Overview
overview
7Static
static
397a77c8e8d...60.exe
windows7-x64
797a77c8e8d...60.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
1$PLUGINSDI...sh.dll
windows10-2004-x64
1$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$TEMP/~nsi...ad.dll
windows7-x64
1$TEMP/~nsi...ad.dll
windows10-2004-x64
1$WINDIR/Sy...vc.exe
windows7-x64
1$WINDIR/Sy...vc.exe
windows10-2004-x64
1mineeo.dll
windows7-x64
6mineeo.dll
windows10-2004-x64
6mineeo.dll
windows7-x64
6mineeo.dll
windows10-2004-x64
6mineeonad.dll
windows7-x64
1mineeonad.dll
windows10-2004-x64
1mineeonad.dll
windows7-x64
1mineeonad.dll
windows10-2004-x64
1mineeosvc.exe
windows7-x64
1mineeosvc.exe
windows10-2004-x64
1mineeosvc.exe
windows7-x64
1mineeosvc.exe
windows10-2004-x64
1minerun.exe
windows7-x64
6minerun.exe
windows10-2004-x64
6minerun.exe
windows7-x64
6minerun.exe
windows10-2004-x64
6Analysis
- max time kernel
140s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
14/02/2024, 02:10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
97a77c8e8daa0ad6717a99f95acfb160.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
97a77c8e8daa0ad6717a99f95acfb160.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$TEMP/~nsis/c3a007/mineeonad.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
$TEMP/~nsis/c3a007/mineeonad.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
$WINDIR/System32/midiasvc.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
$WINDIR/System32/midiasvc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
mineeo.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
mineeo.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
mineeo.dll
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
mineeo.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
mineeonad.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
mineeonad.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
mineeonad.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
mineeonad.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
mineeosvc.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
mineeosvc.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
mineeosvc.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
mineeosvc.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
minerun.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
minerun.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
minerun.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
General
- Target 97a77c8e8daa0ad6717a99f95acfb160.exe
- Size 449KB
- Sample240214-clyhcsfe95
- SHA256 736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa
- MD5 97a77c8e8daa0ad6717a99f95acfb160
- SHA1 ca5f8b285cfd56d4b43e06f187a75b867f1caa33
- SHA512 efcd57f74697b46c8c55686ef09e866e97eab748b47b6454d305fb547f27fa315f0d535e8f326df33f4eb15a9bdd35893ee4c6701cec1507fdb903e295070383
- SSDEEP 12288:qC1x/d6lwKsVqBwDFS7HKAXKZwACaewbt:XFd6Kn5Jt0eJrdt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
pid Process 3996 midiasvc.exe 2428 midiasvc.exe 4744 midiasvc.exe 4944 mineeosvc.ex_ 1700 mineeosvc.ex_ 1996 mineeosvc.exe 3532 mineeosvc.exe 4320 mineeosvc.exe - Loads dropped DLL 9 IoCs
pid Process 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\ = "MineFilterc3a007APIClass Helper" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11F0542B-643D-40b3-B447-DEFEE8A12ABC} 97a77c8e8daa0ad6717a99f95acfb160.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\midiasvc.exe 97a77c8e8daa0ad6717a99f95acfb160.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\MineFilter\Log\minefilter_up_20240214.txt mineeosvc.ex_ File created C:\Program Files (x86)\MineFilter\mineeonad.dll 97a77c8e8daa0ad6717a99f95acfb160.exe File created C:\Program Files (x86)\MineFilter\minerun.exe 97a77c8e8daa0ad6717a99f95acfb160.exe File opened for modification C:\Program Files (x86)\MineFilter\Log\minefilter_up_20240214.txt mineeosvc.exe File created C:\Program Files (x86)\MineFilter\uninst.exe 97a77c8e8daa0ad6717a99f95acfb160.exe File created C:\Program Files (x86)\MineFilter\mine_uins.dat 97a77c8e8daa0ad6717a99f95acfb160.exe File created C:\Program Files (x86)\MineFilter\mineeosvc.ex_ 97a77c8e8daa0ad6717a99f95acfb160.exe File created C:\Program Files (x86)\MineFilter\minerun.ex_ 97a77c8e8daa0ad6717a99f95acfb160.exe File created C:\Program Files (x86)\MineFilter\mineeo.dll 97a77c8e8daa0ad6717a99f95acfb160.exe File created C:\Program Files (x86)\MineFilter\mineeosvc.exe 97a77c8e8daa0ad6717a99f95acfb160.exe File created C:\Program Files (x86)\MineFilter\mineeo.dl_ 97a77c8e8daa0ad6717a99f95acfb160.exe File created C:\Program Files (x86)\MineFilter\mineeonad.dl_ 97a77c8e8daa0ad6717a99f95acfb160.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 97a77c8e8daa0ad6717a99f95acfb160.