09c91862d6e40c74f6edc233440b5f691d498ede6fb00bb43d309ca24e4e67b9

Analysis

max time kernel
837s
max time network
840s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Size

293KB
MD5

dbc292a2292c6061700236830d45ca91
SHA1

fcdfba4b95c145a715209d694639de6be0478f6b
SHA256

e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60
SHA512

551e097fb31a5e7a6b6ecf602f7ae8cb63dc620940fe47b003ebcafcedbfdb391731cfce399b48111ee9524f2272f53eb4076c84f65e377336930fd6b3c3e0fe
SSDEEP

6144:6qcbmoTtMUxxzP75a2eoEnnZcYupty6DPlQ82hmbN:6NTTyUX/5a2NGZcTs6DPlahmbN

Score

10^/10

aspackv2 discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe ,C:\\Windows\\system32\\PnkB.exe"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\SysWOW64\PnkB.exe	aspack_v212_v242

Drops file in System32 directory 3 IoCs

Processes:

e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe

description	ioc	process
File created	C:\Windows\SysWOW64\pp.exe	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
File opened for modification	C:\Windows\SysWOW64\pp.exe	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
File opened for modification	C:\Windows\SysWOW64\PnkB.exe	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exeregedit.execmd.execmd.execacls.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exeregedit.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	regedit.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Version Vector	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.185b.com/"	regedit.exe

Modifies registry class 23 IoCs

Processes:

e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\ÊôÐÔ(&R)	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\open\ = "´ò¿ªÖ÷Ò³(&H)"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell\open\command	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\ = "Internet Explorer"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shellex	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\InprocServer32\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\InprocServer32\InprocServer32 = "Apartment"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell\ÊôÐÔ(&R)\Command	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\ShellFolder\Attributes = "0"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\DefaultIcon	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\open\command	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\open\command\ = "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe http://www.185B.Com/"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell\ÊôÐÔ(&R)	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\ÊôÐÔ(&R)\ = "ÊôÐÔ(&R)"	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\InprocServer32	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\Shell\open	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E188F7A3-A04E-413E-99D1-D79A45F78506}\shell\open	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe

Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

2492 regedit.exe

pid	process
2492	regedit.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.execmd.exe

description	pid	process	target process
PID 2488 wrote to memory of 2492	2488	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe	regedit.exe
PID 2488 wrote to memory of 2492	2488	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe	regedit.exe
PID 2488 wrote to memory of 2492	2488	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe	regedit.exe
PID 2488 wrote to memory of 2492	2488	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe	regedit.exe
PID 2488 wrote to memory of 2968	2488	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe	cmd.exe
PID 2488 wrote to memory of 2968	2488	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe	cmd.exe
PID 2488 wrote to memory of 2968	2488	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe	cmd.exe
PID 2488 wrote to memory of 2968	2488	e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe	cmd.exe
PID 2968 wrote to memory of 3064	2968	cmd.exe	cmd.exe
PID 2968 wrote to memory of 3064	2968	cmd.exe	cmd.exe
PID 2968 wrote to memory of 3064	2968	cmd.exe	cmd.exe
PID 2968 wrote to memory of 3064	2968	cmd.exe	cmd.exe
PID 2968 wrote to memory of 2856	2968	cmd.exe	cacls.exe
PID 2968 wrote to memory of 2856	2968	cmd.exe	cacls.exe
PID 2968 wrote to memory of 2856	2968	cmd.exe	cacls.exe
PID 2968 wrote to memory of 2856	2968	cmd.exe	cacls.exe

C:\Users\Admin\AppData\Local\Temp\e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe
"C:\Users\Admin\AppData\Local\Temp\e60fc4473ada26f3a8d2dd5c5f226441073bf86737e271f6f2ec61324ef9ab60.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s "C:\Users\Admin\AppData\Local\Temp\\\15.ini"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Runs regedit.exe
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\srun53.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3064
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\╞⌠╢» Internet Explorer Σ»└└╞≈.lnk" /G Everyone:R /C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\15.ini

Filesize
139B

MD5
bb454b063043f484326575ce60d587c1

SHA1
cac3171df8fc25526a82356ed53f1c45a86167be

SHA256
838a54026108ff550f5d3c425cf7852abea41882590863e423cf9e94573dc11f

SHA512
8c86e46eea787025937204f93738c02f1d5268c19e20126d86df5f1bb3d15367935b3f23e5c6c482b462ac79dbbcc87b38a952a3a8567bf9a3cff2a68ab92099

Download Submit
C:\Users\Admin\AppData\Local\Temp\srun53.bat

Filesize
191B

MD5
da809eaf662b3b9d6482da20eb08e7fa

SHA1
9b608f6e10c1ec7f806914eaeefe4e0c63782bfa

SHA256
75f20029163a3e315c6138ad7a0c5fef99101ba4908d7e99b360933991d8802f

SHA512
6d7acf625e237f1ae8e636d2902fbc1085ca9a965c15973a77154beefcc30104a58e6351cdc284a8e151b3aca812e0073d60e0c4ff9865dcd7c6faf2e83b7005

Download Submit
C:\Windows\SysWOW64\PnkB.exe

Filesize
293KB

MD5
5f950468776e1457e4e85f9bb6a4cbc4

SHA1
79bc0bfdf32e865e375cec9d7e076bb179f17b64

SHA256
fddcb3697b81a5aff4c294744fb013691c804107014045b257b1e31af7e65b7e

SHA512
5a066558380718f07ea3ba037e17b546227a4616e72537910b8196e550178653715850c103547153802d692be7c6dcc29c2c93740b9e7c5242e05c3c0f5f01f4

Download Submit
memory/2488-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2488-22-0x0000000000400000-0x00000000004C8000-memory.dmp

Filesize
800KB

Download