a0cbaa1d30c81051528609376fe68d782bed44d5ff2bc4bd17ae57ac77a18758

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 10:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c85f56673db16728d3698bd4f0e60517.exe
Size

2.0MB
MD5

c85f56673db16728d3698bd4f0e60517
SHA1

309e1d63a244cfb4377f51062644bcd87aa8ac0c
SHA256

a0cbaa1d30c81051528609376fe68d782bed44d5ff2bc4bd17ae57ac77a18758
SHA512

a372fffd857c5166c51317865c21196a76a0f54e3b1581a1e380825071369e19e51e66b5430e59b0125f4c514635f0cceb1f2c157aa51b0e74325a9ceda20939
SSDEEP

49152:iqUt5VjyL1niH/NavDQaPk361rxwcRwCkctVVPa5:iqD1iH/NZIfxwcRwCkIVA

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 37 IoCs

pid	Process
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\EverVaccineMain = "\"C:\\Program Files (x86)\\EverVaccine\\EverVaccine.exe\" /Scan"	c85f56673db16728d3698bd4f0e60517.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EverVaccine\Uninstall.exe	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\etc\EverVaccineMon.exe	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\etc\EverVaccineReport.exe	c85f56673db16728d3698bd4f0e60517.exe
File opened for modification	C:\Program Files (x86)\EverVaccine\partner.ini	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\EverVaccine.dll	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\skin\default.avs	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\etc\EverVaccineRemote.dll	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\EVUpdateServer.dat	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\etc\EverVaccineReg.exe	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\conf.ini	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\etc\EverVaccineFD.SYS	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\Lang\kr.xml	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\EverVaccine.exe	c85f56673db16728d3698bd4f0e60517.exe
File created	C:\Program Files (x86)\EverVaccine\EverVaccineUpdate.exe	c85f56673db16728d3698bd4f0e60517.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{495FEA0E-E1EC-11EE-ABF1-CA9969386483} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe
1564	c85f56673db16728d3698bd4f0e60517.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1248	iexplore.exe
1248	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1248	iexplore.exe
1248	iexplore.exe
4360	IEXPLORE.EXE
4360	IEXPLORE.EXE
1248	iexplore.exe
1248	iexplore.exe
820	IEXPLORE.EXE
820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 2688	1564	c85f56673db16728d3698bd4f0e60517.exe	91
PID 1564 wrote to memory of 2688	1564	c85f56673db16728d3698bd4f0e60517.exe	91
PID 1564 wrote to memory of 2688	1564	c85f56673db16728d3698bd4f0e60517.exe	91
PID 1248 wrote to memory of 4360	1248	iexplore.exe	96
PID 1248 wrote to memory of 4360	1248	iexplore.exe	96
PID 1248 wrote to memory of 4360	1248	iexplore.exe	96
PID 1248 wrote to memory of 820	1248	iexplore.exe	97
PID 1248 wrote to memory of 820	1248	iexplore.exe	97
PID 1248 wrote to memory of 820	1248	iexplore.exe	97
PID 1564 wrote to memory of 4924	1564	c85f56673db16728d3698bd4f0e60517.exe	98
PID 1564 wrote to memory of 4924	1564	c85f56673db16728d3698bd4f0e60517.exe	98
PID 1564 wrote to memory of 4924	1564	c85f56673db16728d3698bd4f0e60517.exe	98

C:\Users\Admin\AppData\Local\Temp\c85f56673db16728d3698bd4f0e60517.exe
"C:\Users\Admin\AppData\Local\Temp\c85f56673db16728d3698bd4f0e60517.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /delete /tn:"¿¡¹ö¹é½Å ½ÇÇà" /xml "C:\Users\Admin\AppData\Local\Temp\test_saved.xml"
  2⤵
  PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c \DelUS.bat
  2⤵
  PID:4924

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1840

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1248 CREDAT:17414 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\DelUS.bat

Filesize
200B

MD5
e70cfb1ff76e69e0fc2010aca08a2699

SHA1
18b3391b4301e37c8e518eb628482a30b912704f

SHA256
c0601f27966c2afcf8cd099ca9c11a511a25344325a83fc9973defc22418ee75

SHA512
f68ab90cae4fae1f165151a849819bdc25f0b35e88287cb455fd451c729bcab30252b281584515f137567e77b7fd07bdbd2539347cc514fc73dace08a5af6b88

Download Submit
C:\Program Files (x86)\EverVaccine\EverVaccine.exe

Filesize
784KB

MD5
10df4a038e393878435f4c4079eefc17

SHA1
ebf933824c877e0405b5e9898293dfe5c74a38af

SHA256
537c56ff3dc2b369233a1d63b30e8aab281b0878be355d510e7ba51f2992330a

SHA512
b9ae0d4a18ce4373456a07a915ac008f9aef029501b607cad6a2133861dac81af90bcd6890ab3c0354d6ab667cb2123d3dea20feb570970e80b37be34308e32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\ChkClient.dll

