Analysis

  • max time kernel
    141s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    29-04-2024 03:47

General

  • Target

    f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe

  • Size

    504KB

  • MD5

    1bd01ed8e6e38e6063b8356039993b47

  • SHA1

    1a49cc822a7f4b60b7a90d5b6cbddf36cc297bfa

  • SHA256

    f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853

  • SHA512

    b8259fd532e4bbd6755c45be0aff5b451c07e5b932b1b8efac7388d700025d798f9e1525b9c5d301c1faee56005aede6ec2376b3b134627798329c0d03cac28a

  • SSDEEP

    12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 10 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe
    "C:\Users\Admin\AppData\Local\Temp\f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe
      "C:\Users\Admin\AppData\Local\Temp\f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
        C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2340
        • C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
          "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2512
          • C:\Windows\SysWOW64\ipconfig.exe
            "C:\Windows\system32\ipconfig.exe"
            5⤵
            • Gathers network information
            • Suspicious use of WriteProcessMemory
            PID:756
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\QTJDBIRH.bat" "
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:804
              • C:\Windows\SysWOW64\reg.exe
                REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Explorrer /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray" /f
                7⤵
                • Adds Run key to start application
                • Modifies registry key
                PID:752
        • C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
          "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /u /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
            5⤵
            • Loads dropped DLL
            PID:3060
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
            5⤵
            • Loads dropped DLL
            • Installs/modifies Browser Helper Object
            • Modifies registry class
            PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\QTJDBIRH.bat

    Filesize

    153B

    MD5

    02cbdd547ced25f8f7dc814d9169d567

    SHA1

    fc9697d828dcda615f6edd3e49a55b9307dbd311

    SHA256

    ec250cdf89523b18688d45fdc11bc93e46547a574ef59e03426c098f6b887c07

    SHA512

    cec1b6c5d843408e3cb6345a3430d8469a07c09677e1bd4c522c41ee29dbd941236a8dd9963410c69a165f3913c30aa22cfd206e51a59b9ffd160c38e70cfe3f

  • C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe

    Filesize

    504KB

    MD5

    98a6adb0cba3a70fec253f835ec0bf5a

    SHA1

    b78e4e33cdf688070c73efa428d886319f0e5264

    SHA256

    e4ba614090f0ec26b05e3aa02551ce330c4195c37ca119644d6bba78348f7eca

    SHA512

    62b1e1b9dfcaeaec89b27e9c20c6bb9a0d6503d16101383c6a568989978f31578cf90a1b07d9fce2587f145d7a519fdf83e92d85eb233ef41dd2b4b133306177

  • \Users\Admin\AppData\Roaming\IE\bho.dll

    Filesize

    87KB

    MD5

    49a92a33d1775b45b3bd45f8bec24585

    SHA1

    ea404af50bbdad5cbc9f95f4068bdc30c9fceff6

    SHA256

    976540cf1b4d04d80be1f1af8ea0f050c3f03a0a8c4e339589b7bb9180fc07f5

    SHA512

    7d5c4ea5c6f950a41bff386289df88b3f6d78444d7eeaa8a426569ce7698c2dfa916ae02d321af2be839c20e53b2ba9b3bb6a1573cad3b578733b082f0dc292f

  • memory/756-96-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2164-86-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-71-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-67-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-106-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-65-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-78-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-81-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-73-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-84-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-85-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-87-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-88-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-69-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-89-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-91-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-92-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-83-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-61-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2164-63-0x0000000000400000-0x0000000000471000-memory.dmp

    Filesize

    452KB

  • memory/2340-38-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/2340-82-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/2340-75-0x00000000005D0000-0x00000000005D1000-memory.dmp

    Filesize

    4KB

  • memory/2340-45-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/2340-46-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2340-43-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/2512-103-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2980-42-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2980-13-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2980-23-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2980-11-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/2980-37-0x0000000002590000-0x000000000262C000-memory.dmp

    Filesize

    624KB

  • memory/2980-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2980-7-0x0000000000400000-0x0000000000407000-memory.dmp

    Filesize

    28KB

  • memory/3012-5-0x0000000000320000-0x0000000000321000-memory.dmp

    Filesize

    4KB

  • memory/3012-9-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

    Filesize

    4KB

  • memory/3012-10-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

    Filesize

    4KB

  • memory/3012-6-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/3012-0-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/3012-4-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/3012-22-0x0000000002610000-0x00000000026AC000-memory.dmp

    Filesize

    624KB

  • memory/3012-25-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB

  • memory/3012-3-0x0000000000400000-0x000000000049C000-memory.dmp

    Filesize

    624KB