Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 01:48
Behavioral task
behavioral1
Sample
d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe
Resource
win10v2004-20241007-en
General
-
Target
d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe
-
Size
88KB
-
MD5
43c6fd6fc51136632b47a8672de41034
-
SHA1
a22897d94f9d1ef123cbb1e372a619113327c214
-
SHA256
d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80
-
SHA512
f64b041b5a6afb4412496b526be0059814e4aac587764b36aa5b553ebe9d92533a162f484adc4b705853d65f59f262a91ad8888b84f6c1b7ac1099725fdd4e6a
-
SSDEEP
1536:dXNXdlRH+Dwk4cSGesvhC8plnQ85+HwClgfTQqPTFTCtOQ8CcfiWX:ddtlRH+UxGzh3HQ85+QqoTBfi6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2544 svchosts.exe -
resource yara_rule behavioral2/memory/3408-0-0x0000000000400000-0x0000000000431000-memory.dmp vmprotect behavioral2/memory/3408-1-0x0000000000400000-0x0000000000431000-memory.dmp vmprotect behavioral2/files/0x0008000000023c6d-7.dat vmprotect behavioral2/memory/2544-9-0x0000000000400000-0x0000000000431000-memory.dmp vmprotect behavioral2/memory/3408-67-0x0000000000400000-0x0000000000431000-memory.dmp vmprotect behavioral2/memory/2544-94-0x0000000000400000-0x0000000000431000-memory.dmp vmprotect -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\windows\svchosts.exe d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe File opened for modification C:\windows\svchosts.exe d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchosts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3157588233" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e39000000000200000000001066000000010000200000009c70f54014405554453b5242b3a64bc47e3eeefe044527e2510319099c68afcf000000000e8000000002000020000000a47534c45056f5f8c743e9995f0bfa5e1cd92ea780ba73829b0bb4539042bf7a200000000d95bc7125e4f6aea8da9cde04108d4dc1c311903889cc01f7dd83c6a504c257400000001cc70d6480c23e56d091a56271883bdeec06da0ff40d9e272bc281c4e25a97a9aac979852908da211ede71c502ce70e2f2653837a8db42b55e8c888dce50e7e8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E7C6A987-8C29-11EF-ADF2-EE81E66BE9E9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100fa4bd3620db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137846" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e39cbd3620db01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31137846" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3164306885" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31137846" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3157744368" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a43d217a0cb97a4db769f976d8642e39000000000200000000001066000000010000200000006663c5dc132f6a8a14f66db290ab6f9485b3bf692775244e8dc50f2ae5d0e831000000000e800000000200002000000065619fdce6566372f8eac5ce1dfb004939679bea1d3737b0b9b47c161b6485b220000000b0d39a26ce4c8538f383ca83d1d5c13ade51c0d5fb826a170cc80383c848a1e3400000006eb328adb52ab15a3873cbeb62e3aa04fe568cc464cca9aa0d7b663de3f8cac64d543a775e9b19cc730f9ad17919b367f962a7d54387ee8161fb0eecdde4da34 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435894683" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3408 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe 3408 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2032 iexplore.exe 2544 svchosts.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3408 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe 2544 svchosts.exe 2032 iexplore.exe 2032 iexplore.exe 4076 IEXPLORE.EXE 4076 IEXPLORE.EXE 4076 IEXPLORE.EXE 4076 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3408 wrote to memory of 2544 3408 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe 87 PID 3408 wrote to memory of 2544 3408 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe 87 PID 3408 wrote to memory of 2544 3408 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe 87 PID 3408 wrote to memory of 2032 3408 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe 88 PID 3408 wrote to memory of 2032 3408 d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe 88 PID 2032 wrote to memory of 4076 2032 iexplore.exe 89 PID 2032 wrote to memory of 4076 2032 iexplore.exe 89 PID 2032 wrote to memory of 4076 2032 iexplore.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe"C:\Users\Admin\AppData\Local\Temp\d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\windows\svchosts.exeC:\windows\svchosts.exe auto2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2544
-
-
C:\progra~1\Intern~1\iexplore.exeC:\\progra~1\\Intern~1\\iexplore.exe http://jianqiangzhe1.com/AddSetup.asp?id=137&localID=232138804165&isqq=32⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2032 CREDAT:17410 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4076
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
88KB
MD543c6fd6fc51136632b47a8672de41034
SHA1a22897d94f9d1ef123cbb1e372a619113327c214
SHA256d3b12c1d1dfa2df176c207781470303a234174fcb350cefa8ca11887d91f7a80
SHA512f64b041b5a6afb4412496b526be0059814e4aac587764b36aa5b553ebe9d92533a162f484adc4b705853d65f59f262a91ad8888b84f6c1b7ac1099725fdd4e6a