df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c

General

Target

df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe
Size

1.6MB
MD5

33c05469421dfa44f77fc7b0ebe6c34a
SHA1

710fc507886ad1515565863773b14422be731b17
SHA256

df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c
SHA512

965eb98f09296d6ca0622f7dc635802ea5c5b97bc32fdfac89f027371fdffa4b6cf6b1b34da6fa4a39d6d140e27f2bfd5062d9a3313c4ad90674c0b00e31a0e9

Score

6^/10

adware stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27286431-3161-11EC-B4EA-F212AA2A1227} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DOMStorage\vibeflog.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f45a3407a6eee4cb6062dddd85478a6000000000200000000001066000000010000200000006c2e61b94021f90e716fdf3406967e550c3db1b5653041cfcda99effd0cbfd6e000000000e8000000002000020000000520ba821c06b252e77e3bc8fd02227be7aac9c72c5a14dc6a7de40bfe2f769df90000000c1e6a8535dec4ba2241f7b6acb279d886249a45aaf22fc51044c8434064d62d1250b139db6016e5d6fb60b1d642e988479f7f74a3df71b4a1ab7c28965ee2428e80566ac117725ebbaf3f26864f48a7fd811c4920075d9c87036b831669b23827c249e836cc9de90c6bd3a76e33819e97416905ac528421e4e8f8dfab6263e877e2f884d53f9875c740c154560ab128c40000000bb98f17b23cc702679664d76a7ffb25c7302211aec59a55b169068d820a4c55657a0ffc278bb88df379b40a67b8fe92a3ffab4732e3e311b36adfe96c06178b8	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "341470363"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DOMStorage\vibeflog.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005f45a3407a6eee4cb6062dddd85478a600000000020000000000106600000001000020000000e92a6a6a7519dedc1d8378d3d8acb64170dead08dcabad139fb6a83b86d934e5000000000e8000000002000020000000e882023647eb1d631d487045bfb8517efe08762d474dcaef8ebe8f57cbef5be220000000f962e96f63f1b4e06a430fc5c8785506ab82418002525d22fe0773c0c28620394000000047252c6f456d019867902298b8e2240306df8ab335b567697376339b92c2f61a20a64db3ee61232dfe42fb25b3ee5de6e75c4441829c75dce90c9cd370816ea9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509fd7fe6dc5d701	iexplore.exe

Modifies registry class 7 IoCs

Processes:

df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{332B6D13-B9B2-45F0-8721-200D801C726C}	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{332B6D13-B9B2-45F0-8721-200D801C726C}\	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{332B6D13-B9B2-45F0-8721-200D801C726C}\InprocServer32	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{332B6D13-B9B2-45F0-8721-200D801C726C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\WindowsCOM.dll"	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{332B6D13-B9B2-45F0-8721-200D801C726C}\InprocServer32\ThreadingModel = "Apartment"	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{332B6D13-B9B2-45F0-8721-200D801C726C}	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{332B6D13-B9B2-45F0-8721-200D801C726C}\InprocServer32	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

588 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

588 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

588 iexplore.exe
588 iexplore.exe
524 IEXPLORE.EXE
524 IEXPLORE.EXE
524 IEXPLORE.EXE
524 IEXPLORE.EXE

pid	process
588	iexplore.exe

pid	process
588	iexplore.exe

pid	process
588	iexplore.exe
588	iexplore.exe
524	IEXPLORE.EXE
524	IEXPLORE.EXE
524	IEXPLORE.EXE
524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exeiexplore.exe

description	pid	process	target process
PID 1680 wrote to memory of 588	1680	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe	iexplore.exe
PID 1680 wrote to memory of 588	1680	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe	iexplore.exe
PID 1680 wrote to memory of 588	1680	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe	iexplore.exe
PID 1680 wrote to memory of 588	1680	df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe	iexplore.exe
PID 588 wrote to memory of 524	588	iexplore.exe	IEXPLORE.EXE
PID 588 wrote to memory of 524	588	iexplore.exe	IEXPLORE.EXE
PID 588 wrote to memory of 524	588	iexplore.exe	IEXPLORE.EXE
PID 588 wrote to memory of 524	588	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe
"C:\Users\Admin\AppData\Local\Temp\df35eafa746e76296cb1ec6ce92c78214e088097f46cccd35f8dd719ab20f47c.bin.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1680

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.vibeflog.com/gatasextreme/p/22949550
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:588 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:524

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
ab5c36d10261c173c5896f3478cdc6b7

SHA1
87ac53810ad125663519e944bc87ded3979cbee4

SHA256
f8e90fb0557fe49d7702cfb506312ac0b24c97802f9c782696db6d47f434e8e9

SHA512
e83e4eae44e7a9cbcd267dbfc25a7f4f68b50591e3bbe267324b1f813c9220d565b284994ded5f7d2d371d50e1ebfa647176ec8de9716f754c6b5785c6e897fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
688be7515f5f7a95d50e0126cb30fd78

SHA1
c73fd28eab5cdb2e01b68f7706af82c8c8f6cf8d

SHA256
fb2c3739235c1c969a0303682c6b5b461af98bbb2bc60228b28f4aa45e5e4228

SHA512
de8d7b206addec00e51c80a73177c4cf8c9c67a152f75e4007521ee37d0b348f542d2898b99195051e825919343fe44753cbc6e70ef9baeed639ca6ca0427d08

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NFDCT375.txt
MD5
de78565db8b372af3561c3c00e27b061

SHA1
bce40509d02d346f17fc321df55744f8ae1ebac3

SHA256
94ed06ac3c11d9fe5f7202984d9fb11eab3832abbb69f9bd423c1052d22fb5c9

SHA512
d762314d4dfdc40405cdb13ca0d422698e0861d9a1407e6ad4735a0aba1ce46ab9e5d3486f6d5d5ff5dc249078de96b9dbe2d77cde046848ae6924e4da7f1d12

Download Submit
memory/524-56-0x0000000000000000-mapping.dmp

Download
memory/588-54-0x0000000000000000-mapping.dmp

Download
memory/1680-53-0x0000000074B41000-0x0000000074B43000-memory.dmp

Filesize
8KB

Download
memory/1680-55-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads