c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7

General

Target

c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
Size

108KB
MD5

e393dc4e7c91543ce3b36b26846de333
SHA1

1d4f21e434ff9c937a78baa762d68e823aa847bc
SHA256

c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7
SHA512

c76621f1f87036d57e8fd9db9b80677f90f8db9f5efba7d595b5c38786e761851bdd805bab10d5d8460060ff986b3909dde64efea88879979ed9a1815a627aa4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

pid	process
1056	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
1056	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
1056	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exec20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a60000000000200000000001066000000010000200000005bde2e28292a18919f353433451ddd3d07b00892581fce543e0ac825d88d7c25000000000e8000000002000020000000844fbc5eede506ebf354f6bdcc6d485d84333e6d0f4f35d023064eada89ff16220000000ed0dd61468e78f9f2a5205d34810a7867e8335c8a40968b229ee31f73c46cb3f40000000d99037c3d1deaf2d6740f965c609d6e5c092a406c45d49fc7da7ce0591d54beb1d729b0085a3a0b03bba427e357c3c23ebb9e52ecc83fcf9eae88b80d79db0a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000c749a0e59443dce3c94536072938aacc5e8cfef436e40e39ebc945264adf9d50000000000e8000000002000020000000caa4b80509dc7654cfbdf6174f5bd5733de3a67beffb14dff6bacbf4b2c583109000000011ae50e06e4106519de8a4fd981ca4753445c16bd244c7dab89502fa6e251453883859853838e6de75737e02c973df058818ba4c93784f70a7d32474a06abf966c6deb62c1d936c4f7bee234cdc36e1af7d38d7b3f40ae59ef0f04e5698748261b3f699eb732039cf4ff97ef7f57704370c249a000937b6635443fea5fca21f8bdcbb00aeccf5c9c6943035006a8b08b400000008853141537e571f3e46d307ad894dca3e4520153a2b4caba5b8fe898dd897a41bd9a072d016fe1db2ea5ab0592bb9ccaeafdb15d82ae6e203b2a7050b305d5ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Internet Explorer\Main	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{968A0BF1-2248-11EB-A5C0-D2F6D50BABC0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b098346c55b6d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1"	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311663050"	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://?uid=d25b54e3-c4ca-44c8-87ae-811841f01b3e&uc=20170128&source=&ap=&i_id="	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1636 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1636 iexplore.exe
1636 iexplore.exe
584 IEXPLORE.EXE
584 IEXPLORE.EXE
584 IEXPLORE.EXE
584 IEXPLORE.EXE

pid	process
1636	iexplore.exe

pid	process
1636	iexplore.exe
1636	iexplore.exe
584	IEXPLORE.EXE
584	IEXPLORE.EXE
584	IEXPLORE.EXE
584	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1636 wrote to memory of 584	1636	iexplore.exe	IEXPLORE.EXE
PID 1636 wrote to memory of 584	1636	iexplore.exe	IEXPLORE.EXE
PID 1636 wrote to memory of 584	1636	iexplore.exe	IEXPLORE.EXE
PID 1636 wrote to memory of 584	1636	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
"C:\Users\Admin\AppData\Local\Temp\c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:1056

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1636 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:584

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HMSZ0STP.txt
MD5
6ab64b951e80f1e12f93a99dc256d68f

SHA1
e81084a0c46471c652748372f7be393d2d7f1fd5

SHA256
18ca0dbbbec3d2f652c57aae391d26d303e4138cacbfdc28879ae7fd508bca7a

SHA512
cc97872b768edda1fd450af83bca5cd07916b116536c06e619e74ee42ff4a6294f2b8a02512a0821965864686bdcae8f9309bf337768e0c29db8af3adb137b89

Download Submit
\Users\Admin\AppData\Local\Temp\nsc16EB.tmp\System.dll
MD5
0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1
10c51496d37cecd0e8a503a5a9bb2329d9b38116

SHA256
982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

SHA512
cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

Download Submit
\Users\Admin\AppData\Local\Temp\nsc16EB.tmp\nsisdl.dll
MD5
365e712eafd3fbfedcd9cd711526c977

SHA1
e5984443d51c95daa8ad3a7ea8c16e4f8b3e3466

SHA256
939e81ad5c29211790e5a1a8f6bea7b258bf37b55224631feb71dd31bb0ef852

SHA512
848f2fba59a2c19ee8d98d2ec7f8bc5132014601bb641179eea6d52695290d7ef21908bfd03482e065eb797dcb0f9f87591a9696c1ab399c739cd0348f2a67de

Download Submit
\Users\Admin\AppData\Local\Temp\nsc16EB.tmp\nsisdl.dll
MD5
365e712eafd3fbfedcd9cd711526c977

SHA1
e5984443d51c95daa8ad3a7ea8c16e4f8b3e3466

SHA256
939e81ad5c29211790e5a1a8f6bea7b258bf37b55224631feb71dd31bb0ef852

SHA512
848f2fba59a2c19ee8d98d2ec7f8bc5132014601bb641179eea6d52695290d7ef21908bfd03482e065eb797dcb0f9f87591a9696c1ab399c739cd0348f2a67de

Download Submit
memory/584-4-0x0000000000000000-mapping.dmp

Download
memory/1740-3-0x000007FEF6930000-0x000007FEF6BAA000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads