e6ae1063da1fa6db72607d1ac2b513e6023018150d16ca9f126f7088cba84407

Analysis

max time kernel
135s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c11f1068becb883528d1f7f759a11bb2.exe
Size

308KB
MD5

c11f1068becb883528d1f7f759a11bb2
SHA1

cc08844c9a756d64ae9691096ec45b00a57cbbb0
SHA256

e6ae1063da1fa6db72607d1ac2b513e6023018150d16ca9f126f7088cba84407
SHA512

2c81ef48025c4ccc6ba077188eba66348bd14943bb264ad7ed8c032bc746eeaf17f239316f356c58242071f474d7c7c7a5821afc24993d346737ccac363f5556
SSDEEP

6144:Ke34ebpLo36rFR1gmq3HGpv4qCiRZHV55G3/w0ljEN:Xl036NgEMqb2LjEN

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4988	searchboxcfg.exe

Loads dropped DLL 9 IoCs

pid	Process
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\searchbox = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows Searchbox\\searchboxcfg.exe\""	searchboxcfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31093717"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31093717"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31093717"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e002e355d573da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1390790139"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b883981b30f3694996f9cdb73b998e5e000000000200000000001066000000010000200000007ba58a1344c2a8819a84d3b810df7281242f563f7dbfef8cde19608e20721022000000000e800000000200002000000046a8517b620f6cbd457b11f2c9d071e81b4ca8fe603fb7daf3de706780fcb88d200000009e737629bc339383c947cc9b79f700cbc7a988ca16acd245e80e22008ee2f11f400000005d5078ade6b3355214cd05f481b03ec2f72e179e6ce290cb9e639f99d576ebd9ed79a68a416c77e9b34449f7aa1091e14110ab7744b71466de221b6e9b0a267a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1390790139"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c4c855d573da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7E66C601-DFC8-11EE-9846-5A176B010E55} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416941245"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1397510391"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b883981b30f3694996f9cdb73b998e5e0000000002000000000010660000000100002000000001919107a88c8ee5e527694a69fdc5f530dba1e3dddb323e4e2164a9bcaaf4a1000000000e80000000020000200000004170db17431f085c41a6978dd30d7570dd4ab81ab4a6ba1bfe8373a23d4f4c6a200000002af68cd21ca3df09a5a63b473e9d105fa6b35a55c5df51482608b4c32c562cc04000000091ac005870032903761a4c94e83c1bc30c874b26b13f3bf3b9cef7b82a8b0de1de5da026228c39b9a9ab67c8a2842e9b26b44f15e15cb50bcbf548ca3cc7bf47	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe
2460	c11f1068becb883528d1f7f759a11bb2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4760	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4760	iexplore.exe
4760	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
4988	searchboxcfg.exe
4988	searchboxcfg.exe
4988	searchboxcfg.exe
4988	searchboxcfg.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 4248	2460	c11f1068becb883528d1f7f759a11bb2.exe	95
PID 2460 wrote to memory of 4248	2460	c11f1068becb883528d1f7f759a11bb2.exe	95
PID 2460 wrote to memory of 4248	2460	c11f1068becb883528d1f7f759a11bb2.exe	95
PID 4760 wrote to memory of 2696	4760	iexplore.exe	100
PID 4760 wrote to memory of 2696	4760	iexplore.exe	100
PID 4760 wrote to memory of 2696	4760	iexplore.exe	100
PID 2460 wrote to memory of 4988	2460	c11f1068becb883528d1f7f759a11bb2.exe	102
PID 2460 wrote to memory of 4988	2460	c11f1068becb883528d1f7f759a11bb2.exe	102
PID 2460 wrote to memory of 4988	2460	c11f1068becb883528d1f7f759a11bb2.exe	102
PID 2460 wrote to memory of 208	2460	c11f1068becb883528d1f7f759a11bb2.exe	103
PID 2460 wrote to memory of 208	2460	c11f1068becb883528d1f7f759a11bb2.exe	103
PID 2460 wrote to memory of 208	2460	c11f1068becb883528d1f7f759a11bb2.exe	103

C:\Users\Admin\AppData\Local\Temp\c11f1068becb883528d1f7f759a11bb2.exe
"C:\Users\Admin\AppData\Local\Temp\c11f1068becb883528d1f7f759a11bb2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \DelUS.bat
  2⤵
  PID:4248
- C:\Users\Admin\AppData\Local\Microsoft\Windows Searchbox\searchboxcfg.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows Searchbox\searchboxcfg.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \DelUS.bat
  2⤵
  PID:208

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:3180

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4760 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3828 --field-trial-handle=2268,i,8796662530135712346,11409037572378858775,262144 --variations-seed-version /prefetch:8
1⤵
PID:5732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DelUS.bat

Filesize
200B

MD5
1206640d27e21528a56cec77ebed0eb3

SHA1
2a40f517c1a11b1dab652992575e0dc8795ddc15

SHA256
ee1b3e748bef1e2e34be991d81fe32e995cea975fa8aae78119f8e25f00db918

SHA512
da2b6c0d4127b7008ed26eff0776bd2c3d9a4e74798f3e5d7eadad0660006ad4b7a24aa14f0634eb6ded44691e66ab04675cce4d9cbe3671b7ba45675e00fc0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Searchbox\searchboxcfg.exe

Filesize
407KB

MD5
dc69eb8aea7fd76a9acb740f3b46e445

SHA1
28c5bc35621319024e4828d17704fceb7e8e3246

SHA256
ceaefb320c8b371f8a799ee61f7165cf8664a8c954cebc3b131a5729139280c0

SHA512
80f9469cb64201d0a66688db796709d95f54a8bc959510421b92076eebfde745348d1507e5cfa64dc7aabd2e8b250f727dd008e1345e32f4bd6b56c442374d33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CCR56MZ5\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj76A8.tmp\DLLWaitForKillProgram.dll

Filesize
28KB

MD5
9c4b8ec42d89f7557bfd90798ce52787

SHA1
2376dde426ea65aa27c30e304086310605382475

SHA256
ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

SHA512
17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj76A8.tmp\KillProcDLL.dll

Filesize
36KB

MD5
6958016193a066833556992077bad4fe

SHA1
5f564945936f99381d7e2408f034f97d069005a4

SHA256
f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e

SHA512
fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj76A8.tmp\SelfDelete.dll

Filesize
24KB

MD5
7bf1bd7661385621c7908e36958f582e

SHA1
43242d7731c097e95fb96753c8262609ff929410

SHA256
c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

SHA512
8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj76A8.tmp\System.dll

Filesize
11KB

MD5
c6f5b9596db45ce43f14b64e0fbcf552

SHA1
665a2207a643726602dc3e845e39435868dddabc

SHA256
4b6da3f2bdb6c452fb493b98f6b7aa1171787dbd3fa2df2b3b22ccaeac88ffa0

SHA512
8faa0204f9ed2721acede285be843b5a2d7f9986841bcf3816ebc8900910afb590816c64aebd2dd845686daf825bbf9970cb4a08b20a785c7e54542eddc5b09a

Download Submit
memory/2460-28-0x00000000028E0000-0x00000000028EA000-memory.dmp

Filesize
40KB

Download