Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 21:54

General

  • Target

    VirusShare_adbd221c643d94913045e5b4d633af10.dll

  • Size

    88KB

  • MD5

    adbd221c643d94913045e5b4d633af10

  • SHA1

    92439678c776ef831f0e33af4e7f2d04b5f3902c

  • SHA256

    08df087a486ed6ae86ae2d2eafe476a400687668eeabad569bd14972dbad3e84

  • SHA512

    0183343909d25c4274245cd1c358a8909a5afc97f5a1d23d34ed798812d57fcfeeac5940dea21f9fb08663f39b5cdf64fed663ec835cbb35fbbe7f635ad18882

  • SSDEEP

    1536:HaQF6r8YXJrswPTbRbyBI5eSpEurA+Gv4n2ZiHbEHFGCJeqsWnBJ:NYZfyBI58MAzQHao4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 13 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 9 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2292
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\PROGRA~3\rundll32.exe
        C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG00
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2128
        • C:\PROGRA~3\rundll32.exe
          C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG01
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2676
        • C:\PROGRA~3\rundll32.exe
          C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG02
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          PID:2548
        • C:\PROGRA~3\rundll32.exe
          C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG03
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer Protected Mode
          • Modifies Internet Explorer Protected Mode Banner
          • Modifies Internet Explorer settings
          • Suspicious use of WriteProcessMemory
          PID:2704
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe"
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2180
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:2880
            • C:\Windows\system32\ctfmon.exe
              ctfmon.exe
              6⤵
                PID:2636
          • C:\PROGRA~3\rundll32.exe
            C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG04
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2720
          • C:\PROGRA~3\rundll32.exe
            C:\PROGRA~3\rundll32.exe C:\PROGRA~3\jefobq.dat,FG06
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2508

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            97bb751c2dd003809c40de956f852fb6

            SHA1

            c959f094fbdf82b6c54151ff4314a0e96d27a244

            SHA256

            28bc258acafab51c2bda43c68dfa7b209d1c0b884031598a368c301ad4d9650b

            SHA512

            1d852934c41272bfae0bac26cc3ff4da7bdcce34acb39583d737f9ef4fa6859d6bb180d94f1bd90578a0ed5654bc38c970822dd0096a67f4608d5aa7b06c46e8

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c7708f464790db0783821a73b0225fce

            SHA1

            51d6e2a1dbb8b12f2bfaa0540bbbc69c158de208

            SHA256

            7ad1cae0b258d4e5bb219248f299dd54341664163f869b0b959eaeaf01251b68

            SHA512

            ae8115ba260d46c775480579867d835da1c06779a5ac7264fb03e5ea37235e1d93af35031d2fec53b135863ae8ef9a8b087d20f8bf528ee0268cf09a27ad12b1

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            9270b71c72a0668b88b945a7b131a1b8

            SHA1

            70f0c2c7bb4ac1841d73832de99981a758613040

            SHA256

            681fcc27a77516b88c6226df2c9f04cdd2213e0139ae9ea8b8ed62b13cf96629

            SHA512

            47f5aeb57bb95eaaf02d45e162a34c2456e1ed4331d03e76a52887fef1dc4fb921c1cc94c3122c046274c1e72ecbafe99d7bfd82359a59436563223cee9eacc2

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            baadbdc3ccbd49e4f7729c525ff77d91

            SHA1

            31431bcda882da14f065558378e290252be6bdea

            SHA256

            95754a1758a8be69c5e105bc93fb05dcf9d8eb3737e1cce2459512975d0cc7de

            SHA512

            1fc71565dc8f52a496b88b77069b02f229c603ff0465ab68309882796343508649c55a00cce4337d56a5d531c8fd21bcba88b44729a92ae797840f7fc3af3151

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            c9492ade78d20b181feef176a6a57744

            SHA1

            45892163aa9cfe3a66645c81a0b56030c76b5cca

            SHA256

            fe11b0039c868c3bb5da6ef02a5c3d4cda05ff0e14b159a44d9e92a40118740f

            SHA512

            73a0b7b8b0e1cb4d686215bda5c324c2173e8c5ecf34413898d91209e203814a2129ea14cd9d5853ec06122617921021b0b27ea7471042d9ef0a8273ac9476e5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            cef708b6d68c900a4c8cc1983f16eed0

            SHA1

            86a06609b7222cea36cf2a76e069b37b47ed9cec

            SHA256

            c0a7bb26be1fb14db505bbb9be4e08d1719b842c9625fbbd291c815fe84b4552

            SHA512

            e8b7b9bb1b4645d2a0138e6c7e8ebb0ce193df26d37e034fe6471bb786bb2a6a9b953af5d4581580671fa8af673924f7bcd244e68a738094f5287df794cffa65

