3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9

General

Target
3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe
Size 4.7MB
Sample200908-nv5px83dbs
SHA256 3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9
MD5 88fa43a2de246c4a9d2e5212d7d9d9d9
SHA1 e3eb75fb61c56a05186992bde1052ecc28ca5756
SHA512 f5d39034c0e14588e4001fa598017c716ed765a97bc825d1ec965422ad54c1586bdc84dc1475430d035b0124b6da0c615101d0d2543985a2ee8a03a430f22735
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
740	www.exe
1692	www.exe
944	FLASHP~1.EXE

Loads dropped DLL 5 IoCs

pid	Process
1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe
1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe
740	www.exe
1692	www.exe
1692	www.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe

JavaScript code in executable 2 IoCs

resource	yara_rule
behavioral1/files/0x00030000000131ac-9.dat	js
behavioral1/files/0x00030000000131ac-10.dat	js

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	FLASHP~1.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	FLASHP~1.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	FLASHP~1.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
944	FLASHP~1.EXE
944	FLASHP~1.EXE
944	FLASHP~1.EXE
944	FLASHP~1.EXE

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 740	1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe	25
PID 1144 wrote to memory of 740	1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe	25
PID 1144 wrote to memory of 740	1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe	25
PID 740 wrote to memory of 1692	740	www.exe	27
PID 740 wrote to memory of 1692	740	www.exe	27
PID 740 wrote to memory of 1692	740	www.exe	27
PID 1144 wrote to memory of 944	1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe	35
PID 1144 wrote to memory of 944	1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe	35
PID 1144 wrote to memory of 944	1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe	35
PID 1144 wrote to memory of 944	1144	3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe	35

C:\Users\Admin\AppData\Local\Temp\3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe
"C:\Users\Admin\AppData\Local\Temp\3d30f3e545110a115ed70bb765354c8b3a7cffa96440f0ea45ee819c71ccb8e9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\www.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\www.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\www.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\www.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1692
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FLASHP~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\FLASHP~1.EXE
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  PID:944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1964-13-0x000007FEF7C50000-0x000007FEF7ECA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads