9ce24664cc2fa049bf12d41471939252c295ccf893f00bdc754d73aec1c84b5e

General

Target

sample.exe
Size

26KB
MD5

c7cfaca6501361febe27a6b3e66a61bf
SHA1

55a3414b9668596e120139a059db91a306281dcc
SHA256

fd32cec288cec4f16dc5430cf86dc17e1d4cf941d635979fc17a59c8d6d83d44
SHA512

490814ad45e81ca6712c179fc6f9849788da1e379a02597136a52cc8695d895b648676f1ae2ee200effdac0f0dac7d56bef0af3b6854c8c150f33120af4d75a1

Score

7^/10

persistence spyware

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ransomtoad = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\sample.exe\""	sample.exe

JavaScript code in executable 2 IoCs

Processes:

yara_rule

js
js

yara_rule
js
js

Modifies Internet Explorer settings 1 TTPs 196 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "177041"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "73"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000b91975a0d67b3f55f1769c68aca362168379efbd92a6f07ce2631702cbe1b9d7000000000e8000000002000020000000a1111894a58672f4a3534250d41f5f6563c4bcb2a9c0dfb3d4846a416814ca6f90000000881a3a336594a138b56cc4d2784a076a5c7ca23b8a865082dba4948261c2c5ddf7753f99ee90de254b00381867877badb40966c5c02d50df47b93cfddf7930b0b098baea7d21f82134511556814b9bf25fb6c8e45c051d37a944a618abac48e2c05f594d14085a85f615413f9d46beea829c34a36432fa107b49f36babd3224a1cef207db059d58fbc344fb5702644714000000030418154e2a9d154423c811c0071174def25bbf5339d2d510a70fd81abfa6cee80a72a72647db59efb4600bf74ed703f49861d0df8b7ce9a841319ba99945447	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "225"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "971"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\Total = "42"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\sale.aliexpress.com\ = "177041"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\g.alicdn.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\alicdn.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "481"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\Total = "171"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "971"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "1732"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "206"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "491"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\alicdn.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "169"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "93"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "119"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\Total = "1083"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "315595821"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "605"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "1750"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1740"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1083"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "145"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\sale.aliexpress.com\ = "14"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60507c241adad601	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\Total = "943"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "1105"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\sale.aliexpress.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "962"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "197"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "943"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\Total = "11"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\uptolike.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "177532"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "338"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "67"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\Total = "206"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\Total = "1138"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "459"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "59"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\aliexpress.com\Total = "269"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\ = "15"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1732"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\Total = "1732"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\Total = "971"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "1648"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\vk.com\ = "42"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\DOMStorage\primearea.biz\NumberOfSubdomains = "1"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 218 IoCs

Processes:

sample.exe

pid	process
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

sample.exe

description pid process

Token: SeDebugPrivilege 932 sample.exe

description	pid	process
Token: SeDebugPrivilege	932	sample.exe

Suspicious use of FindShellTrayWindow 279 IoCs

Processes:

iexplore.exesample.exe

pid	process
1780	iexplore.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe
932	sample.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1780 iexplore.exe
1780 iexplore.exe
1220 IEXPLORE.EXE
1220 IEXPLORE.EXE
1220 IEXPLORE.EXE
1220 IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

sample.exeiexplore.exe

description	pid	process	target process
PID 932 wrote to memory of 1780	932	sample.exe	iexplore.exe
PID 932 wrote to memory of 1780	932	sample.exe	iexplore.exe
PID 932 wrote to memory of 1780	932	sample.exe	iexplore.exe
PID 1780 wrote to memory of 1220	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1220	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1220	1780	iexplore.exe	IEXPLORE.EXE
PID 1780 wrote to memory of 1220	1780	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:932

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://primearea.biz/product/235093/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1220

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
d8794710f1a7e49c82ac9ebeac0571f9

SHA1
6627b433dff125e5cd02367d7f913d1606613f2d

SHA256
4e9eb85aeb94e389a938359414059986c184b350408eb70026c088962381300d

SHA512
f9319dc608e65b652150f2b50817c81b741e8058cc667ece2f0be863e184697ad8eb0ada1a29277daa7c8ca79438dccd97d9722c93b30db006221a374c3815a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
883d4d4799e711ef486ddf1591424d11

SHA1
82f5f763d54eb22c67b881b2c5f762985f820c41

SHA256
bb1e69b55fd091fb50966d5150f5e1037ae5a197b97aa1caa8fbc62505c7cb10

SHA512
a52fc4836d968cd54f50bb7ce74a80563bf76e75ce9ea9ff37f4fc244bc5c55ff2f6191384aef9524c80801262209cf012597b8bed588c2664bcc6307d13b7a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QYUGNZKW.txt
MD5
a6ff9833d741e526a3e198bdebbacecd

SHA1
86e3cbcf250e3af6eac0c676309df4edc8757b02

SHA256
70de6dafd48184d8407537279b6957ff1ab62f6f9f632a2bde5c926777ceb9dc

SHA512
148fec85434460933431139941b5f8f43eac383852deafdfcbc6fea60509ed66343f33b91883a982b94443f074bbe070be189ad33aff2194fd2f11818c760e22

Download Submit
memory/932-2-0x000007FEF52A0000-0x000007FEF5C8C000-memory.dmp

Filesize
9.9MB

Download
memory/932-3-0x00000000009E0000-0x00000000009E1000-memory.dmp

Filesize
4KB

Download
memory/1220-7-0x0000000000000000-mapping.dmp

Download
memory/1764-6-0x000007FEF61A0000-0x000007FEF641A000-memory.dmp

Filesize
2.5MB

Download
memory/1780-5-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads