ba38fc5847b491303df3a44071e4a19b46cedf35c44a765c290a555483d14558

General

Target

915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
Size

288KB
MD5

b4cb2af3d9ca46dc2f3444cb1e568c44
SHA1

566d9c5c4035292a3f4fea2e9ebd109e96830fac
SHA256

915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3
SHA512

40894820348890d26ede3a3ccec65e3e12c977e16b693ec2132b71e403f4e2774c4b76c82d6a4e1acb6054c40afa57d5501f3de2010d1294e7da1d97bec6c251

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\4022322028 = "\"C:\\ProgramData\\Barxe\\DorlEntap.exe\""	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

pid	process
240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

Dwm.exeExplorer.EXE915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

description	pid	process
Token: SeCreateGlobalPrivilege	1188	Dwm.exe
Token: SeShutdownPrivilege	1188	Dwm.exe
Token: SeDebugPrivilege	1188	Dwm.exe
Token: SeCreateGlobalPrivilege	1276	Explorer.EXE
Token: SeShutdownPrivilege	1276	Explorer.EXE
Token: SeDebugPrivilege	1276	Explorer.EXE
Token: SeCreateGlobalPrivilege	240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
Token: SeShutdownPrivilege	240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
Token: SeDebugPrivilege	240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

pid process

240 915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

pid	process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe

description	pid	process	target process
PID 240 wrote to memory of 1188	240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe	Dwm.exe
PID 240 wrote to memory of 1276	240	915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe	Explorer.EXE

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1188

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276

C:\Users\Admin\AppData\Local\Temp\915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe
"C:\Users\Admin\AppData\Local\Temp\915aee146b74ebdcb6977376ea8c7718a53b73e1771261035790e8d3e33668c3.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:240

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-0-0x0000000001AE0000-0x0000000001B07000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads