYsAtHpUyhJEZ99JiMHzBddM6fty0lK2QW5:osDIYYbHNWfJiMgUK2QW
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\proper.exe" 91a7402179b970c0e1f7804f2f19d8fe.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 91a7402179b970c0e1f7804f2f19d8fe.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\infos.exe 91a7402179b970c0e1f7804f2f19d8fe.exe -
resource yara_rule behavioral2/memory/3048-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3048-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000700000002321b-373.dat upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Undefined = "C:\\Windows\\system32\\winter.exe" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Undefined = "C:\\Windows\\system32\\winter.exe" 91a7402179b970c0e1f7804f2f19d8fe.exe - Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D27987B8-7244-4DE0-AE10-39B826B492F1} 91a7402179b970c0e1f7804f2f19d8fe.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\winter.exe 91a7402179b970c0e1f7804f2f19d8fe.exe File opened for modification C:\Windows\SysWOW64\winter.exe 91a7402179b970c0e1f7804f2f19d8fe.exe File created C:\Windows\SysWOW64\proper.exe 91a7402179b970c0e1f7804f2f19d8fe.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" 91a7402179b970c0e1f7804f2f19d8fe.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.google.com/ie" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.google.com" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://www.google.com/ie" 91a7402179b970c0e1f7804f2f19d8fe.exe - Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.google.com" 91a7402179b970c0e1f7804f2f19d8fe.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D27987B8-7244-4DE0-AE10-39B826B492F1} 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.htm\ = "htmlfile" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xhtml\ = "htmlfile" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}\InprocServer32\Enable Browser Extensions = "yes" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\http\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000_Classes\.html\ = "htmlfile" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}\InprocServer32\ThreadingModel = "apartment" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\https\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" %1" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xht\ = "htmlfile" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}\InprocServer32\ThreadingModel = "Apartment" 91a7402179b970c0e1f7804f2f19d8fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1} 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}\InprocServer32\ = "C:\\Windows\\SysWow64\\bronto.dll" 91a7402179b970c0e1f7804f2f19d8fe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D27987B8-7244-4DE0-AE10-39B826B492F1}\InprocServer32 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.shtml\ = "htmlfile" 91a7402179b970c0e1f7804f2f19d8fe.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 91a7402179b970c0e1f7804f2f19d8fe.exe - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" 91a7402179b970c0e1f7804f2f19d8fe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" 91a7402179b970c0e1f7804f2f19d8fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91a7402179b970c0e1f7804f2f19d8fe.exe"C:\Users\Admin\AppData\Local\Temp\91a7402179b970c0e1f7804f2f19d8fe.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Drops startup file
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- System policy modification
PID:3048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nArk\dplaysvr.exe
- Size 8KB
- SHA256 f0f847a5079f94adfd5b224c05ddd4a5651c757b920b6c26e629993c7dd36951
- MD5 faeda9b43e022acd3b8462b222eedc72
- SHA1 9d81571936c9270600e54f7bca210026f6ecd830
- SHA512 5a351f6a59f148e7091b8effa5d5e59102ab4fc4bfc1374e19a8ade57fc68bce4467f5b9be34f9a4aaf2df85721efbccde064803469feba2b06ea789681b0d4e
- SSDEEP 96:ixLCTNklk4a+4a9Tcqn2jshq8PjAzIsEWRuWw1QR:ixmT4kJ+4Yu0PrAzKWRuW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\proper.exe
- Size 20KB
- SHA256 d636832aabad1f273a02bcaf4f5776347958760f23154f10c85088e4269d5d32
- MD5 91a7402179b970c0e1f7804f2f19d8fe
- SHA1 87fd46c4061d2818ee4c0e32d2be6903d72d624f
- SHA512 e56aa331d8c32d7fec3fbfd407a47781639564fbe3afe7dd86e21392022071aecf9c6c3d9f27b623016c3fbf7994b0038db81f248b502c8ccc55ce949abdf45a
- SSDEEP 384:oOuL1Eqs/IVpCTYsAtHpUyhJEZ99JiMHzBddM6fty0lK2QW5:osDIYYbHNWfJiMgUK2QW
- MD5 SHA1 SHA512 SSDEEP