Overview
overview
10Static
static
3INQUIRY 20...20.exe
windows7-x64
10INQUIRY 20...20.exe
windows10-2004-x64
7$APPDATA/s...DH.dll
windows7-x64
1$APPDATA/s...DH.dll
windows10-2004-x64
1$APPDATA/s...ui.dll
windows7-x64
1$APPDATA/s...ui.dll
windows10-2004-x64
1$APPDATA/s...sX.exe
windows7-x64
1$APPDATA/s...sX.exe
windows10-2004-x64
1$APPDATA/s...60.dll
windows7-x64
1$APPDATA/s...60.dll
windows10-2004-x64
1$APPDATA/s...cl.dll
windows7-x64
3$APPDATA/s...cl.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$TEMP/Barracoon.dll
windows7-x64
3$TEMP/Barracoon.dll
windows10-2004-x64
3$TEMP/alum...60.dll
windows7-x64
1$TEMP/alum...60.dll
windows10-2004-x64
1$TEMP/alum...xy.exe
windows7-x64
3$TEMP/alum...xy.exe
windows10-2004-x64
3$TEMP/alum...gP.dll
windows7-x64
3$TEMP/alum...gP.dll
windows10-2004-x64
3$TEMP/alum...ap.dll
windows7-x64
1$TEMP/alum...ap.dll
windows10-2004-x64
1$TEMP/map/...60.dll
windows7-x64
1$TEMP/map/...60.dll
windows10-2004-x64
1$TEMP/map/...ip.dll
windows7-x64
8$TEMP/map/...ip.dll
windows10-2004-x64
8$TEMP/refe...80.dll
windows7-x64
1$TEMP/refe...80.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
27-08-2024 04:29
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY 200609-07_06_2020.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
INQUIRY 200609-07_06_2020.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$APPDATA/simpleLogin/ear/jbimpui.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$APPDATA/simpleLogin/ear/jbimpui.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$APPDATA/simpleLogin/ear/resToResX.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$APPDATA/simpleLogin/ear/resToResX.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$APPDATA/speakers/manifest/74.opends60.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$APPDATA/speakers/manifest/74.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$APPDATA/speakers/manifest/edbgcl.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$APPDATA/speakers/manifest/edbgcl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/advsplash.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$TEMP/Barracoon.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
$TEMP/Barracoon.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$TEMP/alumni_reunions/calendars/retail/almap.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$TEMP/alumni_reunions/calendars/retail/almap.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$TEMP/map/clickheat/documents/74.opends60.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
$TEMP/map/clickheat/documents/74.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$TEMP/map/clickheat/documents/msisip.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
$TEMP/map/clickheat/documents/msisip.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$TEMP/referral/msvcrt80.dll
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
$TEMP/referral/msvcrt80.dll
Resource
win10v2004-20240802-en
General
-
Target
$TEMP/map/clickheat/documents/msisip.dll
-
Size
15KB
-
MD5
da23a12845607133acf1db3502d4e575
-
SHA1
3808f3a44ffb3b2bdb7a5e57c650b0a96cd52b5f
-
SHA256
cacbc2940693d704d489f90015d24a01ec509b426bd96febc1852131a53977b8
-
SHA512
8b0d6a3598d4bb6b4dd061d6ad1c56c1dc8fcad5047e5c484c9b85a9698e52029cd0d873dbe8c74bcb53e6d61750fbb616f1c9e6f8ecebb82367d9e73a14ba1b
-
SSDEEP
192:tF8MmFDXLSPZdLzAfbkKIcY7HvqAdsiLuvRzJhaSjocS0xY0Yrk26Ab8WQn:tqvFDXmPZN+/IcY7HyniCRa4IIYvGWQ
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 12 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}\Dll = "MSISIP.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}\FuncName = "MsiSIPGetSignedDataMsg" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}\FuncName = "MsiSIPRemoveSignedDataMsg" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{000C10F1-0000-0000-C000-000000000046}\Dll = "MSISIP.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}\Dll = "MSISIP.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}\FuncName = "MsiSIPVerifyIndirectData" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{000C10F1-0000-0000-C000-000000000046}\FuncName = "MsiSIPIsMyTypeOfFile" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}\FuncName = "MsiSIPPutSignedDataMsg" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}\Dll = "MSISIP.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{000C10F1-0000-0000-C000-000000000046}\Dll = "MSISIP.DLL" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{000C10F1-0000-0000-C000-000000000046}\FuncName = "MsiSIPCreateIndirectData" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}\Dll = "MSISIP.DLL" regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
regsvr32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
regsvr32.exedescription pid process target process PID 904 wrote to memory of 1840 904 regsvr32.exe regsvr32.exe PID 904 wrote to memory of 1840 904 regsvr32.exe regsvr32.exe PID 904 wrote to memory of 1840 904 regsvr32.exe regsvr32.exe PID 904 wrote to memory of 1840 904 regsvr32.exe regsvr32.exe PID 904 wrote to memory of 1840 904 regsvr32.exe regsvr32.exe PID 904 wrote to memory of 1840 904 regsvr32.exe regsvr32.exe PID 904 wrote to memory of 1840 904 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\$TEMP\map\clickheat\documents\msisip.dll1⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\$TEMP\map\clickheat\documents\msisip.dll2⤵
- Manipulates Digital Signatures
- System Location Discovery: System Language Discovery
PID:1840