Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 06:36
Behavioral task
behavioral1
Sample
e1012f2dec2cded76c65d6693e33f758.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
-
Target
e1012f2dec2cded76c65d6693e33f758.exe
-
Size
518KB
-
MD5
e1012f2dec2cded76c65d6693e33f758
-
SHA1
0212dd0ccd4ffe36e1b279bd1f42eb330b3e1ea8
-
SHA256
c3e9b526e003712bb8ed036c93008276fb87f222ed1df9259fbaa4c9052562c8
-
SHA512
9e2f0f580a97fcfc696c50a5a3f7f0d79635cdac20753bacb4d5e02e0c89c8562741be696f150bee788336356a98aee91a181881fa554d17c18786596b6779e3
-
SSDEEP
12288:v6qZjMWxdSb9nSQpndDwMXU4I2t8Qj+c/JyoFNzwfC:v6qZQWbcEQpp84/9+syp
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2836 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2424 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{86EBD5B2-0796-49AD-AE08-846C3146D168} regsvr32.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\762ea34dbd.dll e1012f2dec2cded76c65d6693e33f758.exe File created C:\Windows\SysWOW64\oobe\0147\svchost.exe e1012f2dec2cded76c65d6693e33f758.exe File opened for modification C:\Windows\SysWOW64\oobe\0147\svchost.exe e1012f2dec2cded76c65d6693e33f758.exe File created C:\Windows\SysWOW64\oobe\nmrghvrag.dll e1012f2dec2cded76c65d6693e33f758.exe File opened for modification C:\Windows\SysWOW64\oobe\nmrghvrag.dll e1012f2dec2cded76c65d6693e33f758.exe File created C:\Windows\SysWOW64\762ea34dbd.dll e1012f2dec2cded76c65d6693e33f758.exe File created C:\Windows\SysWOW64\dnabeser.dat e1012f2dec2cded76c65d6693e33f758.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe -
Modifies registry class 42 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nmrghvrag.VedQban\ = "ExpBande" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 56003100000000007b589234100053797374656d333200003e0008000400efbeee3a861a7b5892342a00000027090000000001000000000000000000000000000000530079007300740065006d0033003200000018000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86EBD5B2-0796-49AD-AE08-846C3146D168} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\nmrghvrag.VedQban\Clsid\ = "{86EBD5B2-0796-49AD-AE08-846C3146D168}" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86EBD5B2-0796-49AD-AE08-846C3146D168}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86EBD5B2-0796-49AD-AE08-846C3146D168}\ = "ExpBande" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86EBD5B2-0796-49AD-AE08-846C3146D168}\InprocServer32\ = "C:\\Windows\\SysWow64\\oobe\\nmrghvrag.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nmrghvrag.VedQban\Clsid regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86EBD5B2-0796-49AD-AE08-846C3146D168}\InprocServer32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 52003100000000005558cf7b100057696e646f7773003c0008000400efbeee3a851a5558cf7b2a0000008a020000000001000000000000000000000000000000570069006e0064006f0077007300000016000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4a003100000000007b58a3341000303134370000360008000400efbe7b58a3347b58a3342a000000cf6c01000000090000000000000000000000000000003000310034003700000014000000 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\nmrghvrag.VedQban regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86EBD5B2-0796-49AD-AE08-846C3146D168}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{86EBD5B2-0796-49AD-AE08-846C3146D168}\ProgID\ = "nmrghvrag.VedQban" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 4a003100000000007b58a33410006f6f62650000360008000400efbeee3a881a7b58a3342a0000003b0e00000000010000000000000000000000000000006f006f0062006500000014000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2504 e1012f2dec2cded76c65d6693e33f758.exe 2504 e1012f2dec2cded76c65d6693e33f758.