Analysis
-
max time kernel
142s -
max time network
167s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
10-02-2022 02:57
Static task
static1
Behavioral task
behavioral1
Sample
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe
-
Size
2.9MB
-
MD5
d54474edd997f5ae1772d45974bd7005
-
SHA1
1c6dd6518d61df04fe42b4280cbe1c0e62bb352b
-
SHA256
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57
-
SHA512
e9f187eebdbef0c0b38d01c163c827ed6e6e5fcbe355ac50cded01521425a558f3d090c8b6d1039c760c623ca20432fe830d647428188428761e4b3a75d067f9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = a02eed442a1ed801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "351226965" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Internet Explorer\Main 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc920000000002000000000010660000000100002000000077eeb831369eaab761cfe3711e8df40356a236c58ebd9526dbb0ea9bf77bc808000000000e8000000002000020000000646799f1c24993af5142608acd89d28de975dc53bf0b160785f84d17494c830f900000004eaddc597d0e5d660eb1405462bf55e3e1da2ae5e60242f9fb55ea1088631a2541c550b2cfcff86280849cd227b794e4e2e16fd1a0e7ed6cf872a5ac18aa1cbdcf684686eed0fc7b3afe2a647f2858952b075fa03b939c4eec024ed16f9adc3cc75be9cbc7eb89d3b715385de3673891c91bcb0ed1e693764677cc51de6bff31ded516682e6b2018cc91445fc6aa8c924000000012675a48cbf9c76204fc4c7e500be355ff80b9870c36666054a6ec508fa99b5741ef9877780da2115473e3844055abe5bb1a908f8be49c2ec98e3d031ae0c066 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79521D41-8A1D-11EC-B76D-4AB3DBA4690F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MAO Settings iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000c39e7d7173f85a1495eee6af45257485422b8c2de052ef3ffd419b681cafb4d6000000000e8000000002000020000000af57c604f17f2a288d6f65066b124d46d84f32b6fb162d87ca5c1620d1135ae9200000005635e2fdbc81415f8c4f586b213980b8d20efbec335e495ddb4569e0301175f340000000a23bcdf1570324e9c8bde2c0322d31473ece357cb7c5b1d108b1b55e71d4cc0ae15c9db7d3c7b61badb64fc63ed7d40219abdc09117ba2a1ac160ddb46146c95 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902da45d2a1ed801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\shell\open 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe --weblogin \"%1\"" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\URL Protocol 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe --weblogin \"%1\"" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe --weblogin \"%1\"" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\shell\open\command 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\shell 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\shell\open 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\shell\open\command 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\shell\open\command 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\shell\open 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\ = "URL:de.web.mcl.redirect" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\shell 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\ = "URL:com.mail.mcl.redirect" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\ = "URL:net.gmx.mcl.redirect" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\URL Protocol 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\URL Protocol 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\shell 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 2008 iexplore.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2008 iexplore.exe 2008 iexplore.exe 548 IEXPLORE.EXE 548 IEXPLORE.EXE 548 IEXPLORE.EXE 548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 524 wrote to memory of 2008 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 30 PID 524 wrote to memory of 2008 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 30 PID 524 wrote to memory of 2008 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 30 PID 524 wrote to memory of 2008 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 30 PID 2008 wrote to memory of 548 2008 iexplore.exe 32 PID 2008 wrote to memory of 548 2008 iexplore.exe 32 PID 2008 wrote to memory of 548 2008 iexplore.exe 32 PID 2008 wrote to memory of 548 2008 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe"C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe"1⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe"C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe" /SU1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "http://go.1und1.de/os/win/ie_runonce"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:548
-
-