c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7

General

Target

c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
Size

108KB
MD5

e393dc4e7c91543ce3b36b26846de333
SHA1

1d4f21e434ff9c937a78baa762d68e823aa847bc
SHA256

c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7
SHA512

c76621f1f87036d57e8fd9db9b80677f90f8db9f5efba7d595b5c38786e761851bdd805bab10d5d8460060ff986b3909dde64efea88879979ed9a1815a627aa4

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

pid	process
3988	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
3988	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
3988	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEc20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d0000000002000000000010660000000100002000000045be61b28a917ddd662bf9ebee9e0636acf6336b88cd1f12b95813ad1d1b97b2000000000e8000000002000020000000d7ac2af7cdcb15f6f71a742c719165b695284ea96c807442793849df17cdeb7a20000000cfdfd6b47d40764a4baf83f0c7ae04eb8ceafd250555842c416f19781f3c6fc0400000009aa2859c93898df57cadeb31c2b62a6c187b8d44d181c307d21d72766e47e89317973e7b293efb5bdf852b0d01fea74fc32001338c254e6b4b1818385531369c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1859639363"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1864483382"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "311711639"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "311663053"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "311679647"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1"	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A4F4E0A-2248-11EB-BEBD-CAD1272A8716} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1859639363"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\SOFTWARE\Microsoft\Internet Explorer\Main	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30848597"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f068c16f55b6d601	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30848597"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c0cf6f55b6d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30848597"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f83ea431a1a9554d9899d7aad776ea2d000000000200000000001066000000010000200000003557ece5b905d6e1dc675bb43b7c346aa8857d1754562a80ecfddd05d97ac8ec000000000e8000000002000020000000f4e53737a94cdded2629848070387e9ef1c48a5219d833d6db3043f8f807e99520000000862c70b75abf9512eb3b0e5173220a0d6a2bd22097a5b0013cfe9b60c38d41dd400000001d8e009362e127f5a5766edc174e80761ff7429ed8fb85e5867af8549eccc3ee6590c7defcf2c29851afcea8279102c76399b5bc08a1bfa76fc080a9d10ce7f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://?uid=d25b54e3-c4ca-44c8-87ae-811841f01b3e&uc=20170128&source=&ap=&i_id="	c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3948 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3948 iexplore.exe
3948 iexplore.exe
4048 IEXPLORE.EXE
4048 IEXPLORE.EXE
4048 IEXPLORE.EXE
4048 IEXPLORE.EXE

pid	process
3948	iexplore.exe

pid	process
3948	iexplore.exe
3948	iexplore.exe
4048	IEXPLORE.EXE
4048	IEXPLORE.EXE
4048	IEXPLORE.EXE
4048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3948 wrote to memory of 4048	3948	iexplore.exe	IEXPLORE.EXE
PID 3948 wrote to memory of 4048	3948	iexplore.exe	IEXPLORE.EXE
PID 3948 wrote to memory of 4048	3948	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe
"C:\Users\Admin\AppData\Local\Temp\c20a9d454d283dc7a9deae26cb115686b02de38aead61faf1ba48c6768f7cae7.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:3988

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3948

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3948 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
MD5
a0c055f33d1075d1399388fa891c49d3

SHA1
b454cda0134375bc26e94e536515b02aeb8dc17c

SHA256
c0c37bbe273f349da77cd97f7d2338134532ff1f3fd61d7a4a90f810084385d0

SHA512
7ee8616b77f67ecca73186c05967a047c9ae41e93d9b36adc7d232ee7fd881c4b89e1d09e8f254eb856c15264e2c40dedebc98fcb55423be581b1776f19815a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203
MD5
a047625f14d935b3f6c7a042765e4cde

SHA1
98c4ec5410e11a754de6ab5913d79dbf701dc727

SHA256
a0a5d62e1b1df0c5b6f3860282352432ee9d7f942e00527b7cc8beb2a06cbc36

SHA512
a7e2c05596ae0592d457c940089bc44c04487b6dafd8c061068d0c80b9391287a56aa84bf2be4401157242a5505ec211d41131be21e3f21fc68e9604534b24ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\5YH3SSP1.cookie
MD5
ea6ecc0ccd8c4a1fec2f64df37db90a8

SHA1
8b68034e039b4c7fef39cda4ec3dc339bcadbfd1

SHA256
97d2355d230ab0b2a5d9c3ce80e103282f9c7121a20a0a0bbca356963298eff1

SHA512
935f3e0c4bb08d1a4797c562415735e1432f37e130da80f18de27ce98e80bae0acf7d84adb5af85769bf319a34f9c82a116f7c10aedfe737cd44dca73ad51c17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\J26QNXWT.cookie
MD5
64559735ef7e354e4b77157a4c9f999e

SHA1
b29fb9c1bbcc949f31de136dcc133a65d09f4789

SHA256
f7bde6ebf734da67c890644959340f240609b184b798c46ca62f44abc2f67556

SHA512
353e95e6e45645cec5a16538416d1521154e7ba7cc33b581f91835d5e7833335fd22c97e006819d2f08b80a66ad9ea50a206fed41a1c27b986bff20a3f2707b9

Download Submit
\Users\Admin\AppData\Local\Temp\nssEDB.tmp\System.dll
MD5
0ff2d70cfdc8095ea99ca2dabbec3cd7

SHA1
10c51496d37cecd0e8a503a5a9bb2329d9b38116

SHA256
982c5fb7ada7d8c9bc3e419d1c35da6f05bc5dd845940c179af3a33d00a36a8b

SHA512
cb5fc0b3194f469b833c2c9abf493fcec5251e8609881b7f5e095b9bd09ed468168e95dda0ba415a7d8d6b7f0dee735467c0ed8e52b223eb5359986891ba6e2e

Download Submit
\Users\Admin\AppData\Local\Temp\nssEDB.tmp\nsisdl.dll
MD5
365e712eafd3fbfedcd9cd711526c977

SHA1
e5984443d51c95daa8ad3a7ea8c16e4f8b3e3466

SHA256
939e81ad5c29211790e5a1a8f6bea7b258bf37b55224631feb71dd31bb0ef852

SHA512
848f2fba59a2c19ee8d98d2ec7f8bc5132014601bb641179eea6d52695290d7ef21908bfd03482e065eb797dcb0f9f87591a9696c1ab399c739cd0348f2a67de

Download Submit
\Users\Admin\AppData\Local\Temp\nssEDB.tmp\nsisdl.dll
MD5
365e712eafd3fbfedcd9cd711526c977

SHA1
e5984443d51c95daa8ad3a7ea8c16e4f8b3e3466

SHA256
939e81ad5c29211790e5a1a8f6bea7b258bf37b55224631feb71dd31bb0ef852

SHA512
848f2fba59a2c19ee8d98d2ec7f8bc5132014601bb641179eea6d52695290d7ef21908bfd03482e065eb797dcb0f9f87591a9696c1ab399c739cd0348f2a67de

Download Submit
memory/4048-3-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads