General
Target

bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe

Filesize

24KB

Completed

03-04-2022 04:48

Task

behavioral1

Score
3/10
MD5

0d9cdf4a04cbd4ad7d58d777f5cdd5cf

SHA1

3e4909844bfe19cd4a239052e3f4a043c915d269

SHA256

bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510

SHA512

905cff6972682d02afad4c7decc680004f82ac1bdbef686a03414055dace8eaaf4a1c080af7afd8dffe61412046bdbf3e76cf77132a9afef5dfd47f6787e0e41

Malware Config
Signatures 5

Filter: none

Defense Evasion
Discovery
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Modifies Internet Explorer settings
    iexplore.exeIEXPLORE.EXE

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lvIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\Total = "67"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MINIEiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\TotalIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "67"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\Total = "93"IEXPLORE.EXE
    Set value (data)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f2c0bd9fd0fc1c4d8404f89f10ad210100000000020000000000106600000001000020000000757b5ba5c2a9b968c228bb5b9d6b1e0a867211ee577cfb8d67571509f87e5fc7000000000e8000000002000020000000b1d1e456ea39175767c8b5483d9c93bcd328699b296332f6d35e0280a250c1b72000000012320951d52d6c92708393f3dd418f872c9e4cbfc48cad4c5317593ff2ed6aef400000005fa6396308258d84afe23b3d906c0bee7b8d3be3a1468fb7fd9530b2ede8c74aa878a8f65c9ecf56d369fcda6f3c2ab203412a51290d024a13fd20974f7349a7iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c522a82647d801iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "119"IEXPLORE.EXE
    Set value (str)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\IntelliFormsiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\NumberOfSubdomains = "1"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\Total = "15"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\Total = "41"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "151"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorageIEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\Total = "151"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearchIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsingiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\GPUiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\InternetRegistryiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\PageSetupiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Toolbariexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\LowRegistryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "41"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\Total = "119"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "151"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowseriexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecoveryiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "15"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "119"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C50D1530-B319-11EC-8DCF-D227F1C4769D} = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "41"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "93"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\IETld\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Zoomiexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"iexplore.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\adult.oo.lv\ = "67"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "15"IEXPLORE.EXE
    Set value (int)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "93"IEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Mainiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMiciexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorageiexplore.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"iexplore.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f2c0bd9fd0fc1c4d8404f89f10ad210100000000020000000000106600000001000020000000771d9ee8f24ae5a1947cef7285ed14cbd8752169e379d226184cf70cc8d62431000000000e8000000002000020000000754039a2de6ca5f60a315a4cd1777a7f2815de07ebfb5c3138c7bce6eee2535890000000126c1d7bd18cc7932c274ddabc1c2239568ea7acc8b38c6733745f1c7f41580cd2c48b54d55f30784fe9f4054d9d0a25857860025487eba436998a813235de7e13f067e4265a84fa5828251c5697865692443beb293064f04f0542edbdb8215fbfd0fd00a97edfb75a0a5d22f4bef7e462a7ddb009dee147af6db151d0e9bf163df3ae49cdb7ce6e7f7fdf74f73e903f400000006c80d7e4d22e062604cdcf697ee867efdc6d8f468995818c4f924742940fdef43b08f53c6b0363363d8f9db411064ea93bd14ac48296b2d873f8331a6cb9fb56iexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActiveiexplore.exe
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MainIEXPLORE.EXE
    Key created\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageiexplore.exe
  • Suspicious use of FindShellTrayWindow
    iexplore.exe

    Reported IOCs

    pidprocess
    1600iexplore.exe
  • Suspicious use of SetWindowsHookEx
    iexplore.exeIEXPLORE.EXE

    Reported IOCs

    pidprocess
    1600iexplore.exe
    1600iexplore.exe
    1840IEXPLORE.EXE
    1840IEXPLORE.EXE
  • Suspicious use of WriteProcessMemory
    bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exeiexplore.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1480 wrote to memory of 17641480bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exewscript.exe
    PID 1480 wrote to memory of 17641480bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exewscript.exe
    PID 1480 wrote to memory of 17641480bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exewscript.exe
    PID 1480 wrote to memory of 17641480bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exewscript.exe
    PID 1600 wrote to memory of 18401600iexplore.exeIEXPLORE.EXE
    PID 1600 wrote to memory of 18401600iexplore.exeIEXPLORE.EXE
    PID 1600 wrote to memory of 18401600iexplore.exeIEXPLORE.EXE
    PID 1600 wrote to memory of 18401600iexplore.exeIEXPLORE.EXE
Processes 4
  • C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe
    "C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe"
    Suspicious use of WriteProcessMemory
    PID:1480
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\system32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\OLbPoNJH.js" "C:\Users\Admin\AppData\Local\Temp\bbe7f26bcc02ee60e972c1b094be7944146a53f886b249b3f977a8f871a22510.exe"
      PID:1764
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    Modifies Internet Explorer settings
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1600 CREDAT:275457 /prefetch:2
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1840
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\OLbPoNJH.js

                        MD5

                        3055ff6048a60e79a704001c8b7a0cdd

                        SHA1

                        c793381bcc5ae2e1da599352eb74131a6790c224

                        SHA256

                        6f739f14f1d4dec5d4a62f91cd63caa98766874e9b25cae430990137ad812f37

                        SHA512

                        e4ee9df4b1c7ee75feb331fa2a597b6dfdf83ed714a753a9278b22eabc389ca78aad48609811ce913ebbb7d7ac01c02f7f495aba7d9c244fa31e7f367d906fc1

                      • memory/1480-54-0x0000000076E21000-0x0000000076E23000-memory.dmp

                      • memory/1764-55-0x0000000000000000-mapping.dmp

                      • memory/1764-58-0x0000000000230000-0x0000000000232000-memory.dmp