Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 20:16
General
- Target e2406caf8b2f530e514bd2e767e619e2.exe
- Size 389KB
- Sample240327-y1372sbb62
- SHA256 c25c1a498de5293ca103018fe52307dbf727d1e7d7bf20d4c796f1b59ff3fa99
Malware Config
Signatures
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Drops file in System32 directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies Internet Explorer settings 1 TTPs 38 IoCs
- Modifies registry class 5 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2406caf8b2f530e514bd2e767e619e2.exe"C:\Users\Admin\AppData\Local\Temp\e2406caf8b2f530e514bd2e767e619e2.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\{b7653ad3-0c4e-cf8f-ae18-837989b6443a}.dll" DllInit2⤵
- Loads dropped DLL
- Adds Run key to start application
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
verC582.tmp
suggestions[1].en-US
NSISdl.dll
System.dll
{b7653ad3-0c4e-cf8f-ae18-837989b6443a}.dll
memory/1936-65-0x0000000003560000-0x0000000003561000-memory.dmp
memory/1936-68-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1936-67-0x0000000010000000-0x000000001005A000-memory.dmp
memory/1936-57-0x0000000000D70000-0x0000000000DCA000-memory.dmp
memory/1936-66-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/1936-74-0x0000000010000000-0x000000001005A000-memory.dmp
memory/1936-64-0x0000000003570000-0x0000000003571000-memory.dmp
memory/1936-63-0x0000000000E40000-0x0000000000E41000-memory.dmp
memory/1936-62-0x0000000002730000-0x0000000002731000-memory.dmp
memory/1936-61-0x0000000002770000-0x0000000002771000-memory.dmp
memory/1936-60-0x0000000002750000-0x0000000002751000-memory.dmp
memory/1936-58-0x0000000002710000-0x0000000002711000-memory.dmp
memory/1936-59-0x0000000002760000-0x0000000002761000-memory.dmp
memory/4552-30-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4552-35-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-44-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-43-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-39-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-45-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-49-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-55-0x00000000022B0000-0x00000000022BD000-memory.dmp
memory/4552-38-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-56-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-54-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-37-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-36-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-42-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-34-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-33-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-32-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-31-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4552-29-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4552-28-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4552-27-0x0000000004140000-0x0000000004141000-memory.dmp
memory/4552-26-0x00000000032C0000-0x00000000032C1000-memory.dmp
memory/4552-25-0x0000000003340000-0x0000000003341000-memory.dmp
memory/4552-76-0x0000000004130000-0x0000000004131000-memory.dmp
memory/4552-19-0x0000000003330000-0x0000000003331000-memory.dmp
memory/4552-16-0x00000000032E0000-0x00000000032E1000-memory.dmp
memory/4552-12-0x00000000030F0000-0x000000000314A000-memory.dmp
memory/4552-10-0x00000000022B0000-0x000000000230A000-memory.dmp