Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_adbd221c643d94913045e5b4d633af10.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
VirusShare_adbd221c643d94913045e5b4d633af10.dll
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_adbd221c643d94913045e5b4d633af10.dll
-
Size
88KB
-
MD5
adbd221c643d94913045e5b4d633af10
-
SHA1
92439678c776ef831f0e33af4e7f2d04b5f3902c
-
SHA256
08df087a486ed6ae86ae2d2eafe476a400687668eeabad569bd14972dbad3e84
-
SHA512
0183343909d25c4274245cd1c358a8909a5afc97f5a1d23d34ed798812d57fcfeeac5940dea21f9fb08663f39b5cdf64fed663ec835cbb35fbbe7f635ad18882
-
SSDEEP
1536:HaQF6r8YXJrswPTbRbyBI5eSpEurA+Gv4n2ZiHbEHFGCJeqsWnBJ:NYZfyBI58MAzQHao4
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 1408 rundll32.exe 556 rundll32.exe 3816 rundll32.exe 4804 rundll32.exe 2636 rundll32.exe 3772 rundll32.exe -
Loads dropped DLL 14 IoCs
pid Process 4656 rundll32.exe 4656 rundll32.exe 1408 rundll32.exe 1408 rundll32.exe 556 rundll32.exe 556 rundll32.exe 3816 rundll32.exe 3816 rundll32.exe 3772 rundll32.exe 3772 rundll32.exe 4804 rundll32.exe 4804 rundll32.exe 2636 rundll32.exe 2636 rundll32.exe -
resource yara_rule behavioral2/memory/4656-1-0x00000000014A0000-0x00000000014CB000-memory.dmp upx behavioral2/memory/4656-9-0x00000000014A0000-0x00000000014CE000-memory.dmp upx behavioral2/memory/1408-19-0x0000000000560000-0x000000000058B000-memory.dmp upx behavioral2/memory/4656-41-0x0000000003300000-0x000000000332E000-memory.dmp upx behavioral2/memory/1408-42-0x0000000000560000-0x000000000058E000-memory.dmp upx behavioral2/memory/556-43-0x0000000002670000-0x000000000269E000-memory.dmp upx behavioral2/memory/2636-45-0x0000000000F10000-0x0000000000F3E000-memory.dmp upx behavioral2/memory/3816-44-0x0000000000600000-0x000000000062E000-memory.dmp upx behavioral2/memory/4804-46-0x0000000000FF0000-0x000000000101E000-memory.dmp upx behavioral2/memory/3772-47-0x0000000000FE0000-0x000000000100E000-memory.dmp upx behavioral2/memory/4656-54-0x00000000014A0000-0x00000000014CB000-memory.dmp upx behavioral2/memory/4804-55-0x0000000000FF0000-0x000000000101E000-memory.dmp upx behavioral2/memory/3772-56-0x0000000000FE0000-0x000000000100E000-memory.dmp upx behavioral2/memory/1408-61-0x0000000000560000-0x000000000058B000-memory.dmp upx behavioral2/memory/4804-72-0x0000000000FF0000-0x000000000101E000-memory.dmp upx behavioral2/memory/3772-85-0x0000000000FE0000-0x000000000100E000-memory.dmp upx behavioral2/memory/3772-93-0x0000000000FE0000-0x000000000100E000-memory.dmp upx behavioral2/memory/3772-105-0x0000000000FE0000-0x000000000100E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\PROGRA~3\\rundll32.exe C:\\PROGRA~3\\brigi.dat,FG00" rundll32.exe -
Drops file in Program Files directory 9 IoCs
description ioc Process File created C:\PROGRA~3\igirb.pad rundll32.exe File opened for modification C:\PROGRA~3\igirb.pad rundll32.exe File created C:\PROGRA~3\igirb.js rundll32.exe File created C:\PROGRA~3\igirb.bat rundll32.exe File created C:\PROGRA~3\igirb.reg rundll32.exe File created C:\PROGRA~3\rundll32.exe rundll32.exe File created C:\PROGRA~3\brigi.dat rundll32.exe File opened for modification C:\PROGRA~3\igirb.pad rundll32.exe File created C:\PROGRA~3\as98213.txt rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" rundll32.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1CD6C7B7-2774-11EF-BCA5-CEC6030110C3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424218391" iexplore.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 548 iexplore.exe 548 iexplore.exe 548 iexplore.exe 548 iexplore.exe 548 iexplore.exe 548 iexplore.exe 548 iexplore.exe 548 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 548 iexplore.exe 548 iexplore.exe 4604 IEXPLORE.EXE 4604 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1924 wrote to memory of 4656 1924 rundll32.exe 81 PID 1924 wrote to memory of 4656 1924 rundll32.exe 81 PID 1924 wrote to memory of 4656 1924 rundll32.exe 81 PID 4656 wrote to memory of 1408 4656 rundll32.exe 85 PID 4656 wrote to memory of 1408 4656 rundll32.exe 85 PID 4656 wrote to memory of 1408 4656 rundll32.exe 85 PID 1408 wrote to memory of 556 1408 rundll32.exe 86 PID 1408 wrote to memory of 556 1408 rundll32.exe 86 PID 1408 wrote to memory of 556 1408 rundll32.exe 86 PID 1408 wrote to memory of 3816 1408 rundll32.exe 87 PID 1408 wrote to memory of 3816 1408 rundll32.exe 87 PID 1408 wrote to memory of 3816 1408 rundll32.exe 87 PID 1408 wrote to memory of 2636 1408 rundll32.exe 88 PID 1408 wrote to memory of 2636 1408 rundll32.exe 88 PID 1408 wrote to memory of 2636 1408 rundll32.exe 88 PID 1408 wrote to memory of 4804 1408 rundll32.exe 89 PID 1408 wrote to memory of 4804 1408 rundll32.exe 89 PID 1408 wrote to memory of 4804 1408 rundll32.exe 89 PID 1408 wrote to memory of 3772 1408 rundll32.exe 90 PID 1408 wrote to memory of 3772 1408 rundll32.exe 90 PID 1408 wrote to memory of 3772 1408 rundll32.exe 90 PID 2636 wrote to memory of 548 2636 rundll32.exe 91 PID 2636 wrote to memory of 548 2636 rundll32.exe 91 PID 548 wrote to memory of 4604 548 iexplore.exe 92 PID 548 wrote to memory of 4604 548 iexplore.exe 92 PID 548 wrote to memory of 4604 548 iexplore.exe 92 PID 2636 wrote to memory of 548 2636 rundll32.exe 91 PID 2636 wrote to memory of 548 2636 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VirusShare_adbd221c643d94913045e5b4d633af10.dll,#12⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG003⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG014⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556
-
-
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG024⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:3816
-
-
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG034⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:548 CREDAT:17410 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4604
-
-
-
-
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG044⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4804
-
-
C:\PROGRA~3\rundll32.exeC:\PROGRA~3\rundll32.exe C:\PROGRA~3\brigi.dat,FG064⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3772
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5adbd221c643d94913045e5b4d633af10
SHA192439678c776ef831f0e33af4e7f2d04b5f3902c
SHA25608df087a486ed6ae86ae2d2eafe476a400687668eeabad569bd14972dbad3e84
SHA5120183343909d25c4274245cd1c358a8909a5afc97f5a1d23d34ed798812d57fcfeeac5940dea21f9fb08663f39b5cdf64fed663ec835cbb35fbbe7f635ad18882
-
Filesize
60KB
MD5889b99c52a60dd49227c5e485a016679
SHA18fa889e456aa646a4d0a4349977430ce5fa5e2d7
SHA2566cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
SHA51208933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641