72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5

Analysis

max time kernel
61s

Sharing

Copy URL

Twitter E-mail

General

Target

test.zip
Sample

190821-b2h8n5wv9n
SHA256

72b228f51cf5a1b7600f0e0848145e4e54e54838977a5a5b1c85f69b64b92cf5

Score

N/A

Malware Config

Signatures

Loads dropped DLL 1 TTPs

Shared Modules
T1129

Drops file in system dir 2 IoCs

description
C:\Program Files (x86)\SinTech\TextEdit.exe
C:\Program Files (x86)\SinTech\TextEdit.exe.config

Adds Run entry to start application 2 TTPs 1 IoCs

Modify Registry

T1112

description
\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run (CreateKeyEx)

Modifies Internet Explorer settings 1 TTPs 9 IoCs

Modify Registry

T1112

description
\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\main (CreateKeyEx)
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Check_Associations = "no"
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\NoProtectedModeBanner = "1"
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IE8RunOnceLastShown = "1"
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IE8RunOnceLastShown_TIMESTAMP = 8afe20f63237d401
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IE8TourShown = "1"
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\IE8TourShownTime = 0c8ab1fc3237d401
\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Recovery (CreateKeyEx)
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Recovery\AutoRecover = "2"

Suspicious use of WriteProcessMemory 1 TTPs 4 IoCs

Process Injection

T1055

description	pid	Process
PID 1208 wrote to memory of 1260	1260	Process not Found
PID 1208 wrote to memory of 1748	1748	Process not Found
PID 1208 wrote to memory of 2272	2272	Process not Found
PID 1208 wrote to memory of 2816	2816	Process not Found

Executes dropped EXE 1 TTPs

Native API
T1106
Creates new service 1 TTPs

Suspicious use of WriteProcessMemory 1 TTPs 4 IoCs

Process Injection

T1055

description	pid	Process
PID 1748 wrote to memory of 1200	1200	Process not Found
PID 1748 wrote to memory of 704	704	Process not Found
PID 1748 wrote to memory of 1688	1688	Process not Found
PID 1748 wrote to memory of 2216	2216	Process not Found

Launches SC.exe
Modifies Windows Firewall 1 TTPs

Suspicious use of WriteProcessMemory 1 TTPs 3 IoCs

Process Injection

T1055

description	pid	Process
PID 1752 wrote to memory of 304	304	Process not Found
PID 1752 wrote to memory of 860	860	Process not Found
PID 1752 wrote to memory of 2708	2708	Process not Found

Modifies Internet Explorer settings 1 TTPs 2 IoCs

Modify Registry

T1112

description
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Setup (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Setup\HaveCreatedQuickLaunchItems = "1"

Modifies Internet Explorer settings 1 TTPs 67 IoCs

Modify Registry

T1112

description
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\BrowserEmulation (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\UnattendLoaded = "1"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\TLDUpdates = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Main (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\InternetRegistry (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\IntelliForms (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Toolbar (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\PageSetup (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Zoom (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\IETld\LowMic (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Recovery (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F39C1B3-C41C-11E9-8080-528EC5CC216E} = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\SearchScopes (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\LinksFolderMigrate = 100380e22858d501
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\MarketingLinksMigrate = 706482e22858d501
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\Extensions (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{2670000A-7350-4f3c-8081-5663EE0C6C49} = "8192"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId = "8193"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} = "8193"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\Extensions\CmdMapping\NextId = "8194"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0 (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\Path = "C:\\Users\\Admin\\Favorites\\Links\\Web Slice Gallery.url"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\Handler = "{B0FA7D7C-7195-4F03-B03E-9DC1C9EBC394}"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\DisplayName = "Web Slice Gallery"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\DisplayMask = "4"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\ErrorState = "64"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\Expiration = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff4400000044000000640300009c020000
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Suggested Sites (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Suggested Sites\MigrationTime = 30d8d7ef2858d501
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Suggested Sites\SlicePath = "C:\\Users\\Admin\\Favorites\\Links\\Suggested Sites.url"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\Path = "C:\\Users\\Admin\\Favorites\\Links\\Suggested Sites.url"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\DisplayName
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\Expiration (DeleteValueKey)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\ErrorState = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\DisplayMask = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1 (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\Path = "C:\\Users\\Admin\\Favorites\\Links\\Web Slice Gallery.url"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\Handler = "{B0FA7D7C-7195-4F03-B03E-9DC1C9EBC394}"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\DisplayName = "Suggested Sites"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\DisplayName = "Web Slice Gallery"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\DisplayMask = "4"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\ErrorState = "64"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\Expiration = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\DisplayName
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\Expiration (DeleteValueKey)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\ErrorState = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\DisplayMask = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\User Preferences (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000748e6cc0478c8c4987439d1c0fffc8a900000000020000000000106600000001000020000000a6b8015256526c211763e49867b058cf72748ce8e09c72378e4291750707a095000000000e80000000020000200000005a07c81ce8ef07a23bdd9d6d5389f17f2db7d011e9b46fae590b14f2a52c11c1500000005fc2d525bdb77a344026a8e9427d5314444caba3248f08564bd93fda914ca594ef6a238afd0fe232d74842a5ea88019d3d6e31bd772bf5b372ec3b5d7be28b3ed93e59cd2ca5754a72fd78f8776c37a7400000005ec8e3d16c3e6b38f109e1292889c8c6b5a9317b4652858e1c1fc1e0609914dbbe2ac60dcd52c67da76aeedacc64300d8c02a6d259c69da2cb32e26765538315
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\User Preferences\2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000748e6cc0478c8c4987439d1c0fffc8a9000000000200000000001066000000010000200000005c286d0d343bcdc22b9dfd5b2c12726ac2b92b3332673f85fa6a9c9688a01371000000000e80000000020000200000003bc8beb8cc906492b0503471f34da620e44b7d69807ae63b932ec537eb271d6c10000000c5a2cd410b54f294853004f27bd2a449400000000fe328dc274da27ee7531153457231bbb2b0023ddb014552c1281b5b4abdde142a8b4b52dfafb1ebc50d1b654e75ab180c799e729295a90fa1327b321551f502

