63bee368085136ef7eed0823b6d8fb25ffecfd6f6d9050ee26f782e2b35df9a4

General

Target

pan0ramic0.jpg.dll
Size

377KB
MD5

9fe062a79018b4df322391a8f055d6be
SHA1

dee5ab23ff6f339fabddbb5b2bedc9d13329682c
SHA256

63bee368085136ef7eed0823b6d8fb25ffecfd6f6d9050ee26f782e2b35df9a4
SHA512

1e9d23e8d901622cdda01dbc732636b64b0f8215a8b9b1a625cc4ab42feaf2c8564ef5083e8af8ee92d4b19435c1ca20e31a784cb76b872157914749b28d8aa6

Score

5^/10

ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38176818-5CA8-11EB-B59A-42CC13A58998} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

424 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

424 iexplore.exe
424 iexplore.exe
1432 IEXPLORE.EXE
1432 IEXPLORE.EXE

pid	process
424	iexplore.exe

pid	process
424	iexplore.exe
424	iexplore.exe
1432	IEXPLORE.EXE
1432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

regsvr32.exeiexplore.exe

description	pid	process	target process
PID 812 wrote to memory of 1512	812	regsvr32.exe	regsvr32.exe
PID 812 wrote to memory of 1512	812	regsvr32.exe	regsvr32.exe
PID 812 wrote to memory of 1512	812	regsvr32.exe	regsvr32.exe
PID 424 wrote to memory of 1432	424	iexplore.exe	IEXPLORE.EXE
PID 424 wrote to memory of 1432	424	iexplore.exe	IEXPLORE.EXE
PID 424 wrote to memory of 1432	424	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\pan0ramic0.jpg.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:812

C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\pan0ramic0.jpg.dll
2⤵
PID:1512

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:424

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:424 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1432-5-0x0000000000000000-mapping.dmp

Download
memory/1512-2-0x0000000000000000-mapping.dmp

Download
memory/1512-3-0x0000000074420000-0x000000007442F000-memory.dmp

Filesize
60KB

Download
memory/1512-4-0x00000000028D0000-0x00000000028D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing