Analysis
-
max time kernel
139s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 03:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77810.exe
Resource
win7-20240220-en
7 signatures
150 seconds
General
-
Target
77810.exe
-
Size
94KB
-
MD5
f93b32527bf4a3336aaf723e3843e167
-
SHA1
1eff6bc9d4071208e5c27e3d888b841b77821504
-
SHA256
773dba4375f27e9444e7c51755b6d070d3c18fce223e5a52d37f173563b16290
-
SHA512
e32e08a55b188b40ee0c4de9b823a6d176323c6a99c9522869d4350eaaa5c068a99dc9d38f1c850f043ade9518f30e31f4dc25c0adf403deb74382a97e6d8c05
-
SSDEEP
1536:WnnFGOHtnmJXRDB3EZTz71YvUAGjztobIu+Vh/QRFBAw1:WTYXRgbjCbb+D/QRFBZ
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
iconspack.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat iconspack.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 25 IoCs
Processes:
iconspack.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings iconspack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{99310438-B89D-44F4-9043-9D8A286E96A5}\WpadDecision = "0" iconspack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0126000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iconspack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{99310438-B89D-44F4-9043-9D8A286E96A5}\WpadDecisionTime = 606b2a9fbeacda01 iconspack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iconspack.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix iconspack.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" iconspack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iconspack.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{99310438-B89D-44F4-9043-9D8A286E96A5} iconspack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" iconspack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-43-e2-51-6e-0a\WpadDecisionReason = "1" iconspack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-43-e2-51-6e-0a\WpadDecisionTime = 8006a24ebeacda01 iconspack.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" iconspack.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings iconspack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0126000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iconspack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{99310438-B89D-44F4-9043-9D8A286E96A5}\WpadDecisionReason = "1" iconspack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{99310438-B89D-44F4-9043-9D8A286E96A5}\WpadDecisionTime = 8006a24ebeacda01 iconspack.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-43-e2-51-6e-0a\WpadDecision = "0" iconspack.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{99310438-B89D-44F4-9043-9D8A286E96A5}\WpadNetworkName = "Network 2" iconspack.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-43-e2-51-6e-0a iconspack.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-43-e2-51-6e-0a\WpadDecisionTime = 606b2a9fbeacda01 iconspack.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections iconspack.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad iconspack.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{99310438-B89D-44F4-9043-9D8A286E96A5}\ca-43-e2-51-6e-0a iconspack.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-43-e2-51-6e-0a\WpadDetectedUrl iconspack.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
77810.exe77810.exeiconspack.exeiconspack.exepid process 2088 77810.exe 2788 77810.exe 2604 iconspack.exe 2724 iconspack.exe 2724 iconspack.exe 2724 iconspack.exe 2724 iconspack.exe 2724 iconspack.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
77810.exepid process 2788 77810.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
77810.exeiconspack.exedescription pid process target process PID 2088 wrote to memory of 2788 2088 77810.exe 77810.exe PID 2088 wrote to memory of 2788 2088 77810.exe 77810.exe PID 2088 wrote to memory of 2788 2088 77810.exe 77810.exe PID 2088 wrote to memory of 2788 2088 77810.exe 77810.exe PID 2604 wrote to memory of 2724 2604 iconspack.exe iconspack.exe PID 2604 wrote to memory of 2724 2604 iconspack.exe iconspack.exe PID 2604 wrote to memory of 2724 2604 iconspack.exe iconspack.exe PID 2604 wrote to memory of 2724 2604 iconspack.exe iconspack.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77810.exe"C:\Users\Admin\AppData\Local\Temp\77810.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\77810.exe"C:\Users\Admin\AppData\Local\Temp\77810.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\iconspack.exe"C:\Windows\SysWOW64\iconspack.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\iconspack.exe"C:\Windows\SysWOW64\iconspack.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2088-6-0x0000000000280000-0x0000000000290000-memory.dmpFilesize
64KB
-
memory/2088-5-0x00000000001E0000-0x00000000001ED000-memory.dmpFilesize
52KB
-
memory/2088-4-0x0000000000270000-0x000000000027D000-memory.dmpFilesize
52KB
-
memory/2088-0-0x0000000000270000-0x000000000027D000-memory.dmpFilesize
52KB
-
memory/2088-14-0x00000000001E0000-0x00000000001ED000-memory.dmpFilesize
52KB
-
memory/2604-19-0x00000000001F0000-0x00000000001FD000-memory.dmpFilesize
52KB
-
memory/2604-29-0x00000000001E0000-0x00000000001ED000-memory.dmpFilesize
52KB
-
memory/2604-21-0x0000000000280000-0x0000000000290000-memory.dmpFilesize
64KB
-
memory/2604-20-0x00000000001E0000-0x00000000001ED000-memory.dmpFilesize
52KB
-
memory/2604-15-0x00000000001F0000-0x00000000001FD000-memory.dmpFilesize
52KB
-
memory/2724-28-0x0000000000330000-0x0000000000340000-memory.dmpFilesize
64KB
-
memory/2724-26-0x0000000000320000-0x000000000032D000-memory.dmpFilesize
52KB
-
memory/2724-22-0x0000000000320000-0x000000000032D000-memory.dmpFilesize
52KB
-
memory/2724-27-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/2724-32-0x0000000000310000-0x000000000031D000-memory.dmpFilesize
52KB
-
memory/2788-12-0x00000000001E0000-0x00000000001ED000-memory.dmpFilesize
52KB
-
memory/2788-13-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/2788-7-0x0000000000280000-0x000000000028D000-memory.dmpFilesize
52KB
-
memory/2788-11-0x0000000000280000-0x000000000028D000-memory.dmpFilesize
52KB
-
memory/2788-30-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2788-31-0x00000000001E0000-0x00000000001ED000-memory.dmpFilesize
52KB