e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876

General

Target

e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876.bin.exe
Size

532KB
MD5

1b39dcc5de43d2840d6992a561e34eec
SHA1

abb567aadfbd5686b3fbed027dc297646e6bbf04
SHA256

e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876
SHA512

1a63c915bf4a829bf3fdb50fdf8cd1dbdeebe0fc6265d5c45ed3eeec43be44f857aac7008c7ae453c0f859efa660ed4e77fb76ec9b83e5b5d5effd3bd4c0bdcb

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f302f7a020b975438ea1f1f995ba97830000000002000000000010660000000100002000000067e294368ec24ab23c8a632495a5d17ee06a8623dff811dc3be95a18fa83fc4c000000000e8000000002000020000000194ddce153029fc797a9d15e32604a0079334d810234dddec9348d6347033a41900000003efff1503f315017eae2a20308af4bc904b40f1dff4cbf1eb27c8ef9ab43aa997f5c9b49de2ef8918e6f22f4de294561de3b57d35e5969c556a38a546b76436faa9c1cb232b81d5b8f1751193a92a5d21340c320e75bf219b21fc21a17a6876724c16701b3479efe1ea1ad8078d111e9dd07f448710fd62ac81d9146ffdca4008ab0d392ac427fb58f447715bce8327b40000000553b309f73d6053b0835ad65ed0071808a4e6582b4329dd7a5b9affc5d9ca2bafc49faf8e9cdfc2d7107387bf57b2e19f8b1dd2eaaded046b332f406af587513	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0aee5138bfdd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f302f7a020b975438ea1f1f995ba978300000000020000000000106600000001000020000000bb025475cf72bcd1328535378b4b41ebd6e5d8548ff4f5fcd4d3f71b4b824938000000000e8000000002000020000000ba6e8c456f9a149f022013499ef34cc21ba14b9833fb0be2a510b189668ad03120000000f2445f78c7c202809b42609cf0c7c59ec15ed0bb4965959c59e5e638600fee39400000004191f24a0ed40d1be585c5bb9fa798568a14177b7285f31c7bb7fc7520e5deb0f272c281fe69cc31e835877b32ef4926d5ac81e0488bddad05ab135dc0807781	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F5FEE11-697E-11EC-9EF0-F2153E37317C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

1316 iexplore.exe
1316 iexplore.exe

pid	process
1316	iexplore.exe
1316	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876.bin.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1436	e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876.bin.exe
1316	iexplore.exe
1316	iexplore.exe
276	IEXPLORE.EXE
276	IEXPLORE.EXE
1316	iexplore.exe
1316	iexplore.exe
1068	IEXPLORE.EXE
1068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 1316 wrote to memory of 276	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 276	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 276	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 276	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 1068	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 1068	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 1068	1316	iexplore.exe	IEXPLORE.EXE
PID 1316 wrote to memory of 1068	1316	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876.bin.exe
"C:\Users\Admin\AppData\Local\Temp\e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1436

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:603141 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-56-0x0000000000000000-mapping.dmp

Download
memory/1068-58-0x0000000000000000-mapping.dmp

Download
memory/1436-55-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1436-57-0x00000000001A0000-0x00000000001A2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads