59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6

General

Target

59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exe
Size

553KB
MD5

dbae681c46bd2b639f477c6bdb4bf9b3
SHA1

7553b9f49fc0dacedd2e6365fb41fbbebfb5f3c2
SHA256

59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6
SHA512

f950975834ec2b26f895bf4b81b1542d6418ea3bd150b8502abf2a4896733afb9e65cae388e1d43778182ed1a6c87fabf6d64ae41a2f9fdcafb2e71267d9f0e1

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B9BF251-A0AA-11EC-AC7F-466006210864} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab8535dea0c55241b6e6a02dc814678c00000000020000000000106600000001000020000000a5526c537646c76c43727dc87b0a5fa2d0da87b582a167f4800ccf0efde21e8a000000000e800000000200002000000049e3c25551ae296b5e23788f5b6b1efe6fd9ded98efb70148d897d399fcf210420000000a64334af9dc2443d80091ad8aaab496a2cb5c7412a8f4594537731cc9c8bd7dd4000000067e9b5ba4d64af0756426e0dbea13fef4fdbe832169ee424017947d97fb5c02dd72f34ea747ba5413390ebea907abc09a037bc86423f0d244763516bfdc04935	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30537834b734d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "353706383"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1405931862-909307831-4085185274-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ab8535dea0c55241b6e6a02dc814678c000000000200000000001066000000010000200000004ce5848c8f8f75f3aefd7052a3fae35df47056e2e0cbfef35a8940a2551c115d000000000e80000000020000200000006fafa8b15b3415eb16f61399944e4c34e266132233c7a6473d2d89eb0ef3518f900000003bd967d06ea6c5ce76925568f034b27d69ed64155ccd2f23785e181e12788694bbfd99cb11c090db00dac801a670333e41cf11c42fa2f6275db9f173659e5fce92f63f090e9f0ec58c6eab1c685415a9c15f386c109380c7ff9b5ebcdca2f44f24e19db0977a1d9a6318da6b873b3597e151623483d2d8a52dfa0a27274c63e58cf72ea5541b2f139d060a8c424898b340000000e7fdd5b4c5ed2609885c828fd97380d27e7836c1407493c06e4540ee5f814e094419f79aec04fa5c295641bb876b0915e416d04171592ed746efe108c9024704	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

1032 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1032 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1032 iexplore.exe
1032 iexplore.exe
592 IEXPLORE.EXE
592 IEXPLORE.EXE
592 IEXPLORE.EXE
592 IEXPLORE.EXE

pid	process
1032	iexplore.exe

pid	process
1032	iexplore.exe

pid	process
1032	iexplore.exe
1032	iexplore.exe
592	IEXPLORE.EXE
592	IEXPLORE.EXE
592	IEXPLORE.EXE
592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exeiexplore.exe

description	pid	process	target process
PID 1628 wrote to memory of 1032	1628	59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exe	iexplore.exe
PID 1628 wrote to memory of 1032	1628	59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exe	iexplore.exe
PID 1628 wrote to memory of 1032	1628	59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exe	iexplore.exe
PID 1628 wrote to memory of 1032	1628	59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exe	iexplore.exe
PID 1032 wrote to memory of 592	1032	iexplore.exe	IEXPLORE.EXE
PID 1032 wrote to memory of 592	1032	iexplore.exe	IEXPLORE.EXE
PID 1032 wrote to memory of 592	1032	iexplore.exe	IEXPLORE.EXE
PID 1032 wrote to memory of 592	1032	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exe
"C:\Users\Admin\AppData\Local\Temp\59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=59516a07653d39db4492ef7de6d943140ba0e9a7b891e36818ea4c0d052926a6.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

MD5
03fc152ccbe209c181a8b45414633bf9

SHA1
43b2d43056b55609c2a481a84d92396d9595d57c

SHA256
cafe26388375f47bc27c583f568090d958aa97ccb4e58ab6f5d6d5ed4534d43a

SHA512
f4ec8a087aa3e84c9cc592ceed296e205bc6dfc0d68f50d9da956c25cda70b88c403b8ece90ce6e62dec6508388580d3955b728eb5dd3d1349e0a918081fb1c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

MD5
637481df32351129e60560d5a5c100b5

SHA1
a46aee6e5a4a4893fba5806bcc14fc7fb3ce80ae

SHA256
1f1029d94ca4656a577d554cedd79d447658f475af08620084897a5523587052

SHA512
604bfd0a78a57dfddd45872803501ad89491e37e89e0778b0f13644fa9164ff509955a57469dfdd65a05bbedaf0acb669f68430e84800d17efe7d360a70569e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63

MD5
a7d36d47a2ba0fbb942f5f71c1c66885

SHA1
306e067b39bdeb1048f70053f045a796f4a96686

SHA256
bf853bf9a2d454c39fb8332ccb57736b1d5e8a74e1007d038e1cd6e1b9b1a367

SHA512
d89e6764d960b7e0fe781457b9ddb31f36cf452a4045cac3ea48078070c082f41efe3f57a7f84ed4d957e6ade9e28ffa2062e736171c18f314151d3e363e6647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5
fe6d5380e9c5cffd6211dead8e43b907

SHA1
a83440c0e7ba316311107f7be44ff732a1c610e9

SHA256
f619ec4769d67c2a988a56d141da8b2b53270d6c39b1e51b50d24cdf96340bb9

SHA512
41e44e88fec5b78af8c84bd1a0e3f4ae84aae39c8293906e500d8c193f7767d2eba082304f96f82ec6aa139d094220935add09869c94a8d21777fbb510194fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\rx62z5k\imagestore.dat

MD5
c8131d13b5ae3853c5f505e8830e339a

SHA1
e172c8239606fb973acd1ce0d0442cf870a08deb

SHA256
239067f93e786a24488363ffdd99fd1c92f69423e4708b59573ef625561c89c9

SHA512
3ad317b3fe61a5fb0dc5b4674a81103fa353f096585d47cd05ee2d1877242f689fa1e32bd27a95042a14360ecfc832e047f7216fd1b4b8869b1462bae5807015

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0DICDEFK.txt

MD5
f65600b1d7032b4005d3798954e4c4b0

SHA1
9c620217bcb4723f994631c1bc03f4d4c6c90e78

SHA256
fd86ed7dde2dbe9e714577549a272076ee60529caed825ba594b07b92b98f5fd

SHA512
bbc8580ad55490a2016d9023fa91962499741194379378af0b8a2b9573fada40136fe394d1100c734de8af345ca3fae5491f7e175304fed06c5212b79e470254

Download Submit
memory/1628-54-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing