Analysis
- max time kernel
121s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
05/03/2024, 10:51
Behavioral task
behavioral1
Sample
b486869f5d0455cd0179ede65d334ddb.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b486869f5d0455cd0179ede65d334ddb.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target b486869f5d0455cd0179ede65d334ddb.exe
- Size 115KB
- Sample240305-mx374adh86
- SHA256 2fa0de77949c1c80710b166f0658bf2c3a9cf5772dba6640d68807015c5dd78a
- MD5 b486869f5d0455cd0179ede65d334ddb
- SHA1 89846a60ec8f3380781331c58d10e66886bd755f
- SHA512 e701c883c398de4673e700f851cda070f728d9b4446362b2fcb6927a37834abf374f7254eddf0cf95d9db7271702ba233199d900f8de7bda0c221b1369fad45f
- SSDEEP 1536:E33gB2Aj5E33sIstpxNhB8AmlI9mSui8NDz9RBkChaNomb:GqzGsI0hgAmomSuiKDJRBkMxS
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
pid Process 2748 cmd.exe - Executes dropped EXE 1 IoCs
pid Process 2568 WinHom.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\As.ico b486869f5d0455cd0179ede65d334ddb.exe File created C:\Windows\WinHom.exe b486869f5d0455cd0179ede65d334ddb.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\Shell b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\Shell\Open(&O)\ = "Open(&O)" b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Shell\Open(&O)\ = "Open(&O)" b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\Shell\ÊôÐÔ(&D)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ShellFolder b486869f5d0455cd0179ede65d334ddb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\ShellFolder\Attributes = "0" b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E} b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\ = "Internet Explorer" b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE" b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\Shell\ÊôÐÔ(&D) b486869f5d0455cd0179ede65d334ddb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\ShellFolder\Attributes = "0" b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\DefaultIcon\ = "C:\\Windows\\As.ico" b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Shell\Open(&O)\Command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE " b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\DefaultIcon b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\Shell\ÊôÐÔ(&D)\Command b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Shell\ÊôÐÔ(&D)\Command b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\Shell\Open(&O) b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\ b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Shell\ÊôÐÔ(&D) b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\Shell\Open(&O)\Command b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DefaultIcon b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Shell b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Shell\Open(&O)\Command b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\ShellFolder b486869f5d0455cd0179ede65d334ddb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Shell\Open(&O) b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D8B9F522-3C24-11D4-97C2-0080C882687E}\Shell\Open(&O)\Command\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE %1 h%t%t%p:%//%w%w%w.%y%a%o%ch%a.l%a" b486869f5d0455cd0179ede65d334ddb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Shell\ÊôÐÔ(&D)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" b486869f5d0455cd0179ede65d334ddb.exe - Runs .reg file with regedit 3 IoCs
pid Process 2032 regedit.exe 2192 regedit.exe 2836 regedit.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2568 WinHom.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2032 2840 b486869f5d0455cd0179ede65d334ddb.exe 28 PID 2840 wrote to memory of 2032 2840 b486869f5d0455cd0179ede65d334ddb.exe 28 PID 2840 wrote to memory of 2032 2840 b486869f5d0455cd0179ede65d334ddb.exe 28 PID 2840 wrote to memory of 2032 2840 b486869f5d0455cd0179ede65d334ddb.exe 28 PID 2840 wrote to memory of 2192 2840 b486869f5d0455cd0179ede65d334ddb.exe 29 PID 2840 wrote to memory of 2192 2840 b486869f5d0455cd0179ede65d334ddb.exe 29 PID 2840 wrote to memory of 2192 2840 b486869f5d0455cd0179ede65d334ddb.exe 29 PID 2840 wrote to memory of 2192 2840 b486869f5d0455cd0179ede65d334ddb.exe 29 PID 2840 wrote to memory of 2836 2840 b486869f5d0455cd0179ede65d334ddb.exe 30 PID 2840 wrote to memory of 2836 2840 b486869f5d0455cd0179ede65d334ddb.exe 30 PID 2840 wrote to memory of 2836 2840 b486869f5d0455cd0179ede65d334ddb.exe 30 PID 2840 wrote to memory of 2836 2840 b486869f5d0455cd0179ede65d334ddb.exe 30 PID 2840 wrote to memory of 2568 2840 b486869f5d0455cd0179ede65d334ddb.exe 31 PID 2840 wrote to memory of 2568 2840 b486869f5d0455cd0179ede65d334ddb.exe 31 PID 2840 wrote to memory of 2568 2840 b486869f5d0455cd0179ede65d334ddb.exe 31 PID 2840 wrote to memory of 2568 2840 b486869f5d0455cd0179ede65d334ddb.exe 31 PID 2840 wrote to memory of 2748 2840 b486869f5d0455cd0179ede65d334ddb.exe 32 PID 2840 wrote to memory of 2748 2840 b486869f5d0455cd0179ede65d334ddb.exe 32 PID 2840 wrote to memory of 2748 2840 b486869f5d0455cd0179ede65d334ddb.exe 32 PID 2840 wrote to memory of 2748 2840 b486869f5d0455cd0179ede65d334ddb.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\b486869f5d0455cd0179ede65d334ddb.exe"C:\Users\Admin\AppData\Local\Temp\b486869f5d0455cd0179ede65d334ddb.exe"1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\As.reg2⤵
- Runs .reg file with regedit
PID:2032
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\As.reg2⤵
- Runs .reg file with regedit
PID:2192
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s C:\Users\Admin\AppData\Local\Temp\As.reg2⤵
- Runs .reg file with regedit
PID:2836
-
-
C:\Windows\WinHom.exe"C:\Windows\WinHom.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2568
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\b486869f5d0455cd0179ede65d334ddb.exe"2⤵
- Deletes itself
PID:2748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\As.reg
- Size 191B
- SHA256 d804bfbe0fcda12c7eac87d50d97711d58d9233c9fa4dbc28df06fceee614fba
- MD5 8ce1e0204d80e9acfdf66075942b89de
- SHA1 dd5ad43c5567e1cdb1a5fef5775d09ace0ed4ffe
- SHA512 f14d237ccdf68e09c71f0445bd3469ceb4147e02c85aec0346e69787999cc6c58b9bef15a3aa36ba533d55296cc400e0a193cf7dc3cf5ac5d1bcd17d42021f9f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\As.reg
- Size 136B
- SHA256 9b49398b2740012e3b439bb6d124d99b506e2c20ce34825ac56df4c3867ca876
- MD5 29e90ccb597f9d84e6b8ed0573a5ed16
- SHA1 0e596e582edad25cc0d110368a94e21b913a4611
- SHA512 11eacace0cdf5d5c8d137acaa81f1fb03d13edb570e6fa4a77b686fe6e29c0f4502f7fa3f842bf7a979419b2dc1014ae204540aff3acca9a6c6ba9a49a7ab8ed
- MD5 SHA1 SHA512
- Path C:\Windows\WinHom.exe
- Size 8KB
- SHA256 d7f692df91931910fd78a6595d066f345872611d7502839dc9ffced5dc37df54
- MD5 776e2ef225c629cb923d8aca937920e7
- SHA1 64beb91d93aea435417ddd526d62d49229d96d79
- SHA512 a03be154a6442b8588923811963220c247d720861946a830496321c6988602ee5d84fd97f1eb89017f166c0d7e61de687d5ffc0f5c9e6106adbbbae312dcd424
- SSDEEP 192:/TsELvNKQJNUI0zVwB7xGfuJflvdVPvu8JG+zw:/TsELvNKQJNb0zVwB7xCcVLJBz
- MD5 SHA1 SHA512 SSDEEP