Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
dbfc4cc4faf88548b3b1499ba78a324d.exe
Resource
win7-20240221-en
General
-
Target
dbfc4cc4faf88548b3b1499ba78a324d.exe
-
Size
5KB
-
MD5
dbfc4cc4faf88548b3b1499ba78a324d
-
SHA1
ab4b4ebf19e75b8d6281797175a8ba976fc05207
-
SHA256
1f135eeca52d2f7094f4caeada87fdf09e66227f0afc04a53ffb5ac498ed0e63
-
SHA512
c8af9c5c7923040ed1b5b7049b3710d6039a6635949e21aa4457b7b308ef2cd3fcd6b3f7bf83606846b640f26b6a507a3aafa4c35c1c3a15e4e71b4988217262
-
SSDEEP
48:ZvtH9UKeRob1+HDlIzIZNRJmFCKB/x8HHAH7dhNAMoBAX:Z1deRoIHq8nRJmFCKB+n47hcK
Malware Config
Signatures
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C613CE22-151C-4331-94FF-F113A153F66D} regedit.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2999438723" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31095717" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095717" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DE67CBBD-E798-11EE-87B8-D28C415B03FA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2999438723" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417800399" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095717" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3002876192" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C613CE22-151C-4331-94FF-F113A153F66D}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C613CE22-151C-4331-94FF-F113A153F66D}\InProcServer32\ = "c:\\sysdump.dll" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C613CE22-151C-4331-94FF-F113A153F66D}\InProcServer32 regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C613CE22-151C-4331-94FF-F113A153F66D}\InProcServer32\ = "error" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C613CE22-151C-4331-94FF-F113A153F66D} regedit.exe -
Runs .reg file with regedit 2 IoCs
pid Process 2108 regedit.exe 1936 regedit.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2172 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2172 iexplore.exe 2172 iexplore.exe 4864 IEXPLORE.EXE 4864 IEXPLORE.EXE 4864 IEXPLORE.EXE 4864 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4700 wrote to memory of 2108 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 90 PID 4700 wrote to memory of 2108 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 90 PID 4700 wrote to memory of 2108 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 90 PID 4700 wrote to memory of 2172 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 93 PID 4700 wrote to memory of 2172 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 93 PID 2172 wrote to memory of 4864 2172 iexplore.exe 95 PID 2172 wrote to memory of 4864 2172 iexplore.exe 95 PID 2172 wrote to memory of 4864 2172 iexplore.exe 95 PID 4700 wrote to memory of 1936 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 100 PID 4700 wrote to memory of 1936 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 100 PID 4700 wrote to memory of 1936 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 100 PID 4700 wrote to memory of 1716 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 101 PID 4700 wrote to memory of 1716 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 101 PID 4700 wrote to memory of 1716 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 101 PID 4700 wrote to memory of 4952 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 102 PID 4700 wrote to memory of 4952 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 102 PID 4700 wrote to memory of 4952 4700 dbfc4cc4faf88548b3b1499ba78a324d.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbfc4cc4faf88548b3b1499ba78a324d.exe"C:\Users\Admin\AppData\Local\Temp\dbfc4cc4faf88548b3b1499ba78a324d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\regedit.exeregedit -S c:\temp1.reg2⤵
- Installs/modifies Browser Helper Object
- Modifies registry class
- Runs .reg file with regedit
PID:2108
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" %12⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4864
-
-
-
C:\Windows\SysWOW64\regedit.exeregedit -S c:\temp2.reg2⤵
- Modifies registry class
- Runs .reg file with regedit
PID:1936
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\temp2.bat2⤵PID:1716
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\temp1.bat2⤵PID:4952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
4KB
MD5f7982deb1be471edb1aef54b4bbaf109
SHA1e44f8cedb550fe75510809c6181a609ad957c06b
SHA256011ab7c538a7581b0c327fbb9ca5bf578f266fec317af2a9286b5733d50a8e1c
SHA512a89cb5f9939b66d881893b1ad94467d88d4af71541c57ec8cbad46f7023bf3ae4243459545f37946810a96aa81e68d67851b48857523433163aecceadcb80eac
-
Filesize
196B
MD58888fe593e69fe3f4c48f6e207c42d79
SHA1fc12cef7cb590481c312387af3dcef3436cca234
SHA25691805ee2ff3812326e4341b30676be14377442d65f5377fb14643a80b75ef264
SHA5124cecf7657ba257c172238a5ca67c998d85f94b2fac439da83a21a41161363d7bdab6b024c4000e46661bdbb0a3f7e87bd5a75a6d696c66c7f53cac770677f7e8
-
Filesize
435B
MD5492eb2c8ff983e87c95ca5a704c6f5b8
SHA18677a4e0d606a526b1c90f180116dea7a6bcb0de
SHA2569f0388e16d77a4560acfe712ab8a8c6a171c5d369c4134cd3af9bec658bbd431
SHA512ded2c5fa380fcfaa346dcb33a0775cc476ee7f152b0b54ed34b3e97958e200f1f9f01ed546adc2241d2462cfaf39e9e273eaba04cb2efcfbf7085ba9251acd6e
-
Filesize
84B
MD5b9975d30ddbd098a754312e16f744ec6
SHA19d41e8816bf8f8aa48356c99af46e64947a0d2ef
SHA2566e4f3dd8bf9469f50bd04878da2bb005a9df85192a5c7428b4477cecbfd4747c
SHA5125bdca7782ebe7a2d919c7c096d0b2e9927c68044a5ca802ce7a43e6d4d62fda7b5d7620a1154e640c9946def1b13539a948a58bf13697f897748dc66e3406c02
-
Filesize
128B
MD56fdc273e79d8888a813c762aa55edc39
SHA1a3e72c4eaf143697e3c1a29c8b1c223c121e1d58
SHA256e0eb2406ae229d4df0d3ff5bb8f9bd907aa947b51fdbb6bed1a3238852849f6c
SHA512370125ded5b43b67cfc8f28363086fc9b2c85c6fe53ab1e5e00281cf87292650b2abe7bf9420631ca405f4c7e213bed00c53432329cc5f7d6d1f615a02a1f253