Overview
overview
7Static
static
3dc425d638a...d2.exe
windows7-x64
7dc425d638a...d2.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/$S...4_.exe
windows7-x64
7$SYSDIR/$S...4_.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/$_8_.dll
windows7-x64
6$TEMP/$_8_.dll
windows10-2004-x64
6Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2024 17:57
Static task
static1
Behavioral task
behavioral1
Sample
dc425d638aaffd968f4d6c20d473d7d2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dc425d638aaffd968f4d6c20d473d7d2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral5
Sample
$SYSDIR/$SYSDIR/$_14_.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$SYSDIR/$SYSDIR/$_14_.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$TEMP/$_8_.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$TEMP/$_8_.dll
Resource
win10v2004-20231215-en
General
-
Target
dc425d638aaffd968f4d6c20d473d7d2.exe
-
Size
194KB
-
MD5
dc425d638aaffd968f4d6c20d473d7d2
-
SHA1
154f0ca267d764cea5fd794c425bc516465a88f4
-
SHA256
75e2c27c5d49e3236c834c602953faa2a9a6c86223227090be80f8c2671c64ed
-
SHA512
c62a7e45556aec1b080a0ebf65cd13260eb58c3e5f732ec527d611c54f818ad0392cdbb5b48155003dae1ea8a3fbda54d51d4bb9e56d86c58305969cfdaf947a
-
SSDEEP
3072:HNyah0mJB+ckpBVo3AtOqNFsqbinOMy31OBh7EcnJiYVfoQ9vPy2wxRc3LYql6CB:Hw5hB2Q4qN5jMy33ALVAQ9v6dA3LYC3x
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
pid Process 1084 dc425d638aaffd968f4d6c20d473d7d2.exe 1084 dc425d638aaffd968f4d6c20d473d7d2.exe 1084 dc425d638aaffd968f4d6c20d473d7d2.exe 1084 dc425d638aaffd968f4d6c20d473d7d2.exe 1084 dc425d638aaffd968f4d6c20d473d7d2.exe 4248 regsvr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\puqzgghffe = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Users\\Admin\\AppData\\Local\\Temp\\narluujwqtsm.DLL\"" dc425d638aaffd968f4d6c20d473d7d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\puqzgghffe = "C:\\Windows\\System32\\regsvr32.exe /s \"C:\\Windows\\system32\\narluujwqtsm.dll\"" regsvr32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C79A758A-817E-ED97-3CC7-848D10D9396C} dc425d638aaffd968f4d6c20d473d7d2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C79A758A-817E-ED97-3CC7-848D10D9396C}\NoExplorer = "1" dc425d638aaffd968f4d6c20d473d7d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C79A758A-817E-ED97-3CC7-848D10D9396C} regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C79A758A-817E-ED97-3CC7-848D10D9396C}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\fvsdzmssjf.exe dc425d638aaffd968f4d6c20d473d7d2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1307951736" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417808821" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d9e84eb97bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095737" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31095737" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5094ed4eb97bda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7963AB94-E7AC-11EE-B3C6-D6C6679D10A6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31095737" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1307013578" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31095737" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1307951736" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1307013578" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068224481a8b3d349b57460395a3447ba0000000002000000000010660000000100002000000063994ed352c6dd8fdf23bae995a9d4efbc8666fff1b98d7540b10589f6958bed000000000e800000000200002000000032f2327a7c83e0b02487ff7886906c2761aa157024b4db7423d0ea901466c125200000008e725556356859bf8ae8b342c63ffabab899ea8249cd05c49bda4cb887ca290f40000000aae3ab50a38d71607212b01de8b667ae5006366be7ccaf25175eb0d7a4f54340afc4df917d35b02faecadc5b75e1baa607de695e72dfa743d4de79724bbfd832 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000068224481a8b3d349b57460395a3447ba00000000020000000000106600000001000020000000bd3f5309c6081809a2c3bc26828fae75d2439dbd273da4fc127dd9be7eb0a5de000000000e8000000002000020000000a19b9bdfe6864d6ac1b3df669bfe00f19c27cca91292ec75d6d2d16fbaf36f1f200000005a9bfadb166f50c5ffb7075a458bda5fda47e4f42326cf5a1fb4661b0b02ab18400000000bd18b5e88af386d6074419f78b3716b62d8ab5fa8766e3480561d7cd20a4ef6f10929bcb767b6bc86210ea2fa29f4d16e33f26299c3f161baccc6f4dda7a43d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\narluujwqtsm.DLL" dc425d638aaffd968f4d6c20d473d7d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C}\InProcServer32\ = "C:\\Windows\\SysWow64\\narluujwqtsm.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C}\InProcServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C}\InProcServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C} dc425d638aaffd968f4d6c20d473d7d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C}\ = "freedomltd browser enhancer" dc425d638aaffd968f4d6c20d473d7d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C}\InProcServer32 dc425d638aaffd968f4d6c20d473d7d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C}\InProcServer32\ThreadingModel = "Apartment" dc425d638aaffd968f4d6c20d473d7d2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C79A758A-817E-ED97-3CC7-848D10D9396C}\ = "freedomltd browser enhancer" regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 2464 IEXPLORE.EXE 2464 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1084 wrote to memory of 4248 1084 dc425d638aaffd968f4d6c20d473d7d2.exe 92 PID 1084 wrote to memory of 4248 1084 dc425d638aaffd968f4d6c20d473d7d2.exe 92 PID 1084 wrote to memory of 4248 1084 dc425d638aaffd968f4d6c20d473d7d2.exe 92 PID 2248 wrote to memory of 2464 2248 iexplore.exe 95 PID 2248 wrote to memory of 2464 2248 iexplore.exe 95 PID 2248 wrote to memory of 2464 2248 iexplore.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc425d638aaffd968f4d6c20d473d7d2.exe"C:\Users\Admin\AppData\Local\Temp\dc425d638aaffd968f4d6c20d473d7d2.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\narluujwqtsm.dll"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4248
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵PID:3128
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2464
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
380KB
MD59ea41d845f06f65cc4f18c0c60a4a69f
SHA1c3d119060bb7273798571d790d49cc1a2c890204
SHA256edbe235ae1344856534b60a92a08d69ce8ef18c4656853340acbad2f4e70326c
SHA51212fc02282533df30cf6ca5ca5973d746d9a4064877287a7247cfd39cdcb4dbf132526188d6f97033777e38431e3c4c76d54a291163c8e4241f0bffc4513727e0
-
Filesize
10KB
MD57e3c808299aa2c405dffa864471ddb7f
SHA1b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA25691c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
SHA512599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738