Filesize
140KB

MD5
3fe47e461bb686693cf440c8815f2a0b

SHA1
9a7d27d47a542b83d00f1e6027ba4c22d496f887

SHA256
5bdefe9a081e5e2f4af73891db6228a6b57e7dd320fac0ae233f5cd741db8a1f

SHA512
687c57e17c4f527b90e8eafa9929fa9ee0a1fa82b2c9ba9c6a6385cfcb1fcdd1e09305acbf357cf61e7dd7e061d581a378d2661ed7df7dbfd554514f04646e61

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\DLLWaitForKillProgram.dll

Filesize
28KB

MD5
9c4b8ec42d89f7557bfd90798ce52787

SHA1
2376dde426ea65aa27c30e304086310605382475

SHA256
ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548

SHA512
17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\DLLWebCount_new.dll

Filesize
28KB

MD5
f16f5feebd9b431a8bc63456c0ad267c

SHA1
acc75cfa3ed7888334aa2ccf305a6c6c58a08aaf

SHA256
5417af0fc8284e9745650a55803bb34217e314096dc7cedf113c960624ae08ad

SHA512
ed1e62d903b511a29abd5def4419b5afa63699ee2d1c91a9d884ffb01d7debe5981559574cac4885140d1f27f4275be56236f5c6f1c327147dcac8893f965512

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\IEFunctions.dll

Filesize
3KB

MD5
9701818d39318145dd164794ef3a3846

SHA1
7db701f8dc19163d46ba88e8b68d8dbf428a8152

SHA256
3122b0413f74e88518cfd1b9c6e18435dd326ca177a2374b6405df78f43e776a

SHA512
d92786630250e9eb6c47537b09684fa107f959b50d255c7f3952741eb438c3be47e171827d3a4407b049c33c12dad73f8ec381a7265b28a6d8ca101ff702e8a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\IsVista.dll

Filesize
44KB

MD5
344d13fd0fdd2d97e8d61960f40a8a30

SHA1
3f0f120203005eea3e8ed1652a6ea8a607ea934d

SHA256
17bb3331e2300aa01666fbee98b9552cec5e46212a4c5a340c0370b93df88f83

SHA512
b4e49c58503532e270cc369f1cbd14d85edd46da5ab034dad730bd4297887dd541d445d2fbf205820e6afbbdba7ab6d5b78b694467554320fd6db8e06fe4f719

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\KillProcDLL.dll

Filesize
36KB

MD5
6958016193a066833556992077bad4fe

SHA1
5f564945936f99381d7e2408f034f97d069005a4

SHA256
f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e

SHA512
fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\SelfDelete.dll

Filesize
24KB

MD5
7bf1bd7661385621c7908e36958f582e

SHA1
43242d7731c097e95fb96753c8262609ff929410

SHA256
c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e

SHA512
8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\UserMgr.dll

Filesize
55KB

MD5
130f66c0161e6da46744abe3c0be4d9c

SHA1
d2a44a0cd07bc0c5d81fc0d056d6d45d200896ed

SHA256
955705c8c7188d06af16849e5cc3ceae79ea5d0808cc2851630a54d54bbc01f2

SHA512
915b9135da230ec8d3016ba83bd7102b3f8cb13050189a176f8d4d50363f13584fb971226458bc493cd2df27723c8ab7273effab7d6c6e14d49e735d24d7fac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\nsExec.dll

Filesize
6KB

MD5
cdff6b8f9523b6ef9f20fb5f9e90f1a5

SHA1
b25f6e0a19b41ff0a12de8e98e3005bc119d34fa

SHA256
80b2740fb3a21ffab022a96ce6b420019072f8ef3a048fd9dea4a5b64498c0c8

SHA512
62585c6a6103aed10f9a79c016df8cb630c3e37715542b5f26aa1a910771540c9b323ddbba3329db0ecf524143f7a27b782e198ce944317f764be6b9d04b792e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\stack.dll

Filesize
10KB

MD5
0f61a81a543822de5fcb9a8a43f230dd

SHA1
d01d4a0f542f3c654637fdfe5a574fe1f150ece1

SHA256
46b4a72ae8590b0afb3304cc5c13db0502bc4c4cb02f64f37c79008c17db814f

SHA512
596b7a897ba64c32e26ba6168aa3628aad37b187a9814a286298307d8c42eabf8e8a679dbda558f8b2cdc8676c94ec819256432aa5ad7c05a5387759262a4402

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm321D.tmp\xml.dll

Filesize
118KB

MD5
42df1fbaa87567adf2b4050805a1a545

SHA1
b892a6efbb39b7144248e0c0d79e53da474a9373

SHA256
e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845

SHA512
4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d

Download Submit
memory/1564-19-0x0000000002840000-0x000000000284C000-memory.dmp

Filesize
48KB

Download
memory/1564-116-0x0000000002EC0000-0x0000000002EE1000-memory.dmp

Filesize
132KB

Download
memory/1564-107-0x0000000002860000-0x000000000287E000-memory.dmp

Filesize
120KB

Download
memory/1564-27-0x0000000002840000-0x000000000284A000-memory.dmp

Filesize
40KB

Download
memory/1564-10-0x0000000002840000-0x0000000002867000-memory.dmp

Filesize
156KB

Download