Suspicious use of SetWindowsHookEx 1 TTPs
Loads dropped DLL 1 TTPs

Shared Modules
T1129

Malicious domain 2 IoCs

description
www.kitai.jp
rl.ammyy.com

Suspicious use of SetWindowsHookEx 1 TTPs

Modifies Internet Explorer settings 1 TTPs 10 IoCs

Modify Registry

T1112

description
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Toolbar (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\InternetRegistry (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\IntelliForms (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\PageSetup (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Zoom (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\IETld\LowMic (CreateKeyEx)

Modifies service 2 TTPs 5 IoCs

Modify Registry

T1112

description
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig (CreateKeyEx)
\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups (CreateKeyEx)
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas (CreateKeyEx)
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs (CreateKeyEx)
\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI (CreateKeyEx)

Modifies Windows Firewall 1 TTPs
Suspicious use of FindShellTrayWindow 1 TTPs

Process Injection
T1055

Modifies service 2 TTPs 5 IoCs

Modify Registry

T1112

description
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig (CreateKeyEx)
\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups (CreateKeyEx)
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas (CreateKeyEx)
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs (CreateKeyEx)
\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI (CreateKeyEx)

Executes dropped EXE 1 TTPs

Native API
T1106
Loads dropped DLL 1 TTPs

Shared Modules
T1129
Suspicious use of SetWindowsHookEx 1 TTPs
Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs

Suspicious registry modification 15 IoCs

description
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\EnableConsoleTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASAPI32\EnableFileTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASAPI32\EnableConsoleTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASAPI32\FileTracingMask = "4294901760"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASAPI32\ConsoleTracingMask = "4294901760"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASAPI32\MaxFileSize = "1048576"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASAPI32\FileDirectory = "%windir%\\tracing"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASMANCS\EnableFileTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASMANCS\EnableConsoleTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASMANCS\FileTracingMask = "4294901760"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASMANCS\ConsoleTracingMask = "4294901760"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASMANCS\MaxFileSize = "1048576"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\wlanspeed_RASMANCS\FileDirectory = "%windir%\\tracing"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000005000000090000000000000000000000000000000400000000000000806c96e32858d501000000000000000000000000020000001700000000000000fe80000000000000fcba08c89d0a65510b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000a00000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Loads dropped DLL 1 TTPs

Shared Modules
T1129

HTTP(S) URI 1 TTPs 6 IoCs

Modify Registry

T1112

description
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\FeedUrl = "http://go.microsoft.com/fwlink/?LinkId=121315"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\FeedUrl = "https://ieonline.microsoft.com/#ieslice"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\FeedUrl = "http://go.microsoft.com/fwlink/?LinkId=121315"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"

Loads dropped DLL 1 TTPs

Shared Modules
T1129
Loads dropped DLL 1 TTPs

Shared Modules
T1129
Suspicious use of SetWindowsHookEx 1 TTPs

Modifies Internet Explorer settings 1 TTPs 10 IoCs

Modify Registry

T1112

description
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Toolbar (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\InternetRegistry (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\IntelliForms (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\PageSetup (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\Zoom (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic (CreateKeyEx)
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Internet Explorer\IETld\LowMic (CreateKeyEx)

Uses Task Scheduler COM API 1 TTPs

Query Registry
T1012
Executes dropped EXE 1 TTPs

Native API
T1106
Loads dropped DLL 1 TTPs

Shared Modules
T1129
Loads dropped DLL 1 TTPs

Shared Modules
T1129
Loads dropped DLL 1 TTPs

Shared Modules
T1129

Suspicious registry modification 16 IoCs

description
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32\EnableFileTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32\EnableConsoleTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32\FileTracingMask = "4294901760"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32\ConsoleTracingMask = "4294901760"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32\MaxFileSize = "1048576"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASAPI32\FileDirectory = "%windir%\\tracing"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASMANCS\EnableFileTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASMANCS\EnableConsoleTracing = "0"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASMANCS\FileTracingMask = "4294901760"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASMANCS\ConsoleTracingMask = "4294901760"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASMANCS\MaxFileSize = "1048576"
\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\RASMANCS\FileDirectory = "%windir%\\tracing"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000007000000090000000000000000000000000000000400000000000000806c96e32858d501000000000000000000000000020000001700000000000000fe80000000000000fcba08c89d0a65510b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000a00000d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"
\REGISTRY\USER\S-1-5-21-1977670210-1209397319-124334088-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"

Loads dropped DLL 1 TTPs

Shared Modules
T1129
Loads dropped DLL 1 TTPs

Shared Modules
T1129
Loads dropped DLL 1 TTPs

Shared Modules
T1129
Loads dropped DLL 1 TTPs

Shared Modules
T1129
flawedammy family
family

Analysis

Sharing

General

Malware Config

Signatures

Processes