Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 07:15
Behavioral task
behavioral1
Sample
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
120 seconds
General
-
Target
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe
-
Size
116KB
-
MD5
78a2c00ce4d5fb7bfbc288cbfa7e0f70
-
SHA1
52a5f898b51aaf605865651761c9b114f562ab13
-
SHA256
596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0c
-
SHA512
13cc6e9a4c2573ad52873628f0e77b058de0979c790809626f0a18fd208c99ec29e4311ff61b76eacc6e0e49791213907668b2fb6e93f1926e97ee7e4655edee
-
SSDEEP
768:SKNsqwRwJuzpAJwctzIGV988SobokX/BuGXtQ:rPoMuduXVGTKB
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer\run 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\start = "C:\\Users\\Admin\\AppData\\Local\\Temp\\596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0005000000010300-2.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 2064 iebtmm.exe -
Loads dropped DLL 3 IoCs
pid Process 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25} 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\ 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe -
resource yara_rule behavioral1/memory/2468-0-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2468-4-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral1/files/0x0005000000010300-2.dat upx behavioral1/memory/2064-15-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/files/0x000b000000018617-12.dat upx behavioral1/memory/2468-16-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/2468-17-0x0000000010000000-0x0000000010009000-memory.dmp upx behavioral1/memory/2064-19-0x0000000000400000-0x0000000000407000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iebtmm.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\URL = "http://www.managesearches.com/index.php?b=1&t=0&q={searchTerms}" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\MenuText = "IE Anti-Spyware" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\Exec = "http://www.browseroption.com/redirect.php" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302} 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}\DisplayName = "Search" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Search 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{DAED9266-8C28-4C1C-8B58-5C66EFF1D302}" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{9034A523-D068-4BE8-A284-9DF278BE776E} 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25} 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\ddd = "ddd" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\InprocServer32 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iebt.dll" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D46BEAA4-A304-40B3-A9DA-EC7F7F501F25}\InprocServer32\ThreadingModel = "Apartment" 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 2064 iebtmm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2468 wrote to memory of 3064 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 30 PID 2468 wrote to memory of 3064 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 30 PID 2468 wrote to memory of 3064 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 30 PID 2468 wrote to memory of 3064 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 30 PID 2468 wrote to memory of 2064 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 31 PID 2468 wrote to memory of 2064 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 31 PID 2468 wrote to memory of 2064 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 31 PID 2468 wrote to memory of 2064 2468 596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe"C:\Users\Admin\AppData\Local\Temp\596414123494d8373f5a26cf4d911750dee632ff0d9373fe92175fda191a3a0cN.exe"1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe2⤵
- System Location Discovery: System Language Discovery
PID:3064
-
-
C:\Users\Admin\AppData\Local\Temp\iebtmm.exeC:\Users\Admin\AppData\Local\Temp\iebtmm.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5290d607432e59edc0c41c4ea4f6a522d
SHA1462c5ea60fe262798d854344ff8e8034c1585a8a
SHA256817da28848c815a9a573b4216405ccd83dead9e3b9b9d7e00b489c9f58d05c5a
SHA512af68500a90ade8880ebfb88f7dfd1bdf818fe697d8b7dbbd24ab5ecd714250c9533e77f59ee81cf80db2bfdb294f345a68f600ebb962c8f101af84e37bdba85f
-
Filesize
7KB
MD581280008268abe6d26217748960f7b73
SHA1a9c4c5bd7716505ed00357d9ec6f99c9abaee772
SHA2569c0b9cd8408bf933b35ca118f9d7407e8a177c929d5e883939cf67d2af27216b
SHA512555b72dff3f1e6e398c2c4a88ac05b3f9d341543748ebbfa145602a63be0c3521c3fddcf6964c66c7567b0763390dea1feb8c03a2a9c1b9927c2247806cdccce