Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2024 03:47
Static task
static1
Behavioral task
behavioral1
Sample
e70211045ee34fd4a61c11774175ee3ac966afd8586dd60c6763548ad95f35dc.dll
Resource
win7-20240221-en
General
-
Target
e70211045ee34fd4a61c11774175ee3ac966afd8586dd60c6763548ad95f35dc.dll
-
Size
276KB
-
MD5
a71724f88472ab5aece836094e3d3499
-
SHA1
ad24a717035aa70aa25f337384199ad4a95505ed
-
SHA256
e70211045ee34fd4a61c11774175ee3ac966afd8586dd60c6763548ad95f35dc
-
SHA512
95fc7476858607c343018e6b59962a66cb56194dc0d8589d4f93ea88a30943d39952d99a50b0a15882940194052efa7c87a007eaf2ba282b220e958d88042a55
-
SSDEEP
6144:frQuoca4u8i09CXwbkcijm5IZJlN4mQN:Mvoi09CkElN4mQ
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 7 IoCs
Processes:
resource yara_rule C:\Windows\SysWOW64\rundll32Srv.exe UPX behavioral2/memory/1032-4-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/1032-8-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/2116-11-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/2116-14-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/2116-18-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/3308-19-0x0000000010000000-0x0000000010049000-memory.dmp UPX -
Executes dropped EXE 2 IoCs
Processes:
rundll32Srv.exeDesktopLayer.exepid process 1032 rundll32Srv.exe 2116 DesktopLayer.exe -
Processes:
resource yara_rule C:\Windows\SysWOW64\rundll32Srv.exe upx behavioral2/memory/1032-4-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1032-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2116-11-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2116-14-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2116-18-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\rundll32Srv.exe rundll32.exe -
Drops file in Program Files directory 3 IoCs
Processes:
rundll32Srv.exedescription ioc process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe rundll32Srv.exe File opened for modification C:\Program Files (x86)\Microsoft\px1EDD.tmp rundll32Srv.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2868 3308 WerFault.exe rundll32.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1328416413" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1328416413" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7AC6DCE4-FD36-11EE-A3F9-EE516AEA3262} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1352322574" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420177069" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101251" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31101251" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31101251" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
DesktopLayer.exepid process 2116 DesktopLayer.exe 2116 DesktopLayer.exe 2116 DesktopLayer.exe 2116 DesktopLayer.exe 2116 DesktopLayer.exe 2116 DesktopLayer.exe 2116 DesktopLayer.exe 2116 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2504 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2504 iexplore.exe 2504 iexplore.exe 4976 IEXPLORE.EXE 4976 IEXPLORE.EXE 4976 IEXPLORE.EXE 4976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
rundll32.exerundll32.exerundll32Srv.exeDesktopLayer.exeiexplore.exedescription pid process target process PID 3468 wrote to memory of 3308 3468 rundll32.exe rundll32.exe PID 3468 wrote to memory of 3308 3468 rundll32.exe rundll32.exe PID 3468 wrote to memory of 3308 3468 rundll32.exe rundll32.exe PID 3308 wrote to memory of 1032 3308 rundll32.exe rundll32Srv.exe PID 3308 wrote to memory of 1032 3308 rundll32.exe rundll32Srv.exe PID 3308 wrote to memory of 1032 3308 rundll32.exe rundll32Srv.exe PID 1032 wrote to memory of 2116 1032 rundll32Srv.exe DesktopLayer.exe PID 1032 wrote to memory of 2116 1032 rundll32Srv.exe DesktopLayer.exe PID 1032 wrote to memory of 2116 1032 rundll32Srv.exe DesktopLayer.exe PID 3308 wrote to memory of 2600 3308 rundll32.exe splwow64.exe PID 3308 wrote to memory of 2600 3308 rundll32.exe splwow64.exe PID 2116 wrote to memory of 2504 2116 DesktopLayer.exe iexplore.exe PID 2116 wrote to memory of 2504 2116 DesktopLayer.exe iexplore.exe PID 2504 wrote to memory of 4976 2504 iexplore.exe IEXPLORE.EXE PID 2504 wrote to memory of 4976 2504 iexplore.exe IEXPLORE.EXE PID 2504 wrote to memory of 4976 2504 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e70211045ee34fd4a61c11774175ee3ac966afd8586dd60c6763548ad95f35dc.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e70211045ee34fd4a61c11774175ee3ac966afd8586dd60c6763548ad95f35dc.dll,#12⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32Srv.exeC:\Windows\SysWOW64\rundll32Srv.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 6883⤵
- Program crash
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4224,i,13688898677847565093,12881255541559751227,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:81⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3308 -ip 33081⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TOZYVZGO\suggestions[1].en-USFilesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
C:\Windows\SysWOW64\rundll32Srv.exeFilesize
83KB
MD594b88ad3cbf4512d2562c94054c3a88d
SHA1e4a8f7575f992427654ddda1c6556b71eb136c6c
SHA256bd08727b2f887b1d27a3515bf611501eba6c786e2f73e958063ef52e3d6765a5
SHA512f2a7c54f87ad808305df62fa242033282630616d158b142593d7494b51cfb96b8b9a692dd9f67b97e133d1ef1400c24f3d302b276c9931dad422afc5dbdc08b3
-
memory/1032-4-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1032-6-0x0000000002050000-0x000000000205F000-memory.dmpFilesize
60KB
-
memory/1032-8-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2116-13-0x0000000000670000-0x000000000067F000-memory.dmpFilesize
60KB
-
memory/2116-14-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2116-16-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/2116-17-0x0000000077512000-0x0000000077513000-memory.dmpFilesize
4KB
-
memory/2116-18-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/2116-11-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3308-0-0x0000000010000000-0x0000000010049000-memory.dmpFilesize
292KB
-
memory/3308-19-0x0000000010000000-0x0000000010049000-memory.dmpFilesize
292KB