Analysis
-
max time kernel
72s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-04-2022 15:34
Static task
static1
Behavioral task
behavioral1
Sample
99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe
Resource
win7-20220414-en
General
-
Target
99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe
-
Size
289KB
-
MD5
9c5d2ad17b6e100bf79c7ac19de0b289
-
SHA1
7da2598504baaed90d03a647da4dcf8521e8aa83
-
SHA256
99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf
-
SHA512
38a95d72dcfe0a24463d628fa0990c1f3c44fd47303071b17fd1a43707438a6a33a74ee3c9ba7f7b255db3e2401d9486938ec2bc5189d22870c484f27a0400c3
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Windows\iksaxu.dll acprotect -
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in Windows directory 3 IoCs
Processes:
99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exedescription ioc process File created C:\Windows\ILCINOBFOCO 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe File created C:\Windows\iksaxu.dll 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe File opened for modification C:\Windows\iksaxu.dll 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A85294C1-BCF0-11EC-97AC-726C518001C0} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000f3c14e964054be32ce1a3dbdf10cfbbf23e7a6de3ee23ffa4717aea507bdf254000000000e8000000002000020000000dbd04c275d73864d98b19421a177d7e10d5fac4feef9f0ad0c007bab95fca353900000005bd8b7ce04ffd82cbf0a2fc990a4ac30d22e16d313da6ddbd343539d1638c2c7f7bca67ada0d5c54b922e0e42a5056f45df13a4dd08ed791a5a7e0d33d212d734c3d3862a71aeb0d4a4f0b23de1fc0b62bf8100e93a8210cc7f2f491bfbf2664308fc61e3ee0db950f621965a1ecb404ef827bce0af8aa1035bb28ac3e3d2facb96e1db773ba3ef68b16f77221f4192740000000832dd49f681e760675363ed1cdf0fa10299ea71300e62a0f9c7f7f86b8096fa3f1f79c36797a2102738674e179fba81033a37ef913b286d1b8f378622cd1ab70 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d048f983fd50d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000d584784259d60b91737b17ac690315faaa29697933bcb1e22e1b2d7aed1edd26000000000e8000000002000020000000f36187bb6655de1d11d994817eed1b58edf8678023bd8dfd9b77981f62f6a8e120000000f6f86a9fcf734178fc3345b71322cd2d25a9db75675e581cee9a78498d84764d4000000015491cb2a155773a820765ce269d4955e88f904bb947f3d3e28df85474a3908dfbe589629b06b56d77c693920be076163e71f68cd66d68f4d0509e55c5a84fd0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356815214" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Modifies registry class 55 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\Clsid\ = "{C12FC24B-A7B9-487F-9603-5481EBF00C6F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\AppID = "{C12FC24B-A7B9-487F-9603-5481EBF00C6F}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\HELPDIR\ = "C:\\Windows\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\ = "SVC plugin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\ = "YouTube plugin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\0\win32\ = "C:\\Windows\\iksaxu.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\InprocServer32\ = "C:\\Windows\\iksaxu.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\LocalizedString = "@C:\\Windows\\iksaxu.dll,-313" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\ = "SVC plugin" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib\ = "{6549E485-C533-4E58-BA92-9FBCD2F6E839}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\TypeLib\ = "{6549E485-C533-4E58-BA92-9FBCD2F6E839}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Elevation regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\iksaxu.dll\AppID = "{C12FC24B-A7B9-487F-9603-5481EBF00C6F}" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\iksaxu.dll regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ = "IntfVideo" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\DllSurrogate regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\ProgID\ = "bho.bho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\Clsid regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ = "IntfVideo" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib\ = "{6549E485-C533-4E58-BA92-9FBCD2F6E839}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib\Version = "1.0" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Elevation\Enabled = "1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\ = "SVC plugin" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ProxyStubClsid32 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exepid process 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 1292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 1292 iexplore.exe 1292 iexplore.exe 880 IEXPLORE.EXE 880 IEXPLORE.EXE 880 IEXPLORE.EXE 880 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exeiexplore.exedescription pid process target process PID 1836 wrote to memory of 1364 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe regsvr32.exe PID 1836 wrote to memory of 1364 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe regsvr32.exe PID 1836 wrote to memory of 1364 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe regsvr32.exe PID 1836 wrote to memory of 1364 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe regsvr32.exe PID 1836 wrote to memory of 1364 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe regsvr32.exe PID 1836 wrote to memory of 1364 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe regsvr32.exe PID 1836 wrote to memory of 1364 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe regsvr32.exe PID 1836 wrote to memory of 1292 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe iexplore.exe PID 1836 wrote to memory of 1292 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe iexplore.exe PID 1836 wrote to memory of 1292 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe iexplore.exe PID 1836 wrote to memory of 1292 1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe iexplore.exe PID 1292 wrote to memory of 880 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 880 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 880 1292 iexplore.exe IEXPLORE.EXE PID 1292 wrote to memory of 880 1292 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe"C:\Users\Admin\AppData\Local\Temp\99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\iksaxu.dll"2⤵
- Modifies registry class
PID:1364 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com/search?q=sex download2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:880
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD51aad4b1cacdbf2eb397513983f3f2670
SHA1c8cdded970e432d39833539537d5261ef6fbf00d
SHA256201aa109569f75a3a59dc9c0ba30ec100cc728fe946f50a3ce4667a4354b70e4
SHA51226b9e290f8e5d806240a4a3151a79b1e4446ef923bc6c0fffd9d12a29d469899c9012110e39e0e25df5a10baf193c66967186e26631b405dec58fca96ea431ec
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\k007hrg\imagestore.datFilesize
9KB
MD5fded2f2767fa0333d7fd32bf9152bd5d
SHA14ab3348854b079e810325b6d7da3327c11334cd4
SHA256f4b26a228141ff72d1d7f9a16475d087dbcb980907349b3783f2e47094f09356
SHA512814185ee40a4365e5d14962b00c60491fc4415625de3f6bed668f153c291b09de2185c2903e8cac27cbae53e968a6ee6effa22734dac8b2e125b61f4728afb4c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LUKR5PVZ.txtFilesize
604B
MD52f6ac2ee2114edcdd4a698224f75d827
SHA127f3eb20de2f560fcf97ccebb5c7d6809f691a14
SHA256bc393d182616a0510f55ac376d96a17a6a7d4e6a8b09ce8716f3b9f997bf1b0c
SHA512523b0774b0f8f30af8ba5d9fe261029e83a4fdaa65ac3320d0d653d1d4006d5a80b67242700c1a3e61048fa018ea690790b40c0499ce4a038124e505e88e1769
-
C:\Windows\iksaxu.dllFilesize
246KB
MD5c90370a618f0505e6d190c6fa175aeaa
SHA17a260db073f691c3679bd1e8cf17ba934d290b18
SHA256ae87350bcdda0fba4914ae063686574767ac37794fb9355125e27030fd17ae97
SHA5127315ae09c0b3f0f8a3e35c3360a93d2381ebba3c515a3dee138fad9dc22b527684f988057e3f3f4e502d9f4d4c99591d83e2a3eed0f573819dac8885bfa44486
-
memory/1364-55-0x0000000000000000-mapping.dmp
-
memory/1836-54-0x0000000075501000-0x0000000075503000-memory.dmpFilesize
8KB