Analysis

  • max time kernel
    142s
  • max time network
    75s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-04-2024 03:47

General

  • Target

    f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe

  • Size

    504KB

  • MD5

    1bd01ed8e6e38e6063b8356039993b47

  • SHA1

    1a49cc822a7f4b60b7a90d5b6cbddf36cc297bfa

  • SHA256

    f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853

  • SHA512

    b8259fd532e4bbd6755c45be0aff5b451c07e5b932b1b8efac7388d700025d798f9e1525b9c5d301c1faee56005aede6ec2376b3b134627798329c0d03cac28a

  • SSDEEP

    12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 9 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies registry class 5 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe
    "C:\Users\Admin\AppData\Local\Temp\f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Users\Admin\AppData\Local\Temp\f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe
      "C:\Users\Admin\AppData\Local\Temp\f0a375676a19b0db2294bd1f6e792d477de9f367f07dabadddae1e6c6a669853.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
        C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
          "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4488
          • C:\Windows\SysWOW64\ipconfig.exe
            "C:\Windows\system32\ipconfig.exe"
            5⤵
            • Gathers network information
            PID:2592
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 272
              6⤵
              • Program crash
              PID:4648
        • C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
          "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
          4⤵
          • Executes dropped EXE
          • Modifies Internet Explorer settings
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /u /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
            5⤵
            • Loads dropped DLL
            PID:2516
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
            5⤵
            • Loads dropped DLL
            • Installs/modifies Browser Helper Object
            • Modifies registry class
            PID:2248
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2592 -ip 2592
    1⤵
      PID:4876

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe

      Filesize

      504KB

      MD5

      332fd0be91557639b36f8c438da4cdb5

      SHA1

      a68c9bbe82f09b6874197423a8c47344742da401

      SHA256

      3f9a4e0547000bc5bac4d39c21baa3527572a2cca8986311f2139498642cd875

      SHA512

      c136d5bb504e1e65675cd48437ddec56621615281a93c7a9b8ff6147d77cf21c3e35163eb66fa78e66e6375d08133d2ae69832c6d99379f335776cbef756af8a

    • C:\Users\Admin\AppData\Roaming\IE\bho.dll

      Filesize

      87KB

      MD5

      49a92a33d1775b45b3bd45f8bec24585

      SHA1

      ea404af50bbdad5cbc9f95f4068bdc30c9fceff6

      SHA256

      976540cf1b4d04d80be1f1af8ea0f050c3f03a0a8c4e339589b7bb9180fc07f5

      SHA512

      7d5c4ea5c6f950a41bff386289df88b3f6d78444d7eeaa8a426569ce7698c2dfa916ae02d321af2be839c20e53b2ba9b3bb6a1573cad3b578733b082f0dc292f

    • memory/1920-6-0x0000000002970000-0x0000000002971000-memory.dmp

      Filesize

      4KB

    • memory/1920-3-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/1920-0-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/1920-5-0x0000000002130000-0x0000000002131000-memory.dmp

      Filesize

      4KB

    • memory/1920-8-0x00000000056C0000-0x00000000056C1000-memory.dmp

      Filesize

      4KB

    • memory/1920-7-0x0000000002B60000-0x0000000002B61000-memory.dmp

      Filesize

      4KB

    • memory/1920-14-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/1920-4-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/3812-25-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/3812-27-0x0000000002330000-0x0000000002331000-memory.dmp

      Filesize

      4KB

    • memory/3812-21-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/3812-47-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/3812-36-0x00000000043C0000-0x00000000043C1000-memory.dmp

      Filesize

      4KB

    • memory/3812-26-0x0000000000400000-0x000000000049C000-memory.dmp

      Filesize

      624KB

    • memory/4488-52-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

    • memory/4976-92-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-83-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-41-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-40-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-39-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-43-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-35-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-34-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-32-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-44-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-45-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-53-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-71-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-97-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-96-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-46-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-94-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-93-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-91-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-37-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-90-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-89-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-88-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-87-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-86-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-85-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-84-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-42-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-82-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-81-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-80-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-79-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-78-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-77-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-76-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-75-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-74-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-73-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-72-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-70-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-68-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-69-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-67-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-66-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-65-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-64-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-95-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-63-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-62-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-61-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-60-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/4976-168-0x0000000000400000-0x0000000000471000-memory.dmp

      Filesize

      452KB

    • memory/5060-9-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

    • memory/5060-11-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB

    • memory/5060-24-0x0000000000400000-0x0000000000407000-memory.dmp

      Filesize

      28KB