d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941

General

Target

d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe
Size

47KB
MD5

03b7e356bdc47452c7710c566d33b12d
SHA1

dd2f19962dadeba05a5299b32343fb37221af0b9
SHA256

d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941
SHA512

d77a717048797e9328c7cdc17eba4b32b03c84fabf8530e10dc82b3e7839f1a63487eb5f07eb9bb3aa2451abaeed3ab7b23d866c078f0161b22357e792457166

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

Processes:

d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Webhost.pif	d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe
File created	C:\Windows\SysWOW64\Webnec.pif	d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d75c1ccc4ad801	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ac970f6e21c8045b4ad45959768992c00000000020000000000106600000001000020000000db12cd6218e755aaf0676e6a2096d3d956c64d13afddfc1dc986e4fcd296a2c5000000000e8000000002000020000000546d25a6b176e019d74927fd68c83bd8bb4fb814ab081ae21aee3211e922c72420000000be07f3e15e9d02f00ba0dd4ba2f37b83157c59b9033971d3f08d0b79373cc167400000005359765180ffc3aed0e2c92c51f2da3bb42828f1bf7869375f5964778a69399f8ea989d3cac6cd2e96742a494f4dcbf7e97ccd2d588896de0468bd2894b09187	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002ac970f6e21c8045b4ad45959768992c00000000020000000000106600000001000020000000825c5ba53b730f33089401618cf6f3760c4411f13def2d78c904d6eae6184f51000000000e800000000200002000000037811be13c7b597c547c944a7fdd5288168a44b3628620e11c64a3eefb6a14e49000000070df7975c97b271ec8a0106ff5f443b30d214cdebebe8f0f75c7b1212ffe3c8197cee0863c405f567d7c544a5cf1cdc5c92192c4f5d2438a47ea56ca8849dae54415abbf89da4a780380af45053695b94279e5c2ce2aa111bbe1b008276be6515b5e81886b77977b5e5bb3b2031711a4d5eb591bababf50069bd6aed40c286e81613480e5002c9331539e9b46ce4e127400000002218cf8c98ea12399260a2f5e9804ce6f5ad70f6074a840f03ad4276402625976de6ecae5f6caf198e593fe01e8c8eb0e3930ca65c30334e00fd35af32995059	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BB4DBC1-B6BF-11EC-97B7-C270349D506E} = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356134278"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

1416 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

1416 IEXPLORE.EXE
1416 IEXPLORE.EXE
1916 IEXPLORE.EXE
1916 IEXPLORE.EXE
1916 IEXPLORE.EXE
1916 IEXPLORE.EXE

pid	process
1416	IEXPLORE.EXE

pid	process
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE
1916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 1796 wrote to memory of 808	1796	d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe	iexplore.exe
PID 1796 wrote to memory of 808	1796	d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe	iexplore.exe
PID 1796 wrote to memory of 808	1796	d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe	iexplore.exe
PID 1796 wrote to memory of 808	1796	d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe	iexplore.exe
PID 808 wrote to memory of 1416	808	iexplore.exe	IEXPLORE.EXE
PID 808 wrote to memory of 1416	808	iexplore.exe	IEXPLORE.EXE
PID 808 wrote to memory of 1416	808	iexplore.exe	IEXPLORE.EXE
PID 808 wrote to memory of 1416	808	iexplore.exe	IEXPLORE.EXE
PID 1416 wrote to memory of 1916	1416	IEXPLORE.EXE	IEXPLORE.EXE
PID 1416 wrote to memory of 1916	1416	IEXPLORE.EXE	IEXPLORE.EXE
PID 1416 wrote to memory of 1916	1416	IEXPLORE.EXE	IEXPLORE.EXE
PID 1416 wrote to memory of 1916	1416	IEXPLORE.EXE	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe
"C:\Users\Admin\AppData\Local\Temp\d1a2a1e22c9667d4ff6c4a89a0e43473e79c4d89b4690176361550aaf4352941.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1796

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" www.google.com.br
2⤵
- Suspicious use of WriteProcessMemory
PID:808

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" www.google.com.br
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1416

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1416 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
68c1395cf6359ef556a43626081a1831

SHA1
f29940a1b066a7f977515479aa3fcde6b357f71b

SHA256
357de816e7796dd7e9a441a980388611ce78cb7acdbc9edb923616c7aa6ef868

SHA512
487eab1afa9e44f724af74d8eeb5f56e94ba8493dcb0ebb8b1052691544de41734c7e80331006cfdad2880313f6b9adae30aa647556e4f81912bd65e8d0901fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\b1rou5u\imagestore.dat
Filesize
9KB

MD5
d7dfeb4fd89dac7ee7785ff7783482d3

SHA1
37e5780b3d45f3cb4e1d61f0e68d33f727f2a90b

SHA256
13739f20d2850d570828ec336a75c5a40faad0b3f3e3b6add9a32d1d84192552

SHA512
3cf11e3341c6a11ba5b99ec6bb32e81b635e00a1c00ed2917e56bcf2d094c344f04a31cc01819372498200094af5d7ad93ac020a920efce7016f3a91b293d0d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\T56ZV2EU.txt
Filesize
595B

MD5
a60d8d1f97c7b95223c6433bc21eb355

SHA1
62712e596a3a1d846c676dceef4c3722049c74bc

SHA256
9ff146c6c3701d1d966748b6a3ebfc8b5f36f015aa5a49324b1c4debf3c1a87a

SHA512
e4cf8808faee6abbac00f0db5aeb47c3709714ab9a2881ccc9e11b199eabd564b31d70d8cbffd38fd24fe374350bbe4feabc88e1444e93c8536ff55a13639f90

Download Submit
memory/1796-54-0x0000000075A51000-0x0000000075A53000-memory.dmp

Filesize
8KB

Download
memory/1796-55-0x00000000002A0000-0x00000000002A2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads