Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
15/03/2024, 23:54
Behavioral task
behavioral1
Sample
cc935ed25b4c94e4a73a2e46ce5401c2.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
cc935ed25b4c94e4a73a2e46ce5401c2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target cc935ed25b4c94e4a73a2e46ce5401c2.exe
- Size 32KB
- Sample240315-3x4fvsgd24
- SHA256 dcb27500d056ada6db67b7a0b562c99797789b8d7a1f92a11361584fe3088ac0
- MD5 cc935ed25b4c94e4a73a2e46ce5401c2
- SHA1 a17f1362653bc0261087d198c1be6320c17259f6
- SHA512 09a9603c492d4e4c6068b6c57b2e265ca5c5a2253221589b5057182fa240162d91bf6aea5c3a814cb4e105d3480f62eca23916b028b3ecf9da6f50c00a2299a7
- SSDEEP 768:Yo6qQsIJEuxjAz473OrWsX/pwxRiUGvAAFh/nbcuyD7U:dZYuuxK47uZw70Aoxnouy8
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation cc935ed25b4c94e4a73a2e46ce5401c2.exe -
resource yara_rule behavioral2/memory/4456-0-0x0000000000010000-0x0000000000032000-memory.dmp upx behavioral2/memory/4456-3-0x0000000000010000-0x0000000000032000-memory.dmp upx - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "32" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\Total = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0695e373477da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02463373477da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31094580" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31094580" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb81c2d97e83014aa839d28a6b89bdd4000000000200000000001066000000010000200000002ac4603901804a4d92f984c707727bcc48c6f319102132adcb7a22234a5ec918000000000e80000000020000200000001e3e7e6a95b195355167d487661c9abf1cfa573339f0303b79391fab739bc3ea200000006fa23980ac33a3b52349bf4528c4fe3afbd6b2cdc0bebce9e151978363ccd5e14000000045bd673067c4c23810658c7d389d6f18fc0c392d8346aec77725616308a931b48cf95bb30953722827e9b8eadf256268844a9a7a90ac668be2f3eb4fa32b8a06 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb81c2d97e83014aa839d28a6b89bdd4000000000200000000001066000000010000200000001a4a18866a6d71b38343f7be009ed5cfe3b47f9609f44aaf13f93c9b413d18d4000000000e8000000002000020000000144fa2762704f35199820a53d5f779bb55816ae954ca067efa57eef630bec05a200000009dda4bf446db8f976db1830a8c951cad81be6ff5d46e723cc29def43d71a069c40000000b85ed91fd0683d7d5695f45cf23de475ab77babca5b7d6afa28349d91831ca7889409d8c30d1aabccec400cc2890c14d5a7959454179f1c0ec5edc94a854c258 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{61BF8585-E327-11EE-9216-4640DA9D21C7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\oo.lv\Total = "32" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "908003564" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "908003564" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Internet Explorer\DOMStorage\oo.lv IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 736 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 736 iexplore.exe 736 iexplore.exe 4724 IEXPLORE.EXE 4724 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4456 wrote to memory of 4884 4456 cc935ed25b4c94e4a73a2e46ce5401c2.exe 88 PID 4456 wrote to memory of 4884 4456 cc935ed25b4c94e4a73a2e46ce5401c2.exe 88 PID 4456 wrote to memory of 4884 4456 cc935ed25b4c94e4a73a2e46ce5401c2.exe 88 PID 736 wrote to memory of 4724 736 iexplore.exe 98 PID 736 wrote to memory of 4724 736 iexplore.exe 98 PID 736 wrote to memory of 4724 736 iexplore.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc935ed25b4c94e4a73a2e46ce5401c2.exe"C:\Users\Admin\AppData\Local\Temp\cc935ed25b4c94e4a73a2e46ce5401c2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\TTeMEyLnxm.js" "C:\Users\Admin\AppData\Local\Temp\cc935ed25b4c94e4a73a2e46ce5401c2.exe"2⤵PID:4884
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:444
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\74O910AA\adult.oo[1].xml
- Size 13B
- SHA256 b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
- MD5 c1ddea3ef6bbef3e7060a1a9ad89e4c5
- SHA1 35e3224fcbd3e1af306f2b6a2c6bbea9b0867966
- SHA512 6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BI7EUHR7\favicon[1].htm
- Size 291B
- SHA256 014c471c07b2bc1b90cf5b46eb8eb60abe3ac278e43cd8fcc7c4e6c8950c592d
- MD5 b73189024a094989653a1002fb6a790b
- SHA1 0c44f096cd1fec253c1fe2fcfcd3c58fe05c402d
- SHA512 1bca726835d33847812060c968e5306535f513429de5c90d66942155fd42ff75508dba97da8ca36c6d6e6a8df5a2602fe3be047bb5612ad4e367c6c00e1e50a3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TTeMEyLnxm.js
- Size 10KB
- SHA256 1fbbf7f1a5fe539fa975e246dba624c38c708e987f5516b88498cd3633b6daba
- MD5 fd34bd8bb7721a0ac798df372a1903de
- SHA1 26b6c0bb91eaac925e149ac0671ac1776487cde3
- SHA512 7689311711c43f8d3c7dc5e72c52272856954d65c1a93a8e23a90293c6334370c57266b102ef415d76931aca70b3941d177f9f70b88507af410eac18b03674bb
- SSDEEP 96:sCnHLN0seIsMeboIezLIzZynel/wzZstrYQFKvxSKUeIaI/gPoRQFKN8v4UBeB+c:skHx0UDs/xlLYYsmSJKb
- MD5 SHA1 SHA512 SSDEEP