Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
15/03/2024, 12:07
Behavioral task
behavioral1
Sample
cb5e8f9e9ed82f91a9c602adcc04b299.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb5e8f9e9ed82f91a9c602adcc04b299.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target cb5e8f9e9ed82f91a9c602adcc04b299.exe
- Size 413KB
- Sample240315-parlwsaa42
- SHA256 7c6c3504d2f0a28dd0689037b21487d4d8d909542dbee43cdc77c5821ac46499
- MD5 cb5e8f9e9ed82f91a9c602adcc04b299
- SHA1 9c1437fceb99c9de7031402bdf6b326e9d670eb9
- SHA512 395a812d54ea9b7f949dab58f0a8beede40fc9bb8fdcac60e7e5a0b6eb1b44e07bc5b8682ed9c45b313ffa23f03baa5a981142346d9d4a03a148c7c99624b5c7
- SSDEEP 12288:khIj6W6nGbmuUqp0uSsQifn/9043t207pK4P:khjQmuUqOuSK10YtHFK4P
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1" cb5e8f9e9ed82f91a9c602adcc04b299.exe - Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\WINDOWS\system32\drivers\etc\hosts cb5e8f9e9ed82f91a9c602adcc04b299.exe File created C:\WINDOWS\system32\drivers\etc\hosts cb5e8f9e9ed82f91a9c602adcc04b299.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: cb5e8f9e9ed82f91a9c602adcc04b299.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\msscp.reg cb5e8f9e9ed82f91a9c602adcc04b299.exe File opened for modification C:\Windows\SysWOW64\msscp.reg cb5e8f9e9ed82f91a9c602adcc04b299.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\taobao.ico cb5e8f9e9ed82f91a9c602adcc04b299.exe File opened for modification C:\Program Files\Common Files\System\taobao.ico cb5e8f9e9ed82f91a9c602adcc04b299.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\web\Index.htm cb5e8f9e9ed82f91a9c602adcc04b299.exe File created C:\Windows\web\Index.html cb5e8f9e9ed82f91a9c602adcc04b299.exe File opened for modification C:\Windows\web\Index.htm cb5e8f9e9ed82f91a9c602adcc04b299.exe File opened for modification C:\Windows\web\Index.html cb5e8f9e9ed82f91a9c602adcc04b299.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS cb5e8f9e9ed82f91a9c602adcc04b299.exe - Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://sywfhl.com" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://sywfhl.com" cb5e8f9e9ed82f91a9c602adcc04b299.exe - Modifies registry class 53 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42} cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43} cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R) cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ = "Internet Explorer" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ɾ³ý(&D)\Command cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ɾ³ý(&D) cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\DefaultIcon cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O) cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\WantsParseDisplayName cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "0" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R)\Command cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\1 = "20240315" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R)\Command cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\DefaultIcon cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\HideOnDesktopPerUser cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\ = "´ò¿ªÌÔ±¦Íø(&T)" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\3 = "201437" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\Command cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\HideFolderVerbs cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "1" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ɾ³ý(&D)\Command cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O) cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\Attributes = "0" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\Open(&O)\Command\ = "iexplore.exe C:\\WINDOWS\\Web\\index.htm" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\Attributes = "0" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Play2a cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\HideFolderVerbs cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\ShellFolder\WantsParseDisplayName cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M) cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\Command\ = "iexplore.exe C:\\WINDOWS\\Web\\index.html" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ɾ³ý(&D)\Command\ = "Rundll32.exe" cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ = "ÌÔ±¦Íø£¡" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M)\Command cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ÖØÃüÃû(&M)\Command cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder\HideOnDesktopPerUser cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÊôÐÔ(&R) cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\ÖØÃüÃû(&M) cb5e8f9e9ed82f91a9c602adcc04b299.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\DefaultIcon\ = "C:\\Program Files (x86)\\Common Files\\System\\taobao.ico" cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD42}\Shell\Open(&O)\Command cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\Shell\ɾ³ý(&D) cb5e8f9e9ed82f91a9c602adcc04b299.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F3CA57DF-C5DA-11CF-8F28-00AA0060FD43}\ShellFolder cb5e8f9e9ed82f91a9c602adcc04b299.exe - Runs .reg file with regedit 2 IoCs
pid Process 4068 regedit.exe 2912 regedit.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4336 wrote to memory of 4068 4336 cb5e8f9e9ed82f91a9c602adcc04b299.exe 88 PID 4336 wrote to memory of 4068 4336 cb5e8f9e9ed82f91a9c602adcc04b299.exe 88 PID 4336 wrote to memory of 4068 4336 cb5e8f9e9ed82f91a9c602adcc04b299.exe 88 PID 4336 wrote to memory of 928 4336 cb5e8f9e9ed82f91a9c602adcc04b299.exe 89 PID 4336 wrote to memory of 928 4336 cb5e8f9e9ed82f91a9c602adcc04b299.exe 89 PID 4336 wrote to memory of 928 4336 cb5e8f9e9ed82f91a9c602adcc04b299.exe 89 PID 928 wrote to memory of 2912 928 cb5e8f9e9ed82f91a9c602adcc04b299.exe 90 PID 928 wrote to memory of 2912 928 cb5e8f9e9ed82f91a9c602adcc04b299.exe 90 PID 928 wrote to memory of 2912 928 cb5e8f9e9ed82f91a9c602adcc04b299.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb5e8f9e9ed82f91a9c602adcc04b299.exe"C:\Users\Admin\AppData\Local\Temp\cb5e8f9e9ed82f91a9c602adcc04b299.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Drivers directory
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg2⤵
- Runs .reg file with regedit
PID:4068
-
-
C:\Users\Admin\AppData\Local\Temp\cb5e8f9e9ed82f91a9c602adcc04b299.exeC:\Users\Admin\AppData\Local\Temp\cb5e8f9e9ed82f91a9c602adcc04b299.exe2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\regedit.exeC:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg3⤵
- Runs .reg file with regedit
PID:2912
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\System\taobao.ico
- Size 14KB
- SHA256 091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d
- MD5 468fada123f5548ac87e57bae81f6782
- SHA1 edb8f012c25906e6afd8bf335b495e16c440243d
- SHA512 635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa
- SSDEEP 384:jdsFALc7CTsMVlmVrgDZZPZ9jWgtPnqNIcTj:Rbc765DmODZZPZB52jv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\WINDOWS\system32\drivers\etc\hosts
- Size 3KB
- SHA256 55f5e027f614ba79926dbfdc8f371bf9435262cfe5f07006092e3cd4256bdd0b
- MD5 4dfdebcac88169b082fcb7bdc0999fa5
- SHA1 3f548b4f445be23100de22cbdb796fdb8c2f6f7c
- SHA512 1b5a4688567882d5b68c702f656e20e6680df59bac4b166944310dfcaa500fb3ea027085bbd3529c47fef900aa710992561ec0793ffb4c21b44385dc31681176
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\msscp.reg
- Size 228B
- SHA256 8c19027357bcb3170b6844aec44cd4c143c7b795d5df52ff89426615010f715c
- MD5 2d06a424ad1c7611ea9caad93892ea26
- SHA1 a901e15c2ecea498f1ca8ffc5d5c32bd3f0169d8
- SHA512 3199dffce9d7625d9e01d7a06c912d3629e5f3d98d3935763df6b323807d46f24a40876d78d5ae7f7ac83c90e498e7c4810d88993904dbca1036e8c06833ccdf
- MD5 SHA1 SHA512