Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 04:37
Static task
static1
Behavioral task
behavioral1
Sample
51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe
Resource
win7-20240508-en
General
-
Target
51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe
-
Size
2.6MB
-
MD5
5e1bdb42ba791951c91fd7d3dfc7cf70
-
SHA1
b9fed0cf7ef7a9e5232c4a24acd60e9901234ad4
-
SHA256
51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467
-
SHA512
f7de506c97ddbef58e2e59f7ee9cfc42d2499a83d801108677abcb7aefdf6821e843ac61796a29fc63fbd3adc77d4e94a9d51aeefd5d52fc291a05c7a7742ada
-
SSDEEP
24576:+A8vyrepIND/0bfSPdaYXRFT3KR+h+8fEvdDrGnrdEROGHOhdYiWdCMJ5QxlpYCi:+A81IJPf1lEvdDqnroHOwiW0MbQxJHO
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exedescription ioc process File opened (read-only) \??\O: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\P: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\W: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\A: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\G: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\J: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\L: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\V: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\I: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\M: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\N: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\R: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\U: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\X: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\Z: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\Q: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\S: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\T: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\Y: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\B: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\E: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\H: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe File opened (read-only) \??\K: 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000020ff7ae79b75756f4ca702377475b98fa0ddd68a62cd31de8255e8ed77b01e06000000000e80000000020000200000003fb4cd3f44499d9c53190c7e9cfb6e5ffc623e51068337cb68fef590018d8350200000002e3588e3cc8a167f5cd2e559eeaacf95d19e43649abe89e8eebb961f211c834a400000001ce4f727a8d2dba448486a1e2168fe3bca89d624e224a286cbe11048f73467dff9ce8902e235d9bd7b1afa1f86043a1e9c5f90314567c31ed5ca61f5ccbef23f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425970581" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B874F791-3763-11EF-8962-7678A7DAE141} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104a089e70cbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000030e2fb83b78a7bc601a4e53ebbf201795b41863aa7fdd874bf6c760e559b0cde000000000e8000000002000020000000ce4f86e10b028c737a07072b42e8bcc4889c97ad50da0b43883255339555960f9000000013e1114d0f432254446a87676ee43acea5b035f7c64fda2b111c4fbabfc77b8021ef1e8df60dcdb47c13ba90c08d60c2659d31ec138602a0dc9da1a24b450d261f0299e1ef3097b8773cf408f6420cb2cdde09e92b8296b6b69b149fa3b84623253b5d2ce2270bc9c178e632b3fbb7eb5a7b458a5e8a57be4440883e158681b54687afe2e457006eeeb35bee4e85546440000000c0f5995db1ccdc7130d00398f8f1ca1e40963da73f10861057ecc7a4c592c6118215b7920046dd9c65f5f355de8a893e54b4ce4fbbaf25287d2cbc72bed3b922 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exedescription pid process Token: SeDebugPrivilege 2556 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe Token: SeDebugPrivilege 2556 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe Token: SeDebugPrivilege 2996 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe Token: SeDebugPrivilege 2996 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 2740 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2740 iexplore.exe 2740 iexplore.exe 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE 2548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exeiexplore.exedescription pid process target process PID 2556 wrote to memory of 2996 2556 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe PID 2556 wrote to memory of 2996 2556 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe PID 2556 wrote to memory of 2996 2556 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe PID 2556 wrote to memory of 2996 2556 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe PID 2996 wrote to memory of 2740 2996 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe iexplore.exe PID 2996 wrote to memory of 2740 2996 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe iexplore.exe PID 2996 wrote to memory of 2740 2996 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe iexplore.exe PID 2996 wrote to memory of 2740 2996 51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe iexplore.exe PID 2740 wrote to memory of 2548 2740 iexplore.exe IEXPLORE.EXE PID 2740 wrote to memory of 2548 2740 iexplore.exe IEXPLORE.EXE PID 2740 wrote to memory of 2548 2740 iexplore.exe IEXPLORE.EXE PID 2740 wrote to memory of 2548 2740 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe"C:\Users\Admin\AppData\Local\Temp\51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe"C:\Users\Admin\AppData\Local\Temp\51afbaedc7250c3e66a7877f92c02b2ac42bafe2528e4784200786b15a872467.exe" Master2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.178stu.com/my.htm3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2740 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2556-0-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2556-1-0x0000000000400000-0x000000000069F000-memory.dmpFilesize
2.6MB
-
memory/2996-2-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/2996-5-0x0000000000400000-0x000000000069F000-memory.dmpFilesize
2.6MB
-
memory/2996-8-0x0000000000400000-0x000000000069F000-memory.dmpFilesize
2.6MB