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            42a113011ccbd6f2f16e6bc1f727485e

            SHA1

            5c9bc8d517a0742165d1862f4aec9323afa62dd5

            SHA256

            ed3970f35e5d59e506708b3e4770de9030ca43694740998829c575a3ee54d106

            SHA512

            af782b544fa33fba8614530fb00f0ee7c7e16b4a50f3b034e170171fa3ad3c7886f528e19350bb7cb9ef8bbc9ddf6c92b1d871645e9c5c3d1ab1b743c66728f4

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            6dd7dcef5dcc1add4f560ab88b815056

            SHA1

            92d9e047704947223f7f53712b9014a631c20eba

            SHA256

            d98f3046426a5354bffac3a3fa720e1ca1e8b0fbebfcade9e03e6a3961608d55

            SHA512

            f1d1028ad6f8894b5d2b232f13875f2c6c1889df99da549eceb9935e34f6657d849ca288de5c13e11dbb9bd59d135c2574757b7522cedc9b83ec5593f1092cf9

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            84c2f3887f8f6cceb31af93942f90072

            SHA1

            a34b7fc8bdf84fb6a3bc1b8112bb97b8706d4340

            SHA256

            216465db0020f876d7cd1ab34b667d4f031ea1b7de47fa3df55ad7b3e6674be7

            SHA512

            5834a22b59fd01daaec99e4be385776a68827086ea69fab4dff1d336a212b4f3823eaa728f6f1125a208022d9a8692dfa3c440280d9088d8f962827d4e18dcdb

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            6392379d405314a811fe41b18ef0d241

            SHA1

            a1b28499051331964cc554c77c7903b8b5aa4f2a

            SHA256

            3dc361a80a8ceeb3930c3939ccb2c101a279a632c33fc22787099a0249efdff7

            SHA512

            81a7dee67187bb7b9d86fbba938608371179a70d81815d774ca37f1d32300e6a864ab62f96dd4b3c3b84bfcdc217e71c7ba2f1e58a947d4c61692f2b88de9807

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            1f7392f3373aed97f0ec8c3a21c2b657

            SHA1

            fef1386984fc2549b7bfec8f89bd64e0f30deae9

            SHA256

            323279bc5141df31d0ed73a00bb9963fc911cd486f37a41584c4b246535daa73

            SHA512

            3b29dc0918b66db7532de191a65eb4e496b4a0333501ccaee8dee8c5d3649f492609730fc15abc2e641bb9cf45ad67581ea768c93e632a07a9429b8a080f582d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            0c009258244f92f29743636970e6de34

            SHA1

            4af45d64dbe716a27f9795e8b23beac27cd0c630

            SHA256

            44448e1e7a7e917449030dbc74f8329a4185b9a33cd7c1052f2e1a0430686a31

            SHA512

            0efdce2eaa1c18dbc46349ab021b0c7163cf174ed314242bc7006966ff510d5dda5ec31caf6d86500a0a27894519acc8c415b6af34c7e4d74e19d62511d1bac6

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            342e99230b6169818222a85024fc1bc5

            SHA1

            b83eabb81e6b4ab6085ae72cc68811ea4999726d

            SHA256

            a5cf37951b5edc5582496e133a915bc86152ee98b8615df0955625e3a936d9fa

            SHA512

            45c1a75e72975cb4082fc9e0554588391522447627664c630def0b4344eb51dea077ff2c5348e474fd99f20c383926ac7700ab81747e6dd63b891081bc6ceaef

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            4580772d1b3c9739747a5e7ea918b870

            SHA1

            107e11b42afa085fb03d59d433e749a851615890

            SHA256

            4dc6d252c90d3a619c9f20fceef4dbf0ae3094603bd34d4187c8121df94a6dea

            SHA512

            ef7fd6389c939bd97e6c2f4010bb3c21083acffab2b72d4fb6476f846c78198738c1399a01e079840f5abc43b543484cbdb8e8ffce5628aac5d0f1e0aa9a2793

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            f2433d5ba95f00fb60a20088de72ebfc

            SHA1

            3f8e865d38eabcde46936f20083e3107362a9e09

            SHA256

            9794e76f40fd1b2e0fb7ce8484d88e6460f7ff1ead24b738f194343939af3180

            SHA512

            3fa9dd14de6ed0f0f168ffef75b3b6e53d747a012551d199a5b1239ff975f67812d3b331bfd5d40314b07dd9cfffe2ac76e6085f445c2d70f6de88d6803386a5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            508cd1e866e059a3a1b38061503e07fa