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" mineeosvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mineeosvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" mineeosvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" mineeosvc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" mineeosvc.exe - Modifies registry class 48 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass.1\CLSID\ = "{11F0542B-643D-40b3-B447-DEFEE8A12ABC}" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\0 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\CLSID\ = "{11F0542B-643D-40b3-B447-DEFEE8A12ABC}" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\ProgID\ = "MineFilterc3a007BHO.MineFilterc3a007APIClass.1" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\VersionIndependentProgID\ = "MineFilterc3a007BHO.MineFilterc3a007APIClass" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\InprocServer32\ThreadingModel = "Apartment" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\TypeLib\ = "{01F0542B-643D-40b3-B447-DEFEE8A12ABC}" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\FLAGS 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\0\win32 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ = "IMineFilterc3a007API" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass.1 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass.1\CLSID 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\Programmable 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC} 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib\Version = "1.0" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ProxyStubClsid32 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\WOW6432Node\CLSID\tst_key = "test_ok" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\ = "MineFilterc3a007APIClass Class" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\VersionIndependentProgID 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\InprocServer32 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\ = "MineFilterc3a007APIClass 1.0 Type Library" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ProxyStubClsid32 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass.1\ = "MineFilterc3a007APIClass Class" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\CurVer\ = "MineFilterc3a007BHO.MineFilterc3a007APIClass.1" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\TypeLib 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\MineFilter\\" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib\ = "{01F0542B-643D-40B3-B447-DEFEE8A12ABC}" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib\Version = "1.0" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC} 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\CurVer 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC} 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\ = "MineFilter" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\ProgID 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\HELPDIR 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\ = "IMineFilterc3a007API" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F1F0542B-643D-40B3-B447-DEFEE8A12ABC}\TypeLib\ = "{01F0542B-643D-40B3-B447-DEFEE8A12ABC}" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MineFilterc3a007BHO.MineFilterc3a007APIClass\CLSID 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11F0542B-643D-40b3-B447-DEFEE8A12ABC}\InprocServer32\ = "C:\\Program Files (x86)\\MineFilter\\mineeo.dll" 97a77c8e8daa0ad6717a99f95acfb160.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC} 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\FLAGS\ = "0" 97a77c8e8daa0ad6717a99f95acfb160.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{01F0542B-643D-40B3-B447-DEFEE8A12ABC}\1.0\0\win32\ = "C:\\Program Files (x86)\\MineFilter\\mineeo.dll" 97a77c8e8daa0ad6717a99f95acfb160.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 4200 97a77c8e8daa0ad6717a99f95acfb160.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4200 wrote to memory of 3996 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 86 PID 4200 wrote to memory of 3996 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 86 PID 4200 wrote to memory of 3996 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 86 PID 4200 wrote to memory of 2428 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 87 PID 4200 wrote to memory of 2428 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 87 PID 4200 wrote to memory of 2428 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 87 PID 4200 wrote to memory of 4944 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 89 PID 4200 wrote to memory of 4944 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 89 PID 4200 wrote to memory of 4944 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 89 PID 4200 wrote to memory of 1700 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 90 PID 4200 wrote to memory of 1700 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 90 PID 4200 wrote to memory of 1700 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 90 PID 4200 wrote to memory of 1996 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 91 PID 4200 wrote to memory of 1996 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 91 PID 4200 wrote to memory of 1996 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 91 PID 4200 wrote to memory of 3532 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 92 PID 4200 wrote to memory of 3532 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 92 PID 4200 wrote to memory of 3532 4200 97a77c8e8daa0ad6717a99f95acfb160.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\97a77c8e8daa0ad6717a99f95acfb160.exe"C:\Users\Admin\AppData\Local\Temp\97a77c8e8daa0ad6717a99f95acfb160.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\midiasvc.exe"C:\Windows\System32\midiasvc.exe" /i2⤵
