Analysis
- max time kernel
93s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
21/03/2024, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da40583cd6e4dd348536ec79a49f3322.exe
Resource
win7-20240220-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
da40583cd6e4dd348536ec79a49f3322.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target da40583cd6e4dd348536ec79a49f3322.exe
- Size 148KB
- Sample240321-a3fb1aff27
- SHA256 ce9cc0c7574f4e1fd784aaef914d04fb6ae0b2fee69888214249416b899782ab
- MD5 da40583cd6e4dd348536ec79a49f3322
- SHA1 c42bc1e42387fd831c6d043e461f9689680ee55b
- SHA512 68aa1b3f222d921fd631c59413ce09178b31ea232dd4a48eb3ca8d2961af8114856835a8f648603867be6cf144f80f6263f6748bb6f4d4508c2ab5b07b5b6e55
- SSDEEP 3072:eQbegzATCfTblzwII5VoYr/8BtNPrs5fE:bVZzDor/Avof
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\sashost.exe" da40583cd6e4dd348536ec79a49f3322.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation da40583cd6e4dd348536ec79a49f3322.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation shelasv.exe - Deletes itself 1 IoCs
pid Process 2132 shelasv.exe - Executes dropped EXE 3 IoCs
pid Process 544 cvshost.exe 2132 shelasv.exe 3148 sashost.exe - Loads dropped DLL 1 IoCs
pid Process 4856 regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B0A105E-5FB9-4507-835D-68794062C367} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1B0A105E-5FB9-4507-835D-68794062C367}\ = "HTML Doucment" regsvr32.exe - Drops file in System32 directory 16 IoCs
description ioc Process File created C:\Windows\SysWOW64\kavell.sys da40583cd6e4dd348536ec79a49f3322.exe File opened for modification C:\Windows\SysWOW64\sashost.exe shelasv.exe File opened for modification C:\Windows\SysWOW64\interfat.ini shelasv.exe File opened for modification C:\Windows\SysWOW64\havser.ini shelasv.exe File created C:\Windows\SysWOW64\cvshost.exe da40583cd6e4dd348536ec79a49f3322.exe File created C:\Windows\SysWOW64\mseval.dll da40583cd6e4dd348536ec79a49f3322.exe File opened for modification C:\Windows\SysWOW64\clfmon.exe shelasv.exe File opened for modification C:\Windows\SysWOW64\kavell.sys shelasv.exe File opened for modification C:\Windows\SysWOW64\shelrav.exe shelasv.exe File opened for modification C:\Windows\SysWOW64\interfat.ini da40583cd6e4dd348536ec79a49f3322.exe File created C:\Windows\SysWOW64\censhel.DLL da40583cd6e4dd348536ec79a49f3322.exe File created C:\Windows\SysWOW64\sashost.exe shelasv.exe File opened for modification C:\Windows\SysWOW64\censhel.DLL shelasv.exe File created C:\Windows\SysWOW64\ssdtdt.sys da40583cd6e4dd348536ec79a49f3322.exe File created C:\Windows\SysWOW64\shelasv.exe da40583cd6e4dd348536ec79a49f3322.exe File opened for modification C:\Windows\SysWOW64\msmacl.dll shelasv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\TypeLib\ = "{31077068-3D52-40AC-8F45-A70B51CB7C52}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\ = "IBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO\CLSID\ = "{1B0A105E-5FB9-4507-835D-68794062C367}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\InprocServer32\ = "C:\\Windows\\SysWow64\\mseval.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\TypeLib\ = "{31077068-3D52-40AC-8F45-A70B51CB7C52}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO.1\ = "HTML Doucment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO\CurVer\ = "VIPBHO3.BHO.