Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
06/04/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
100.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
100.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
40.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
40.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
rdns.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
rdns.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target 40.exe
- Size 1.0MB
- Sample240406-2c418acg7x
- SHA256 986f4b9b0c86141db624d8e1811a3743d067896da7300840df59db962a97d87d
- MD5 9f1520c12a9aaabb48d786c7b0afbd88
- SHA1 bc6f959c52b034b3d8cf47bd6601fee196019a2a
- SHA512 6d281ee8c29006fe0c558df836c149904fbda6dcca3cdf5e2a0b297b08b8c365fe505a74db8b87f2fd2f08b305bac5187517e6c85beae64f0b7f1f14dc0b79a1
- SSDEEP 12288:RNE20t/TBdp9TuxviU3vuEqV/a68TSfqzpSwyovU59nP3V7Rh1E1:J0t3AvHzqohTMZNVPfhG1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
http://www.grooveshark.com/
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2340 saf8647.tmp - Loads dropped DLL 1 IoCs
pid Process 1736 regsvr32.exe - Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6}\ = "Tango" regsvr32.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\d978.dll 40.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{55CAD694-D8AC-465E-9D06-82EBC2FE277E}\URL = "http://www.tangosearch.com/?q={searchTerms}&a=SEARCH" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{55CAD694-D8AC-465E-9D06-82EBC2FE277E} regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{55CAD694-D8AC-465E-9D06-82EBC2FE277E} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{55CAD694-D8AC-465E-9D06-82EBC2FE277E}\DisplayName = "Search" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = "0" saf8647.tmp Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{55CAD694-D8AC-465E-9D06-82EBC2FE277E}\DisplayName = "Search" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{55CAD694-D8AC-465E-9D06-82EBC2FE277E}\URL = "http://www.tangosearch.com/?q={searchTerms}&a=SEARCH" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Bar = "http://www.tangosearch.com/?useie5=1&q=" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar = "http://www.tangosearch.com/?useie5=1&q=" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Use Custom Search URL = "1" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBarLayout = "0" saf8647.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6} = "0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{55CAD694-D8AC-465E-9D06-82EBC2FE277E}\Codepage = "65001" regsvr32.exe Set value (int) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{55CAD694-D8AC-465E-9D06-82EBC2FE277E}\Codepage = "65001" regsvr32.exe Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{55CAD694-D8AC-465E-9D06-82EBC2FE277E}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{55CAD694-D8AC-465E-9D06-82EBC2FE277E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar regsvr32.exe - Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\Properties regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\Properties\BuildName = "876994" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6}\InprocServer32\ = "C:\\Windows\\SysWow64\\d978.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\ = "Tango" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\Properties\Ticket = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6}\ = "Tango" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\InprocServer32\ = "C:\\Windows\\SysWow64\\d978.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\TypeLib\ = "{1B32B4CB-B4A8-4C1A-B785-7C9D45ED070A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\Properties\Version = "78" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE49-FC7D-4D3F-8F71-0F6BB6E2BEE6}\TypeLib\ = "{1B32B4CB-B4A8-4C1A-B785-7C9D45ED070A}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E46BE48-FC7D-4D3F-8F71-0F6BB6E2BEE6}\TypeLib regsvr32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 848 40.exe 2340 saf8647.tmp - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 848 wrote to memory of 4676 848 40.exe 86 PID 848 wrote to memory of 4676 848 40.exe 86 PID 848 wrote to memory of 4676 848 40.exe 86 PID 848 wrote to memory of 1736 848 40.exe 87 PID 848 wrote to memory of 1736 848 40.exe 87 PID 848 wrote to memory of 1736 848 40.exe 87 PID 1736 wrote to memory of 2340 1736 regsvr32.exe 98 PID 1736 wrote to memory of 2340 1736 regsvr32.exe 98 PID 1736 wrote to memory of 2340 1736 regsvr32.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\40.exe"C:\Users\Admin\AppData\Local\Temp\40.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\mshta.exemshta.exe http://www.grooveshark.com/2⤵PID:4676
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\system32\d978.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\saf8647.tmpC:\Users\Admin\AppData\Local\Temp\saf8647.tmp3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\saf8647.tmp
- Size 188KB
- SHA256 2449e4d0eb3449658f6c9d32d1901a616d9a3eff609d7a3e3ec7927393f272ef
- MD5 2c1a46dcf80cb07958dd42306275a45a
- SHA1 7e36d0956022829778ce1d2e7811d6be40651675
- SHA512 7c197770ccff5b3bdaaa522ce0cb01c764f1d25110930e7de1db0dd1ce78fb29e5d32bb925ca88eeb36146ece42b441513ce7b81dd7d6b43fd89cc999cf60bbe
- SSDEEP 3072:Kp+szq+juJpPMyubG3Ofqj0uhFJb+7rwy0T6Kwr73/ocHsz0XhzTys:ThT+yubG+fqzHJb+wyod0b
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\d978.dll
- Size 880KB
- SHA256 d5d2529aaf7b3240e6dc078f76ed11295bdd7f885f54647da67f0cca40f7da06
- MD5 155bcb710fd1d6dd1434811dcbefb4db
- SHA1 80c61d4c700586b53c5e561b8feb54628b19d58b
- SHA512 2277f8320aba2c0fdf8600e9ad13a98b140a15d8036469fd028088ee5b85e21955a3b90b24b5f35544fe3050174795f6c703806e2e9e26c67b48cf1b8b0ae649
- SSDEEP 12288:E/TBdp9TuxviU3vuEqV/a68TSfqzpSwyovU59nP3V7Rh1E:O3AvHzqohTMZNVPfhG
- MD5 SHA1 SHA512 SSDEEP