Analysis
-
max time kernel
14s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 15:08
Static task
static1
Behavioral task
behavioral1
Sample
dbedeb6bcf5a905fc9cd3159ecb486a9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dbedeb6bcf5a905fc9cd3159ecb486a9.exe
Resource
win10v2004-20240226-en
Errors
General
-
Target
dbedeb6bcf5a905fc9cd3159ecb486a9.exe
-
Size
244KB
-
MD5
dbedeb6bcf5a905fc9cd3159ecb486a9
-
SHA1
48752df112bb4512bc7d2a94eb559278e8c6649d
-
SHA256
bdc2a05298d45a6eb8383aaa9cdfbc1bdfbd6709d31beee4f67d20820cac626b
-
SHA512
35ef0965f671232fb7713c723f1f7a3a905c67f51bd00e8de28cbb098d8ef9f71eb0f023033b35ad0098d35ad569e481d596858a3aaf8760e3e103c6906c2ab0
-
SSDEEP
6144:TLlRodPmZd7T5hmu3eqK2iV2K0mFkfLKi8R+ntnV4:1Rod+Zd7n3O/V2K0mFkfmiA0nV4
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Iprip\Parameters\ServiceDll = "C:\\WINDOWS\\SYSTEM32\\liprip.dll" ipw.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Iprip\Parameters\ServiceDll = "C:\\Windows\\system32\\liprip.dll" svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2892 ipw.exe -
Loads dropped DLL 4 IoCs
pid Process 1968 dbedeb6bcf5a905fc9cd3159ecb486a9.exe 1968 dbedeb6bcf5a905fc9cd3159ecb486a9.exe 2512 svchost.exe 2512 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\repst = "C:\\Windows\\system32\\iprep.exe" svchost.exe -
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsutk.dll dbedeb6bcf5a905fc9cd3159ecb486a9.exe File created C:\WINDOWS\SysWOW64\liprip.dll ipw.exe File opened for modification C:\Windows\SysWOW64\fsutk.dll svchost.exe File created C:\Windows\SysWOW64\iprep.exe svchost.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Version = "*" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Version = "*" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk\AutoCAD\R16.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk\AutoCAD\R17.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Flags = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Flags = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk\AutoCAD\R16.2 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk\AutoCAD\R17.1 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Flags = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59} svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk\AutoCAD svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Version = "*" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59} svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk\AutoCAD\R16.1 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59} svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk\AutoCAD\R17.2 svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Autodesk\AutoCAD\R18.0 svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{BF50AC63-19DA-487E-AD4A-0B452D823B59} svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Ext\Settings svchost.exe Key created \REGISTRY\USER\S-1-5-18 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\S-1-5-20 svchost.exe -
Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AF604EFE-8897-11D1-B944-00A0C90312E1}\InProcServer32\ svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\InprocServer32\ThreadingModel = "Apartment" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\ svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer\ = "IEHlprObj.IEHlprObj.1" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0E5CBF21-D15F-11d0-8301-00AA005B4383}\InProcServer32\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\ svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID\ = "{BF50AC63-19DA-487E-AD4A-0B452D823B59}" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AF604EFE-8897-11D1-B944-00A0C90312E1}\InProcServer32\ ipw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ = "QuickFlash" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ProgID\ = "IEHlprObj.IEHlprObj.1" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Programmable\ svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\Programmable\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\InprocServer32\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ProgID\ svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\ = "QuickFlash" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer\ svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\ = "QuickFlash" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\ svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\VersionIndependentProgID\ svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\VersionIndependentProgID\ = "IEHlprObj.IEHlprObj" svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID\ svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BF50AC63-19DA-487E-AD4A-0B452D823B59}\InprocServer32\ = "C:\\Windows\\SysWow64\\fsutk.dll" svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 2512 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1968 dbedeb6bcf5a905fc9cd3159ecb486a9.exe 2892 ipw.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2892 1968 dbedeb6bcf5a905fc9cd3159ecb486a9.exe 28 PID 1968 wrote to memory of 2892 1968 dbedeb6bcf5a905fc9cd3159ecb486a9.exe 28 PID 1968 wrote to memory of 2892 1968 dbedeb6bcf5a905fc9cd3159ecb486a9.exe 28 PID 1968 wrote to memory of 2892 1968 dbedeb6bcf5a905fc9cd3159ecb486a9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbedeb6bcf5a905fc9cd3159ecb486a9.exe"C:\Users\Admin\AppData\Local\Temp\dbedeb6bcf5a905fc9cd3159ecb486a9.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\ipw.exe"C:\Users\Admin\AppData\Local\Temp\ipw.exe"2⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2892
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2720
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5be0b4f5b0c11cc5f7b9acaa23f0ca443
SHA1cf99197f1ae49e5ffc35c81b0b0603640d9b0b1a
SHA25670601bb1cbf48a6bd507310ed0f6d21c873c1a320784cbbd82d23d60d3c5f234
SHA5129829c1e6f4dd748bdad6d6a9015c25f601c3ec1a82e00fa791cae09ade6ebc0e2a09ff4bc14cb43857a7ce35807a73f08de7a27519fb04fce80c8dbfef56f52e
-
Filesize
220KB
MD54f69d71a0568508730966bdd39b95c95
SHA1878ea7d895ba421cca8bfae1c71698009a847d74
SHA25602b4e1d03e2064b0ebdd4d95cee3287f0d4dc69f373554eadd824c6d3df40331
SHA512d04dfae26f44647636acc087dfb6cd9db479743663db970fa5764b844f98052a549f4614a358a820acc55df75cae3ede9bca4865f739106ab6e501568a16ae99
-
Filesize
84KB
MD5e942a0f126a283ac5305993d0be0b8f4
SHA1ab77366093838f10879bcab3e7fd0f71ef75afd8
SHA256a4acc2d63fb7f6cd12211a57541f11d391f02cd9ed6ef003d35160d3c6e05104
SHA5127f5155d4b93c1c146c3b19e9a7d6d318d8d827a3d30e41a69ab1edb39670bb4bcf174c3b7ec603c1cd3cbbee6923c30c1f458968a735d1d8cfcd039ed9f51a74
-
Filesize
20KB
MD5f417997432de8f500c7b3e86a3defcc7
SHA18450126b476688e10dcaec5ca6e4b036929160ed
SHA256599a8a9acae1ddb98e3bd096256dcabc2b620059bd4d1e968b0424dbc9b97f1a
SHA51277f4718bf308680f3f049437a57c4e1603b3d3ce38d51c5c60fd1b7511aedd9175aae207db1911f903365686e8d7d9be457ae0095bb48bb2f5ea9841cb99ddc7