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\ = "HTML Doucment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0\HELPDIR\ = "C:\\Windows\\system32" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\TypeLib\ = "{31077068-3D52-40AC-8F45-A70B51CB7C52}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\VersionIndependentProgID\ = "VIPBHO3.BHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0\ = "VIPBHO3 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\ProgID\ = "VIPBHO3.BHO.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31077068-3D52-40AC-8F45-A70B51CB7C52}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\mseval.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\ = "IBHO" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO.1\CLSID\ = "{1B0A105E-5FB9-4507-835D-68794062C367}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VIPBHO3.BHO\ = "HTML Doucment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1B0A105E-5FB9-4507-835D-68794062C367}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84DD673F-42B1-449E-8911-56D1310FE9DA}\ProxyStubClsid32 regsvr32.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 940 da40583cd6e4dd348536ec79a49f3322.exe 940 da40583cd6e4dd348536ec79a49f3322.exe 940 da40583cd6e4dd348536ec79a49f3322.exe 940 da40583cd6e4dd348536ec79a49f3322.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe 3148 sashost.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 652 Process not Found - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeSystemtimePrivilege 940 da40583cd6e4dd348536ec79a49f3322.exe Token: SeSystemtimePrivilege 3148 sashost.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 940 da40583cd6e4dd348536ec79a49f3322.exe 940 da40583cd6e4dd348536ec79a49f3322.exe 544 cvshost.exe 544 cvshost.exe 2132 shelasv.exe 3148 sashost.exe 3148 sashost.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 940 wrote to memory of 544 940 da40583cd6e4dd348536ec79a49f3322.exe 90 PID 940 wrote to memory of 544 940 da40583cd6e4dd348536ec79a49f3322.exe 90 PID 940 wrote to memory of 544 940 da40583cd6e4dd348536ec79a49f3322.exe 90 PID 940 wrote to memory of 4856 940 da40583cd6e4dd348536ec79a49f3322.exe 92 PID 940 wrote to memory of 4856 940 da40583cd6e4dd348536ec79a49f3322.exe 92 PID 940 wrote to memory of 4856 940 da40583cd6e4dd348536ec79a49f3322.exe 92 PID 940 wrote to memory of 2132 940 da40583cd6e4dd348536ec79a49f3322.exe 93 PID 940 wrote to memory of 2132 940 da40583cd6e4dd348536ec79a49f3322.exe 93 PID 940 wrote to memory of 2132 940 da40583cd6e4dd348536ec79a49f3322.exe 93 PID 2132 wrote to memory of 3148 2132 shelasv.exe 94 PID 2132 wrote to memory of 3148 2132 shelasv.exe 94 PID 2132 wrote to memory of 3148 2132 shelasv.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\da40583cd6e4dd348536ec79a49f3322.exe"C:\Users\Admin\AppData\Local\Temp\da40583cd6e4dd348536ec79a49f3322.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\cvshost.exe"C:\Windows\system32\cvshost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:544
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s /c C:\Windows\system32\mseval.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4856
-
-
C:\Windows\SysWOW64\shelasv.exe"C:\Windows\system32\shelasv.exe"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\sashost.exe"C:\Windows\system32\sashost.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3148
