78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5

General

Target

78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5.exe
Size

2.4MB
MD5

791da1c01b6b87bb3d5ec4673f4546e2
SHA1

c6700c5494f1658f3059bc9872609e6e9e8694bb
SHA256

78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5
SHA512

33861f68d2dce833f6dd290a1e277afb3923c1f7e501198ca58c8ed76bce5a505812723bdcccabad9ba83f95ee21da819c6c76599e98a79446fafc63f67c8f64

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "354498576"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c05ebed0eb3bd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAFEEEF0-A7DE-11EC-A46B-FAD28856B159} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e500000000020000000000106600000001000020000000e2ca41072ae7757398e7ed627bdaa3ea1d6ce57893a90d692a985231c04bc81a000000000e800000000200002000000010c71685c3344c46930ed27b440cc256fabd37664bf929e3798ebd975452fbd190000000cf7c7ebb21d0d3134447c4ff9091081789ce068808054e978b257dc7e3c0fb8a8d329dfc077a92847f26e86dfa7a2c03002fe21a952cde01b0c3336f186817cd2de801e1f8516b128f141130cc6b6ccc1ecf9b76ea2c5439f92a4bebbf38eb24bf407141fc5727e9c66b127d0b863005daf694b188fe45e5d243a80d31fd2f0512d218963ce1973a4ead12d8529a673c4000000094213a3146b5ec6717efb1fb6227d327aef79959eab89a636bebbcc11711e8441042d0b5c557212c7bfad2b1956c1f7c1ce8f751ada7de28fcf005d27f630567	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004dda8e4cddf84341b86bc814e98354e5000000000200000000001066000000010000200000004aa22541b79231de7f61be56a4c54a54ef2c549d2c8d662f5edc04281747f07f000000000e8000000002000020000000b78c0c5ce3a13f273ac702d6877703b3947f06fda35e5664ddb1b4174de0b5b4200000004da496d253d462210a6024ae0e12b1f2537595c5168213c827ce7de6db940370400000006cd0fdf5d34ef3b77d2b44d85732c6fecd55771695b4644608d052891eacf7d3938f17478e851046462360e1d239abfe08f81538a5fdea9d56e56e69e2156889	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1752 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1752 iexplore.exe
1752 iexplore.exe
1444 IEXPLORE.EXE
1444 IEXPLORE.EXE
1444 IEXPLORE.EXE
1444 IEXPLORE.EXE

pid	process
1752	iexplore.exe

pid	process
1752	iexplore.exe
1752	iexplore.exe
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5.exeiexplore.exe

description	pid	process	target process
PID 1652 wrote to memory of 1752	1652	78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5.exe	iexplore.exe
PID 1652 wrote to memory of 1752	1652	78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5.exe	iexplore.exe
PID 1652 wrote to memory of 1752	1652	78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5.exe	iexplore.exe
PID 1752 wrote to memory of 1444	1752	iexplore.exe	IEXPLORE.EXE
PID 1752 wrote to memory of 1444	1752	iexplore.exe	IEXPLORE.EXE
PID 1752 wrote to memory of 1444	1752	iexplore.exe	IEXPLORE.EXE
PID 1752 wrote to memory of 1444	1752	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5.exe
"C:\Users\Admin\AppData\Local\Temp\78033e74ed996845b50335f09ac669af486cd3089776c9bf26804c808fa479b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=5.0.1&gui=true
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1752

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1752 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
7d4d0a79e5f9021448cf3263c613b23b

SHA1
2a396871fd8379dd36dbfd19d216f7dbbce8c260

SHA256
14d9538d97987aba2ca9ae6acc58b2054f4719f85779d6776a3b0769de5438a9

SHA512
cd8be4bb90a23575890e30f0db30956477606ea4de4aec3ccde8a85d44fff513f6799bfceaa458ec4cca40f79e123cee4e30864c9f147bc3518b3d88e511ea16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63
MD5
f991424e80315b3ec78a0307bd744441

SHA1
6d9d9c914d642696a112e2a499de344cabaaf17b

SHA256
306cc6edc7356905ec448c21fd20a649449c0ac3c5ec8b542951f0e253270aa1

SHA512
7a8bae8c00af52925c1417f235d23d9b2719f4e7139154e3daca9d5147168e9d2ef5fc5dbb0917b6d6cc4f101c41f7db944a96031dc6cdb5eff9e4e66ae88e94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
8afc55192a5397d790765790a26ed60d

SHA1
3789c8911d441b60b861e322407cd6fa306e3418

SHA256
7468297a43b00d84cebe242de04c3f0074cfc08f9feb39d9d942934cb05e61e4

SHA512
3b9bb07eaee9daee96227b60972cfdbda984892f54de93a32256287408521bcfbba0b3bb3c3fbbe08fa2188351a6879e3b5269ab6a625db574e0b29b21272cb3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\48DZ56VS.txt
MD5
d07aaca21cda48a0c6f67a525e80bce6

SHA1
8b72c783856cc2ed314f7d036dae5481d57e8172

SHA256
a668bb640abfb5ebadb49367a1cba43b432fbf9132d4cf200fa92faad936c3d4

SHA512
595919d98a160692abdb1fb428b25b8f935adc5a20b90a370adf294a35dc57f057b1d884a9632565304e0dbf9121ae5d3769ee771e22213f745e21d00fd5fecc

Download Submit
memory/1652-54-0x000007FEFB831000-0x000007FEFB833000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing