Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
05/02/2024, 16:24
Behavioral task
behavioral1
Sample
92754fb2a8dd8da8a29b0f5d5b7818aa.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
92754fb2a8dd8da8a29b0f5d5b7818aa.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 92754fb2a8dd8da8a29b0f5d5b7818aa.exe
- Size 19KB
- Sample240205-twfhzadhfl
- SHA256 2800f16d65f5983a4028f12008b3c0b7951d6e925f19a41cab9e004b63b309ed
- MD5 92754fb2a8dd8da8a29b0f5d5b7818aa
- SHA1 09b54a5df276af36e4fce721e60365fb664133f6
- SHA512 15a8065352d5060ecdebdb1f303c1d6a7319f1d2cf7771ff2b4f2387e3845e36568c9a32456e81fc5381c70e19b1282f39e370a519b51f3f8242589524019edc
- SSDEEP 384:vqpcbJXjpPvGYfmiOhhdoIRmLyOXK+qVumvKDDI:CW5jx+Y+HjdoI0TK+q8m2D
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\92754fb2a8dd8da8a29b0f5d5b7818aa.exe" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe - ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0007000000023217-2.dat acprotect - Executes dropped EXE 1 IoCs
pid Process 2724 iebtmm.exe - Loads dropped DLL 1 IoCs
pid Process 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe -
resource yara_rule behavioral2/memory/872-0-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/files/0x0007000000023217-2.dat upx behavioral2/memory/872-5-0x0000000010000000-0x000000001000A000-memory.dmp upx behavioral2/files/0x0006000000023221-7.dat upx behavioral2/memory/2724-10-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/872-11-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/2724-12-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/872-15-0x0000000010000000-0x000000001000A000-memory.dmp upx - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}\ 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A49E097A-D6EF-4B2F-8B0F-1230E998587F} 92754fb2a8dd8da8a29b0f5d5b7818aa.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.iexplorergate.com/redirect.php" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.srchhere.com/index.php?b=1&t=0&q={searchTerms}" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\SearchScopes 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Search 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\Main 92754fb2a8dd8da8a29b0f5d5b7818aa.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A49E097A-D6EF-4B2F-8B0F-1230E998587F} 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}\xxx = "xxx" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}\InprocServer32 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iebt.dll" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A49E097A-D6EF-4B2F-8B0F-1230E998587F}\InprocServer32\ThreadingModel = "Apartment" 92754fb2a8dd8da8a29b0f5d5b7818aa.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 2724 iebtmm.exe 2724 iebtmm.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 872 wrote to memory of 2724 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 84 PID 872 wrote to memory of 2724 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 84 PID 872 wrote to memory of 2724 872 92754fb2a8dd8da8a29b0f5d5b7818aa.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\92754fb2a8dd8da8a29b0f5d5b7818aa.exe"C:\Users\Admin\AppData\Local\Temp\92754fb2a8dd8da8a29b0f5d5b7818aa.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\iebtmm.exeC:\Users\Admin\AppData\Local\Temp\iebtmm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\iebt.dll
- Size 8KB
- SHA256 443185cc9c97d79b5fc300b3fbb5932747681755f7c1ae8271f5342925b1b1a0
- MD5 fea1af5eb4c306d8e1c7978b390958a7
- SHA1 9471832be43894428e75fd5f2c1254d155428ac0
- SHA512 d5173497483b27e416fafcaa0aee21807479a415b9268de76ce3c9a5ca4a92cfde95d615173565e07ee6a6ab67e01a933aa81d6f7f784807d109804f56cf7d6b
- SSDEEP 96:Ba/fiU2j8/FcEKbMuZfl4Bz0dZmY5uLKA+gVRZ+M+a5DVbgwGeTiIsMXL4qv2dG6:BqXsQBDVz0oYIe2VRNDVkhIQU2nSq
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\iebtmm.exe
- Size 5KB
- SHA256 4b2473042a76cc92c19fa90d9e3b66d810161018f6386669d84954c6f3adb72f
- MD5 86389960aa89a52ae88ab01ffc35d397
- SHA1 ae480e43291a5e48d0185b2fc0ca591bdf26b38d
- SHA512 183d1fd3d6ac60f06f40aa7c9170d0f6039c71c0f3f179340d81a5ed0ad7194c9a36771e94336b7cdecacf55bd84c377abe620e9d0f112c591bf66661be904aa
- SSDEEP 96:43DvqqB+F1vg0JcoqrTz6jT8lSA0MCd0Wdps4xh723qWDwupN6FXYo:e+cr36j4Id0Wz29D36FH
- MD5 SHA1 SHA512 SSDEEP