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\cvshost.exe
- Size 20KB
- SHA256 dd0defbe5160881f41afb4daace07ac3c89b7971e20bbc43057016e96e76db20
- MD5 77e119c92601b62529a3742de2e289be
- SHA1 5034a37c775be3ca0ff2c889ffafd632faade208
- SHA512 f2fc02e6b3b0a4b7ed92df0a4615bb9af2ca3ccf93a9018580decf56651465a775f58133a6c895932f100968ac0b63c7bc1886acac9a5132015f73db29123bef
- SSDEEP 192:a8GX5ISDBKkdQuPBWanaIeP1oyn0svSo71nF:0yxX8aH1KC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\interfat.ini
- Size 91B
- SHA256 07bcc25f74565de3c56e721e00e4d86d6a80a1872381057d59a3210387fbaea9
- MD5 fa18dde0d5363d133e64fb8b034246f6
- SHA1 5e4d7efcbd4840497ce8144d160ff43c48f1721b
- SHA512 f23e4563580c33fe5667b8205069c8a49638d775159a4a6be12a20fd3c112fc6e4a90aa22f6eca6f29deb9364e3c54765902cf5db5b4b1496997ca08e68b4a4b
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\interfat.ini
- Size 26B
- SHA256 14776c2d9c1446833752ec1c0686cc74bee4c3bd3036b3ad7cf51249ebe381ab
- MD5 d8ab3ea023fda33b8017ccc4748534f8
- SHA1 e5c8b0f40ed03ad98f0d207ee073af2ee925db78
- SHA512 0a6ab8641e77dcdc9b33e49462404aaf43ca549122d6fd5afc72448b5f50558859657d64d66d38415e752c05abaa225e545310986516eb1af0f691ff690ec5e0
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\kavell.sys
- Size 2KB
- SHA256 20365aaa55196401e7a500f11ad7490a55aee0fb3972fdf3f05ea4395375d153
- MD5 20eb9af9b9d26c91c36a992c4648eb6e
- SHA1 09feadf3f73573745124b41e44a2eb49cb6034dc
- SHA512 316fe981338abddefed090482b47d7ac28886fdb7ec25728617b636cbafa48596d2f87c4b8477a56d67a2906abf9e7cf607d326d750b70b3b94f84fba419218a
- MD5 SHA1 SHA512
- Path C:\Windows\SysWOW64\mseval.dll
- Size 48KB
- SHA256 218a9a1a8e4805287b9b1a19712c49a136faf976e00a503bc8eecab56eed8d48
- MD5 b51964d515a38f4a790e1235a97211e2
- SHA1 eeeab95a380463f463371f1daed7ed3a3dc612a5
- SHA512 c90cbf47c0b87d3b594c33b43289226fd28b41ce64812e68cfcd8198fef192164ac59abd5cb1bd009f2d4f211f683f2ad0b643d5de189e207b4ae3dff623b82c
- SSDEEP 768:JQvLz/RM3Rj1E8r0iY99s8pCmCyWCgjJlyME3nV8DFbmfjU0rs5ZgrEEa:JQvihj1E84iY99s8KyliJlyMwV8d0rsS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\sashost.exe
- Size 148KB
- SHA256 ce9cc0c7574f4e1fd784aaef914d04fb6ae0b2fee69888214249416b899782ab
- MD5 da40583cd6e4dd348536ec79a49f3322
- SHA1 c42bc1e42387fd831c6d043e461f9689680ee55b
- SHA512 68aa1b3f222d921fd631c59413ce09178b31ea232dd4a48eb3ca8d2961af8114856835a8f648603867be6cf144f80f6263f6748bb6f4d4508c2ab5b07b5b6e55
- SSDEEP 3072:eQbegzATCfTblzwII5VoYr/8BtNPrs5fE:bVZzDor/Avof
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\shelasv.exe
- Size 20KB
- SHA256 d8a79ce2953ed9305cba87a5e689a2971bec9cae4d45d81f690f2871616af392
- MD5 f6ebd825bcff1ddc77dc418e46700191
- SHA1 b623ca60b0ebd67f58ed230b05f8dcb882fe604a
- SHA512 6749215c5f54eeebc8ffacb1a95d9e0a894da79f50fbd7b8a4624db691487a862a60ff83e77c264c0dc2e68b1d5d23048987b043f5ed1acfd6f73b494fb63db4
- SSDEEP 96:a/sRxWE9AjXaGGrLEDC0sgs2xD1+3GsMHssPtboyngNoe1OU6Ev:3RfqjX8WtQ2lDDP1oyngNoKhv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ssdtdt.sys
- Size 2KB
- SHA256 a612678df4d0415221943f004cbe9df447530708afe823dbdce5dbdf5ee354b6
- MD5 00e017d93f3f3c7a98d9cd511fc3be63
- SHA1 2aa195542f925496ab03bfb714708305cd898936
- SHA512 d69f4019fc023112c83ebacdb94c0dd98a21851cf738114f59e44561ec3f9c597554d901c6e30d9e46d47f19e1b430a6bf7a37fcdaac43d500c022da527c5ddb
- MD5 SHA1 SHA512