Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
26-02-2024 10:35
Static task
static1
Behavioral task
behavioral1
Sample
a6243d6db924f3a1b34cafc3b9bc5163.exe
Resource
win7-20240220-en
General
-
Target
a6243d6db924f3a1b34cafc3b9bc5163.exe
-
Size
99KB
-
MD5
a6243d6db924f3a1b34cafc3b9bc5163
-
SHA1
5b4e9109876c1129813f52365344ca54dc77a3aa
-
SHA256
c88a8f4362929f801e4de2e9a056c0d81f09bd4545217be34786783f8316f28c
-
SHA512
8abfe25c4c761b096f5f4f4697331284fa2c4aca40330831a5c43498c467955ee7f8e8b15b5bfbf73ed0b3ab70fe571d464ef4e659ced2229d891cedddc7fcd9
-
SSDEEP
3072:TCuvo0N7CdRp1wHa8tORcXChoqGVk8jwaaHw7Koj4rDM+l7:OuvZgnp1A9WcXuDR
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a6243d6db924f3a1b34cafc3b9bc5163.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Control Panel\International\Geo\Nation a6243d6db924f3a1b34cafc3b9bc5163.exe -
Executes dropped EXE 1 IoCs
Processes:
tdahvpucvygixogg.exepid process 2996 tdahvpucvygixogg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 556 5048 WerFault.exe svchost.exe 1608 3224 WerFault.exe svchost.exe -
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3009988508" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3210300876" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31090847" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415708751" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31090847" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3019208483" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31090847" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31090847" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DF0404A0-D492-11EE-9A10-DEAAA693D5E5} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3009988508" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3538781373-1545967067-4263767959-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 660 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
a6243d6db924f3a1b34cafc3b9bc5163.exetdahvpucvygixogg.exedescription pid process Token: SeSecurityPrivilege 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe Token: SeDebugPrivilege 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe Token: SeSecurityPrivilege 2996 tdahvpucvygixogg.exe Token: SeLoadDriverPrivilege 2996 tdahvpucvygixogg.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
IEXPLORE.EXEpid process 4520 IEXPLORE.EXE 4520 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEpid process 4520 IEXPLORE.EXE 4520 IEXPLORE.EXE 936 IEXPLORE.EXE 936 IEXPLORE.EXE 936 IEXPLORE.EXE 936 IEXPLORE.EXE 4520 IEXPLORE.EXE 4520 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
a6243d6db924f3a1b34cafc3b9bc5163.exeiexplore.exeIEXPLORE.EXEiexplore.exedescription pid process target process PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 5048 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 1588 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe iexplore.exe PID 3088 wrote to memory of 1588 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe iexplore.exe PID 3088 wrote to memory of 1588 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe iexplore.exe PID 1588 wrote to memory of 4520 1588 iexplore.exe IEXPLORE.EXE PID 1588 wrote to memory of 4520 1588 iexplore.exe IEXPLORE.EXE PID 4520 wrote to memory of 936 4520 IEXPLORE.EXE IEXPLORE.EXE PID 4520 wrote to memory of 936 4520 IEXPLORE.EXE IEXPLORE.EXE PID 4520 wrote to memory of 936 4520 IEXPLORE.EXE IEXPLORE.EXE PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 3224 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 3088 wrote to memory of 676 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe iexplore.exe PID 3088 wrote to memory of 676 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe iexplore.exe PID 3088 wrote to memory of 676 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe iexplore.exe PID 676 wrote to memory of 2368 676 iexplore.exe IEXPLORE.EXE PID 676 wrote to memory of 2368 676 iexplore.exe IEXPLORE.EXE PID 4520 wrote to memory of 1348 4520 IEXPLORE.EXE IEXPLORE.EXE PID 4520 wrote to memory of 1348 4520 IEXPLORE.EXE IEXPLORE.EXE PID 4520 wrote to memory of 1348 4520 IEXPLORE.EXE IEXPLORE.EXE PID 3088 wrote to memory of 2996 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe tdahvpucvygixogg.exe PID 3088 wrote to memory of 2996 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe tdahvpucvygixogg.exe PID 3088 wrote to memory of 2996 3088 a6243d6db924f3a1b34cafc3b9bc5163.exe tdahvpucvygixogg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6243d6db924f3a1b34cafc3b9bc5163.exe"C:\Users\Admin\AppData\Local\Temp\a6243d6db924f3a1b34cafc3b9bc5163.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 2083⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4520 CREDAT:17410 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4520 CREDAT:82950 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 2043⤵
- Program crash
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\tdahvpucvygixogg.exe"C:\Users\Admin\AppData\Local\Temp\tdahvpucvygixogg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5048 -ip 50481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3224 -ip 32241⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CH7VV9L3\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Users\Admin\AppData\Local\Temp\tdahvpucvygixogg.exeFilesize
99KB
MD5a6243d6db924f3a1b34cafc3b9bc5163
SHA15b4e9109876c1129813f52365344ca54dc77a3aa
SHA256c88a8f4362929f801e4de2e9a056c0d81f09bd4545217be34786783f8316f28c
SHA5128abfe25c4c761b096f5f4f4697331284fa2c4aca40330831a5c43498c467955ee7f8e8b15b5bfbf73ed0b3ab70fe571d464ef4e659ced2229d891cedddc7fcd9
-
memory/2996-41-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/2996-39-0x00000000004A0000-0x00000000004A2000-memory.dmpFilesize
8KB
-
memory/2996-37-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/2996-36-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/3088-7-0x00000000004F0000-0x00000000004F2000-memory.dmpFilesize
8KB
-
memory/3088-19-0x0000000077852000-0x0000000077853000-memory.dmpFilesize
4KB
-
memory/3088-1-0x0000000000432000-0x000000000043B000-memory.dmpFilesize
36KB
-
memory/3088-2-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/3088-12-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/3088-16-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/3088-18-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/3088-6-0x00000000006F0000-0x00000000006F1000-memory.dmpFilesize
4KB
-
memory/3088-8-0x0000000077852000-0x0000000077853000-memory.dmpFilesize
4KB
-
memory/3088-0-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/3088-5-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/3088-3-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/5048-11-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/5048-10-0x0000000000490000-0x0000000000491000-memory.dmpFilesize
4KB