            SHA1

            5192de1ae8f2d440ee4a568b671b1149f93ba7bd

            SHA256

            3ac4723f4c46e4258f2045afcfa8f6ccbcfedea25fc2ab9f4b02afc222f407bd

            SHA512

            b9a01da0695afc1293cc5534b9cdb415af549d8be808e41f936d9d2a075d6c23ba87e32bc30a3d23e6832ab15af5c9fd3033202fde1852281176190ea99fc13c

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            3824d50dea21e8d41198396ffb2e782a

            SHA1

            608ae9dfcb6693d945f4721bee46b36460c2b1be

            SHA256

            e84a22b07169e555eafccdc5e5c005d5ed377a1edfba9e87d92cb535afce17e1

            SHA512

            ad79926f7f95624af6e784fe67db9321ac26bd04518027d55704a264c212525ab8e6ae48e2fedacc0a7d9a022cc8743ce3b58c13d7a2fbd2a4a6c8a9a643deeb

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            34986808a3f730e01aa8482e4150fa29

            SHA1

            cfa08f2ad62ca787267e58857c79da89f2bf64d8

            SHA256

            48e772b493f4e80cf4877f4a83fde0443044d6632fba4980b8f3f8a0e49d468d

            SHA512

            428a507859f26bee5e5833a3e5460b2d438d749a87f2da4e3cf67ad72a8291152a69f10f590b7ab10b6d239d94a1a345234a5eb89a6b1e70b1b4b03abe25803d

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            342B

            MD5

            7c8f2bd6d5533671eb11c16fe7f11cc5

            SHA1

            3ad0f7c1a03d7eb5d2d810d24f509a40076a7e89

            SHA256

            6f62a12db8e4f319c1794873c16f2a97e146a0cf9594f0c309233b96c2a97066

            SHA512

            9841c3d52bf81bd221cf196f7c65871bc7fc9977b3b912a91ece61f5d2234468d42815abeed39255e00b11f3963929c99588c2c0c8b2177412d9a6a93cbd7617

          • C:\Users\Admin\AppData\Local\Temp\Cab5CC1.tmp

            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          • C:\Users\Admin\AppData\Local\Temp\Tar5DD3.tmp

            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          • \PROGRA~3\jefobq.dat

            Filesize

            88KB

            MD5

            adbd221c643d94913045e5b4d633af10

            SHA1

            92439678c776ef831f0e33af4e7f2d04b5f3902c

            SHA256

            08df087a486ed6ae86ae2d2eafe476a400687668eeabad569bd14972dbad3e84

            SHA512

            0183343909d25c4274245cd1c358a8909a5afc97f5a1d23d34ed798812d57fcfeeac5940dea21f9fb08663f39b5cdf64fed663ec835cbb35fbbe7f635ad18882

          • \PROGRA~3\rundll32.exe

            Filesize

            43KB

            MD5

            51138beea3e2c21ec44d0932c71762a8

            SHA1

            8939cf35447b22dd2c6e6f443446acc1bf986d58

            SHA256

            5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

            SHA512

            794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

          • memory/2128-530-0x0000000000210000-0x000000000023B000-memory.dmp

            Filesize

            172KB

          • memory/2128-529-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/2128-17-0x0000000000210000-0x000000000023B000-memory.dmp

            Filesize

            172KB

          • memory/2128-16-0x0000000000240000-0x0000000000241000-memory.dmp

            Filesize

            4KB

          • memory/2128-42-0x0000000000210000-0x000000000023E000-memory.dmp

            Filesize

            184KB

          • memory/2508-1037-0x0000000000210000-0x000000000023E000-memory.dmp

            Filesize

            184KB

          • memory/2508-547-0x0000000000210000-0x000000000023E000-memory.dmp

            Filesize

            184KB

          • memory/2508-1047-0x0000000000210000-0x000000000023E000-memory.dmp

            Filesize

            184KB

          • memory/2508-218-0x0000000000210000-0x000000000023E000-memory.dmp

            Filesize

            184KB

          • memory/2508-1052-0x0000000000210000-0x000000000023E000-memory.dmp

            Filesize

            184KB

          • memory/2720-536-0x0000000000200000-0x000000000022E000-memory.dmp

            Filesize

            184KB

          • memory/2720-217-0x0000000000200000-0x000000000022E000-memory.dmp

            Filesize

            184KB

          • memory/2760-6-0x0000000000180000-0x00000000001AE000-memory.dmp

            Filesize

            184KB

          • memory/2760-525-0x0000000000180000-0x00000000001AB000-memory.dmp

            Filesize

            172KB

          • memory/2760-524-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2760-2-0x0000000000180000-0x00000000001AB000-memory.dmp

            Filesize

            172KB

          • memory/2760-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

            Filesize

            4KB

          • memory/2760-41-0x0000000000370000-0x000000000039E000-memory.dmp

            Filesize

            184KB