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2504 e1012f2dec2cded76c65d6693e33f758.exe Token: SeDebugPrivilege 2504 e1012f2dec2cded76c65d6693e33f758.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2464 2504 e1012f2dec2cded76c65d6693e33f758.exe 32 PID 2504 wrote to memory of 2464 2504 e1012f2dec2cded76c65d6693e33f758.exe 32 PID 2504 wrote to memory of 2464 2504 e1012f2dec2cded76c65d6693e33f758.exe 32 PID 2504 wrote to memory of 2464 2504 e1012f2dec2cded76c65d6693e33f758.exe 32 PID 2504 wrote to memory of 2424 2504 e1012f2dec2cded76c65d6693e33f758.exe 34 PID 2504 wrote to memory of 2424 2504 e1012f2dec2cded76c65d6693e33f758.exe 34 PID 2504 wrote to memory of 2424 2504 e1012f2dec2cded76c65d6693e33f758.exe 34 PID 2504 wrote to memory of 2424 2504 e1012f2dec2cded76c65d6693e33f758.exe 34 PID 2504 wrote to memory of 2424 2504 e1012f2dec2cded76c65d6693e33f758.exe 34 PID 2504 wrote to memory of 2424 2504 e1012f2dec2cded76c65d6693e33f758.exe 34 PID 2504 wrote to memory of 2424 2504 e1012f2dec2cded76c65d6693e33f758.exe 34 PID 2504 wrote to memory of 2488 2504 e1012f2dec2cded76c65d6693e33f758.exe 35 PID 2504 wrote to memory of 2488 2504 e1012f2dec2cded76c65d6693e33f758.exe 35 PID 2504 wrote to memory of 2488 2504 e1012f2dec2cded76c65d6693e33f758.exe 35 PID 2504 wrote to memory of 2488 2504 e1012f2dec2cded76c65d6693e33f758.exe 35 PID 2504 wrote to memory of 1264 2504 e1012f2dec2cded76c65d6693e33f758.exe 21 PID 2504 wrote to memory of 2836 2504 e1012f2dec2cded76c65d6693e33f758.exe 37 PID 2504 wrote to memory of 2836 2504 e1012f2dec2cded76c65d6693e33f758.exe 37 PID 2504 wrote to memory of 2836 2504 e1012f2dec2cded76c65d6693e33f758.exe 37 PID 2504 wrote to memory of 2836 2504 e1012f2dec2cded76c65d6693e33f758.exe 37
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\e1012f2dec2cded76c65d6693e33f758.exe"C:\Users\Admin\AppData\Local\Temp\e1012f2dec2cded76c65d6693e33f758.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cacls.execacls "C:\Windows\system32\oobe\0147" /t /e /g everyone:f3⤵PID:2464
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s C:\Windows\system32\oobe\nmrghvrag.dll3⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:2424
-
-
C:\Windows\SysWOW64\EXPLORER.EXEEXPLORER.EXE /e,C:\Windows\system32\oobe\0147\3⤵PID:2488
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$306609.bat3⤵
- Deletes itself
PID:2836
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
182B
MD5f1bd45789faf64a3b14b6e7253dae082
SHA142434423261aa5001bc7713605e5f42f57188f9f
SHA256df3b40933a73d21c6ec239494d209ba3a3c9edaa22b8dbcad15f89f53589255d
SHA512dc3eed4daafae293ac79a3c58b42aa894bb7732b1a774d955b039e3c609267ecfc437ba6442e350491311318cdb00220140322ff73783f4cc3f3255e7e7906e4
-
Filesize
522KB
MD5efd6edfefc8e393a850e17c199f06bc0
SHA146ca4212971f2590d0d3659c1e5823cba07aaa44
SHA25615e5f787ea1491f13ad7106320195c3e9142f6e99af503fbc66c53cccc2e4925
SHA512e9e195d106142174594d871fc2182c8989e5aec5722b3c289fa512b01e766fa8e3418d60adc4482d98de8f46b85539eeb971741fd1b80ea9ed51b5ab48be7e23