Analysis
-
max time kernel
142s -
max time network
167s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
10-02-2022 02:57
Static task
static1
Behavioral task
behavioral1
Sample
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe
Resource
win10v2004-en-20220112
General
-
Target
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe
-
Size
2.9MB
-
MD5
d54474edd997f5ae1772d45974bd7005
-
SHA1
1c6dd6518d61df04fe42b4280cbe1c0e62bb352b
-
SHA256
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57
-
SHA512
e9f187eebdbef0c0b38d01c163c827ed6e6e5fcbe355ac50cded01521425a558f3d090c8b6d1039c760c623ca20432fe830d647428188428761e4b3a75d067f9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exe475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = a02eed442a1ed801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "351226965" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Internet Explorer\Main 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc920000000002000000000010660000000100002000000077eeb831369eaab761cfe3711e8df40356a236c58ebd9526dbb0ea9bf77bc808000000000e8000000002000020000000646799f1c24993af5142608acd89d28de975dc53bf0b160785f84d17494c830f900000004eaddc597d0e5d660eb1405462bf55e3e1da2ae5e60242f9fb55ea1088631a2541c550b2cfcff86280849cd227b794e4e2e16fd1a0e7ed6cf872a5ac18aa1cbdcf684686eed0fc7b3afe2a647f2858952b075fa03b939c4eec024ed16f9adc3cc75be9cbc7eb89d3b715385de3673891c91bcb0ed1e693764677cc51de6bff31ded516682e6b2018cc91445fc6aa8c924000000012675a48cbf9c76204fc4c7e500be355ff80b9870c36666054a6ec508fa99b5741ef9877780da2115473e3844055abe5bb1a908f8be49c2ec98e3d031ae0c066 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{79521D41-8A1D-11EC-B76D-4AB3DBA4690F} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\MAO Settings iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000029a8fa03d77d0143b95f148165a5bc9200000000020000000000106600000001000020000000c39e7d7173f85a1495eee6af45257485422b8c2de052ef3ffd419b681cafb4d6000000000e8000000002000020000000af57c604f17f2a288d6f65066b124d46d84f32b6fb162d87ca5c1620d1135ae9200000005635e2fdbc81415f8c4f586b213980b8d20efbec335e495ddb4569e0301175f340000000a23bcdf1570324e9c8bde2c0322d31473ece357cb7c5b1d108b1b55e71d4cc0ae15c9db7d3c7b61badb64fc63ed7d40219abdc09117ba2a1ac160ddb46146c95 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902da45d2a1ed801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Modifies registry class 21 IoCs
Processes:
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\shell\open 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe --weblogin \"%1\"" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\URL Protocol 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe --weblogin \"%1\"" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe --weblogin \"%1\"" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\shell\open\command 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\shell 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\shell\open 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\shell\open\command 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\shell\open\command 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\shell\open 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\ = "URL:de.web.mcl.redirect" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\shell 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect\ = "URL:com.mail.mcl.redirect" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\ = "URL:net.gmx.mcl.redirect" 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\URL Protocol 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\de.web.mcl.redirect\URL Protocol 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\com.mail.mcl.redirect 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\net.gmx.mcl.redirect\shell 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe -
Processes:
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exeiexplore.exepid process 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 2008 iexplore.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exepid process 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 2008 iexplore.exe 2008 iexplore.exe 548 IEXPLORE.EXE 548 IEXPLORE.EXE 548 IEXPLORE.EXE 548 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exeiexplore.exedescription pid process target process PID 524 wrote to memory of 2008 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe iexplore.exe PID 524 wrote to memory of 2008 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe iexplore.exe PID 524 wrote to memory of 2008 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe iexplore.exe PID 524 wrote to memory of 2008 524 475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe iexplore.exe PID 2008 wrote to memory of 548 2008 iexplore.exe IEXPLORE.EXE PID 2008 wrote to memory of 548 2008 iexplore.exe IEXPLORE.EXE PID 2008 wrote to memory of 548 2008 iexplore.exe IEXPLORE.EXE PID 2008 wrote to memory of 548 2008 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe"C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe"1⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe"C:\Users\Admin\AppData\Local\Temp\475eba482ed51fe75968f9457f559c9af6cf50ea35bc305e39e8bdee7e75bf57.exe" /SU1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "http://go.1und1.de/os/win/ie_runonce"2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2008 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:548
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5208ffdcffdac412e0255a3339ad30d1b
SHA14761b51b26f2d48eedc8ceddd38d844ed9ee5cbf
SHA256d7bdaab70d3a86af9dfd4da8dbb8dd79d77b2576a3a65ef1fb6deb3a2766338d
SHA512541155c024459d26bb4421eee5b7f6d53de125e29a8828955f2ab37388ac313cea3e5976bc13a83d2e4f18c2881c76e6923d7f10389a2fd16c5bc1277b699b99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD59adcc832c3369d9f8a8d56e70b267f84
SHA1827cb12d8a9cdde2149371845c6308dea006d9ce
SHA2568c46acfe32a3a7f10cc5dbc0a83164870df699e5578a7ebf1f8f0ca338547064
SHA51233e50d618427336995584fc92d7dfcc0e13edf8553b3241871542aea65408879e6aac311c7a705d5009cf46b4378e12fa522af7ec6f2ccadeed8a580280a4ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD50215e205e8b7f335d4156875eb428888
SHA1032189d8b71125539999cfb621f457832b067b8f
SHA2568bf5a4b72a4b164e003c7ff36bab3318a462db721f98cfa9398cbde1c62114fc
SHA51254701a1b22fa360aeb2aaa141bb1eb91dd6e4a4520844b26ea60ecd1f85e74e0f638c36e24976dbcb10745f5ed8b5d26cb5698b9db0932797b49e3531961f96d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD54c39f08717acae7803e66b4600f3b619
SHA127486bcc43bf8017371c6ed8267b35561893b6d3
SHA256f8093f0d8825d9e6c4f7c7330deef1b989b5c469bde104c1bf0cd5080ffe2731
SHA5121057d7c2ac283d1319e9c23ce52f44a0954930ef04d107e78495d76024e6ca4f0ee6a0afce2abcadb691a00488ac4bbfb0ce88473837ae52d3b7568d7aa2d608
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
MD50dceead07ce610d7466e9f22265e952d
SHA10884e97dd246b7098e31f1ed778585ffd0e2de2a
SHA2566bbccd3f0dae9a75f696682a0586e214fafca0704fb5d7e9cdc0d36ef329e70c
SHA512d3b6568a66f04f7184cd4ad89788f287b6cbc5fb9976dbea2fff3ee49eaf25fa35000789d5752c4c00d2c083f17e3d5238eb43b9567c6fd395c0f9a7c469c6e0
-
MD5
60b4f86b3177a3f158a0ca41970cad3b
SHA16efe7deb483167b8661c26183be869a318427618
SHA25645e68c5593e316ae7d9f561af1f6eaa5a3bcd4f956059cd9e407d3ef622ee996
SHA512fc68c8095a975e69376947d3fb5a5e4295d4609c69d63a129e02bfd84d48c72bd001bd9db8791cbcad734e39556fc1dcc815606b3e0d931c5413b7884426bdea