Analysis
- max time kernel
93s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
14/02/2024, 06:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b0687b57c5411b378ef42b57ffa658c.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
General
- Target 9b0687b57c5411b378ef42b57ffa658c.exe
- Size 1.5MB
- Sample240214-hhcdlsch29
- SHA256 8497d5197b020f6058832b880f72f18d162fbaf780d06aa7a25c60c4ede00c26
- MD5 9b0687b57c5411b378ef42b57ffa658c
- SHA1 d336896cbce141ae6a7fca5fee2790168f7812b6
- SHA512 905c3b28bc84c819c5c6f78d90978cb3192f2dfc4dac9137c4985271ed0a06b366b004f1e084dc7a364f7849ff3c7f23c85e2a0e98c1729e21a34bcc64f22a79
- SSDEEP 24576:qSj97y1zE5f2Oz4rWX1sxkL2aF+5UQc8rTmpeDGVlAhzeFAT:qSES+viMd5vTweREAT
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List regedit.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile regedit.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications regedit.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\oobe\6438\svchost.exe = "C:\\Windows\\system32\\oobe\\6438\\svchost.exe:*:Enabled:svchost" regedit.exe - Loads dropped DLL 1 IoCs
pid Process 4604 Regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{03C12478-A0D3-4291-A535-F6D16BA08D68} Regsvr32.exe - Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\oobe\zsipadroni.dll 9b0687b57c5411b378ef42b57ffa658c.exe File created C:\Windows\SysWOW64\SZVCZLRASOX.reg 9b0687b57c5411b378ef42b57ffa658c.exe File created C:\Windows\SysWOW64\2e9f163b0d.dll 9b0687b57c5411b378ef42b57ffa658c.exe File opened for modification C:\Windows\SysWOW64\2e9f163b0d.dll 9b0687b57c5411b378ef42b57ffa658c.exe File created C:\Windows\SysWOW64\oobe\6438\svchost.exe 9b0687b57c5411b378ef42b57ffa658c.exe File created C:\Windows\SysWOW64\oobe\zsipadroni.dll 9b0687b57c5411b378ef42b57ffa658c.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe - Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C12478-A0D3-4291-A535-F6D16BA08D68} Regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C12478-A0D3-4291-A535-F6D16BA08D68}\ = "ExSwfTrc" Regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zsipadroni.XunBHoSwf Regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zsipadroni.XunBHoSwf\ = "ExSwfTrc" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\zsipadroni.XunBHoSwf\Clsid\ = "{03C12478-A0D3-4291-A535-F6D16BA08D68}" Regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 5a003100000000004e587b35100053797374656d33320000420009000400efbe874f77484e587b352e000000b90c00000000010000000000000000000000000000000d7f8c00530079007300740065006d0033003200000018000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4e003100000000004e587c3510003634333800003a0009000400efbe4e587c354e587c352e000000fd3102000000070000000000000000000000000000000a3a09013600340033003800000014000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C12478-A0D3-4291-A535-F6D16BA08D68}\InprocServer32 Regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C12478-A0D3-4291-A535-F6D16BA08D68}\InprocServer32\ = "C:\\Windows\\SysWow64\\oobe\\zsipadroni.dll" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C12478-A0D3-4291-A535-F6D16BA08D68}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\zsipadroni.XunBHoSwf\Clsid Regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 56003100000000008f57155c100057696e646f777300400009000400efbe874f77484e587c352e0000000006000000000100000000000000000000000000000020872501570069006e0064006f0077007300000016000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C12478-A0D3-4291-A535-F6D16BA08D68}\ProgID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03C12478-A0D3-4291-A535-F6D16BA08D68}\ProgID\ = "zsipadroni.XunBHoSwf" Regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 4e003100000000004e587c3510006f6f626500003a0009000400efbe874fdb494e587c352e000000ae1300000000010000000000000000000000000000000a3a09016f006f0062006500000014000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe - Runs .reg file with regedit 1 IoCs