- Executes dropped EXE
PID:3996
-
-
C:\Windows\SysWOW64\midiasvc.exe"C:\Windows\System32\midiasvc.exe" /start2⤵
- Executes dropped EXE
PID:2428
-
-
C:\Program Files (x86)\MineFilter\mineeosvc.ex_"C:\Program Files (x86)\MineFilter\mineeosvc.ex_" /stop2⤵
- Executes dropped EXE
PID:4944
-
-
C:\Program Files (x86)\MineFilter\mineeosvc.ex_"C:\Program Files (x86)\MineFilter\mineeosvc.ex_" /u2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1700
-
-
C:\Program Files (x86)\MineFilter\mineeosvc.exe"C:\Program Files (x86)\MineFilter\mineeosvc.exe" /i2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1996
-
-
C:\Program Files (x86)\MineFilter\mineeosvc.exe"C:\Program Files (x86)\MineFilter\mineeosvc.exe" /start2⤵
- Executes dropped EXE
PID:3532
-
-
C:\Windows\SysWOW64\midiasvc.exeC:\Windows\SysWOW64\midiasvc.exe1⤵
- Executes dropped EXE
PID:4744
-
C:\Program Files (x86)\MineFilter\mineeosvc.exe"C:\Program Files (x86)\MineFilter\mineeosvc.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\MineFilter\Log\minefilter_up_20240214.txt
- Size 231B
- SHA256 377206681309daf1fed53346f7ddc09734ef67b5ca8afcf05d78ee1c7000adc8
- MD5 a7d829b57b564cfe1031e324e6766f5a
- SHA1 415c07caa9166b00de95f1c765116b7aae186cbe
- SHA512 8ace99c872127ac5cbe2f0929e8b26dc7609cda8d0cebf75038345f2871ea260d745dc2cff740fdfb01d44ea0ad356101bd8fd0e6cbf64dbcbbc6e3e29b7b5d3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\MineFilter\mineeo.dll
- Size 121KB
- SHA256 b9eacbc9112e1b97017b7e1b5213f1bc20b56bfbfdcd6898315b76bd56d72834
- MD5 c7cff0342d39a8b13fa47c7c8d5f5cbf
- SHA1 6b86fb16a10be1c8b5ae6111407cd3085a0c5660
- SHA512 9a80098bda278ccae5ca9958e6a8c2bfd5f27995f66b7b8b2a06212c9942cebb5363f97f4ac8cbc90ba246586d39e8679c918ddc953e990e0a7dc284f81d5e34
- SSDEEP 3072:c20bUZLSzWRtfU3tOA3wO4aeqtBG+EctaS:c9AAz45UsAbeN+NaS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\MineFilter\mineeosvc.ex_
- Size 105KB
- SHA256 a7be80960f400b55533195f07c40e413e51542b4c0dade35d5a72988a36ab1d8
- MD5 2b69deccb1730858b225c58f6437d64a
- SHA1 ae92bd082409911dc21de122ec7bcefe22d4aaa9
- SHA512 e61875b104982b8780c1e556f792328fae48aacdbf12e6fcb352c371efa2695106084f7ac30c339fcf53dedec513f59f0d96fc2be4c2b19aa0cbba9c700703a0
- SSDEEP 1536:3iZb/FwJ3etrGhmxkMS29jENmMISOLKV35PawzZXhGJHM1tkloqkcn:ubDtrGhm2MxjUhtOoJP7zZXhGJs1tDcn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\MineFilter\minerun.exe
- Size 129KB
- SHA256 bfac7a61df4335acfe677ca09fb1996bef63530a3867a81bfb2fceed5a123dc5
- MD5 596199aebea31fbddb0044fdfb2e75ec
- SHA1 00f1136ecfe4b5c7d8045f65e4ff4fd11959fd54
- SHA512 52efc0b8a6890d93db74b1d3e77b0d21c1fe9c7e1300c440f49a3971b6914cd02722c9150559f882054f8c8e56e34627cef88852d626e9810bda22a96a8a3e7a
- SSDEEP 1536:RYW/2vJd49J2uSF0/cyqcMYdLY3wy2vgcUZ:eW7B/cyqcMYorco
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvA00A.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvA00A.tmp\newadvsplash.dll
- Size 8KB
- SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
- MD5 7ee14dff57fb6e6c644b318d16768f4c
- SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
- SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
- SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvA00A.tmp\nsProcess.dll
- Size 4KB
- SHA256 b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
- MD5 8f4ac52cb2f7143f29f114add12452ad
- SHA1 29dc25f5d69bf129d608b83821c8ec8ab8c8edb3
- SHA512 2f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
- SSDEEP 48:6sG7qYBUYBFxhRwYCI0owYlOdkPm4LYZ5sRXEv26vqAa4GEVu:HhYBUYBL0Toa7+Q5sKG4GEV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\nsvA00A.tmp\splash.jpg
- Size 631B
- SHA256 25cf0f0ce42f8acd9ea6facc223f54105c7fd0cce63fb7bb5d83e6600100acbd
- MD5 d68e763c825dc0e388929ae1b375ce18
- SHA1 7951a43bbfb08fd742224ada280913d1897b89ab
- SHA512 1e146e2631a4f3bd091905ccc10ed1054700349648cd52aad24eaeeedff0fac4b44b6212284a6d0855942ff16308c66402ecb895e68ef1c66dcd496973043cdb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\~nsis\c3a007\mineeonad.dll
- Size 577KB
- SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
- MD5 ec10d3888f7907ee3dffc5f883d84196
- SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
- SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
- SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\midiasvc.exe
- Size 85KB
- SHA256 7e864083928b1574a3cdad0827653fb91eaf96acb0b32445ed4725c8ee3d7059
- MD5 e47777c0038db4950a72da594518b328
- SHA1 7f858c3161d020d0c500fbb29a0f2d38cb93d44c
- SHA512 4d6d02415afff4a2ceb229e3181dcd3fc7df89a99a3b6c7c0addb9f5265c03c1b3f0231f3b6d1c29c7e529ddfee83ab8e6f6a3e3e7eef838de5c42fbed60988a
- SSDEEP 1536:TkriKIIIgLMYHoAtSXG4FkgrExEJHmLtzZnLr4:TkWKBIAHoOaFkjEJGLthLc
- MD5 SHA1 SHA512 SSDEEP