pid Process 5072 regedit.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3152 9b0687b57c5411b378ef42b57ffa658c.exe 3152 9b0687b57c5411b378ef42b57ffa658c.exe 3152 9b0687b57c5411b378ef42b57ffa658c.exe 3152 9b0687b57c5411b378ef42b57ffa658c.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3152 9b0687b57c5411b378ef42b57ffa658c.exe Token: SeDebugPrivilege 3152 9b0687b57c5411b378ef42b57ffa658c.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3640 explorer.exe 3640 explorer.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3152 wrote to memory of 4288 3152 9b0687b57c5411b378ef42b57ffa658c.exe 85 PID 3152 wrote to memory of 4288 3152 9b0687b57c5411b378ef42b57ffa658c.exe 85 PID 3152 wrote to memory of 4288 3152 9b0687b57c5411b378ef42b57ffa658c.exe 85 PID 3152 wrote to memory of 4604 3152 9b0687b57c5411b378ef42b57ffa658c.exe 87 PID 3152 wrote to memory of 4604 3152 9b0687b57c5411b378ef42b57ffa658c.exe 87 PID 3152 wrote to memory of 4604 3152 9b0687b57c5411b378ef42b57ffa658c.exe 87 PID 3152 wrote to memory of 2700 3152 9b0687b57c5411b378ef42b57ffa658c.exe 88 PID 3152 wrote to memory of 2700 3152 9b0687b57c5411b378ef42b57ffa658c.exe 88 PID 3152 wrote to memory of 2700 3152 9b0687b57c5411b378ef42b57ffa658c.exe 88 PID 3152 wrote to memory of 5072 3152 9b0687b57c5411b378ef42b57ffa658c.exe 90 PID 3152 wrote to memory of 5072 3152 9b0687b57c5411b378ef42b57ffa658c.exe 90 PID 3152 wrote to memory of 5072 3152 9b0687b57c5411b378ef42b57ffa658c.exe 90 PID 3152 wrote to memory of 2856 3152 9b0687b57c5411b378ef42b57ffa658c.exe 91 PID 3152 wrote to memory of 2856 3152 9b0687b57c5411b378ef42b57ffa658c.exe 91 PID 3152 wrote to memory of 2856 3152 9b0687b57c5411b378ef42b57ffa658c.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b0687b57c5411b378ef42b57ffa658c.exe"C:\Users\Admin\AppData\Local\Temp\9b0687b57c5411b378ef42b57ffa658c.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\cacls.execacls "C:\Windows\system32\oobe" /t /e /g everyone:f2⤵PID:4288
-
-
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe /s C:\Windows\system32\oobe\zsipadroni.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4604
-
-
C:\Windows\SysWOW64\EXPLORER.EXEEXPLORER.EXE /e,C:\Windows\system32\oobe\6438\2⤵PID:2700
-
-
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /s "C:\Windows\system32\SZVCZLRASOX.reg"2⤵
- Modifies firewall policy service
- Runs .reg file with regedit
PID:5072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$306609.bat2⤵PID:2856
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\$$306609.bat
- Size 182B
- SHA256 38ef83efccb209f786c913a2cfb0e88591c7732dfffef6f02d6f6b73228bdc86
- MD5 a067cbb4731a7ecc309a76b624179e84
- SHA1 a9921493e01f4cdcb6c4dd01fb2f7859d7dbed42
- SHA512 72c140526a86d4c4924793bb179d2e7b9c37f84034cbc8b8691b8171c4c4252fa13e8c41f3d53f92510b7ea8a4c639f29c1649d85db2f9a310770351d5fad200
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\SZVCZLRASOX.reg
- Size 297B
- SHA256 452037a39c6981d80e1c05ac9b11a5e0efab3ab0f3d18d69da5d0bebbe815d14
- MD5 c26ea7460e0d85e4c8951c4c4beef663
- SHA1 1276a74f562e381097b15f4a71ca76159a8abc4b
- SHA512 44c59c30ccacd390ab9cd89f3512f384e1a71091f732a76a5459f0789f4f5e41552b2c2f15b264eaeeb8cbb1b739551ed018b6a4820b0a0c47fca787605f8873
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\oobe\zsipadroni.dll
- Size 550KB
- SHA256 d3795481114af0ad71bf9c6ccdee03012e9ba2acb1b35af7afcaec3c6bb0df1c
- MD5 f93c3434b602a7a17a4bf5bf33c3cd67
- SHA1 5645d4e6b1d22a84ff1678ddfeea07cc4be83198
- SHA512 345519b9201d58ef7e18ab7ad886fbcb8d532e1718be5ccf08de77a571b423bb757c7cf532e4e8b1fe34139ee3ca08fc44ff6f45a1198452043960434982c46d
- SSDEEP 6144:FXg4N/1idqbBNELG+a9fOk8+p/nURYvRmne/H3ADTLqX4k64dS7Hto2UXOpsFshb:1fDi4BNELGFb8Ql4HmXyNo25sFshTn
- MD5 SHA1 SHA512 SSDEEP