99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf

General

Target

99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe
Size

289KB
MD5

9c5d2ad17b6e100bf79c7ac19de0b289
SHA1

7da2598504baaed90d03a647da4dcf8521e8aa83
SHA256

99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf
SHA512

38a95d72dcfe0a24463d628fa0990c1f3c44fd47303071b17fd1a43707438a6a33a74ee3c9ba7f7b255db3e2401d9486938ec2bc5189d22870c484f27a0400c3

Score

9^/10

adware stealer

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Windows\iksaxu.dll	acprotect

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

Drops file in Windows directory 3 IoCs

Processes:

99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe

description	ioc	process
File created	C:\Windows\ILCINOBFOCO	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe
File created	C:\Windows\iksaxu.dll	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe
File opened for modification	C:\Windows\iksaxu.dll	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A85294C1-BCF0-11EC-97AC-726C518001C0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000f3c14e964054be32ce1a3dbdf10cfbbf23e7a6de3ee23ffa4717aea507bdf254000000000e8000000002000020000000dbd04c275d73864d98b19421a177d7e10d5fac4feef9f0ad0c007bab95fca353900000005bd8b7ce04ffd82cbf0a2fc990a4ac30d22e16d313da6ddbd343539d1638c2c7f7bca67ada0d5c54b922e0e42a5056f45df13a4dd08ed791a5a7e0d33d212d734c3d3862a71aeb0d4a4f0b23de1fc0b62bf8100e93a8210cc7f2f491bfbf2664308fc61e3ee0db950f621965a1ecb404ef827bce0af8aa1035bb28ac3e3d2facb96e1db773ba3ef68b16f77221f4192740000000832dd49f681e760675363ed1cdf0fa10299ea71300e62a0f9c7f7f86b8096fa3f1f79c36797a2102738674e179fba81033a37ef913b286d1b8f378622cd1ab70	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d048f983fd50d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000d584784259d60b91737b17ac690315faaa29697933bcb1e22e1b2d7aed1edd26000000000e8000000002000020000000f36187bb6655de1d11d994817eed1b58edf8678023bd8dfd9b77981f62f6a8e120000000f6f86a9fcf734178fc3345b71322cd2d25a9db75675e581cee9a78498d84764d4000000015491cb2a155773a820765ce269d4955e88f904bb947f3d3e28df85474a3908dfbe589629b06b56d77c693920be076163e71f68cd66d68f4d0509e55c5a84fd0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "356815214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies registry class 55 IoCs

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\Clsid\ = "{C12FC24B-A7B9-487F-9603-5481EBF00C6F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\AppID = "{C12FC24B-A7B9-487F-9603-5481EBF00C6F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\HELPDIR\ = "C:\\Windows\\"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\ = "SVC plugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\ = "YouTube plugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\0\win32\ = "C:\\Windows\\iksaxu.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\InprocServer32\ = "C:\\Windows\\iksaxu.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\LocalizedString = "@C:\\Windows\\iksaxu.dll,-313"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\ = "SVC plugin"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib\ = "{6549E485-C533-4E58-BA92-9FBCD2F6E839}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\TypeLib\ = "{6549E485-C533-4E58-BA92-9FBCD2F6E839}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Elevation	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\iksaxu.dll\AppID = "{C12FC24B-A7B9-487F-9603-5481EBF00C6F}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\AccessPermission = 01000480440000005400000000000000140000000200300002000000000014000300000001010000000000050400000000001400030000000101000000000005120000000102000000000005200000002002000001020000000000052000000020020000	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\iksaxu.dll	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ = "IntfVideo"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\DllSurrogate	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\ProgID\ = "bho.bho"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bho.bho\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ = "IntfVideo"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib\ = "{6549E485-C533-4E58-BA92-9FBCD2F6E839}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\Elevation\Enabled = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6549E485-C533-4E58-BA92-9FBCD2F6E839}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C12FC24B-A7B9-487F-9603-5481EBF00C6F}\ = "SVC plugin"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{16C65D96-EF19-4439-A6EA-F73A8BEC4DF0}\ProxyStubClsid32	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe

pid process

1836 99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1292 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1292 iexplore.exe
1292 iexplore.exe
880 IEXPLORE.EXE
880 IEXPLORE.EXE
880 IEXPLORE.EXE
880 IEXPLORE.EXE

pid	process
1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe

pid	process
1292	iexplore.exe

pid	process
1292	iexplore.exe
1292	iexplore.exe
880	IEXPLORE.EXE
880	IEXPLORE.EXE
880	IEXPLORE.EXE
880	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exeiexplore.exe

description	pid	process	target process
PID 1836 wrote to memory of 1364	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	regsvr32.exe
PID 1836 wrote to memory of 1364	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	regsvr32.exe
PID 1836 wrote to memory of 1364	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	regsvr32.exe
PID 1836 wrote to memory of 1364	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	regsvr32.exe
PID 1836 wrote to memory of 1364	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	regsvr32.exe
PID 1836 wrote to memory of 1364	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	regsvr32.exe
PID 1836 wrote to memory of 1364	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	regsvr32.exe
PID 1836 wrote to memory of 1292	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	iexplore.exe
PID 1836 wrote to memory of 1292	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	iexplore.exe
PID 1836 wrote to memory of 1292	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	iexplore.exe
PID 1836 wrote to memory of 1292	1836	99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe	iexplore.exe
PID 1292 wrote to memory of 880	1292	iexplore.exe	IEXPLORE.EXE
PID 1292 wrote to memory of 880	1292	iexplore.exe	IEXPLORE.EXE
PID 1292 wrote to memory of 880	1292	iexplore.exe	IEXPLORE.EXE
PID 1292 wrote to memory of 880	1292	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe
"C:\Users\Admin\AppData\Local\Temp\99ecb8fe08339f5a1ef6790d2102b38f7b17cf8f74a258f6020ab2075b2734bf.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\iksaxu.dll"
2⤵
- Modifies registry class
PID:1364

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.google.com/search?q=sex download
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1aad4b1cacdbf2eb397513983f3f2670

SHA1
c8cdded970e432d39833539537d5261ef6fbf00d

SHA256
201aa109569f75a3a59dc9c0ba30ec100cc728fe946f50a3ce4667a4354b70e4

SHA512
26b9e290f8e5d806240a4a3151a79b1e4446ef923bc6c0fffd9d12a29d469899c9012110e39e0e25df5a10baf193c66967186e26631b405dec58fca96ea431ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\k007hrg\imagestore.dat
Filesize
9KB

MD5
fded2f2767fa0333d7fd32bf9152bd5d

SHA1
4ab3348854b079e810325b6d7da3327c11334cd4

SHA256
f4b26a228141ff72d1d7f9a16475d087dbcb980907349b3783f2e47094f09356

SHA512
814185ee40a4365e5d14962b00c60491fc4415625de3f6bed668f153c291b09de2185c2903e8cac27cbae53e968a6ee6effa22734dac8b2e125b61f4728afb4c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LUKR5PVZ.txt
Filesize
604B

MD5
2f6ac2ee2114edcdd4a698224f75d827

SHA1
27f3eb20de2f560fcf97ccebb5c7d6809f691a14

SHA256
bc393d182616a0510f55ac376d96a17a6a7d4e6a8b09ce8716f3b9f997bf1b0c

SHA512
523b0774b0f8f30af8ba5d9fe261029e83a4fdaa65ac3320d0d653d1d4006d5a80b67242700c1a3e61048fa018ea690790b40c0499ce4a038124e505e88e1769

Download Submit
C:\Windows\iksaxu.dll
Filesize
246KB

MD5
c90370a618f0505e6d190c6fa175aeaa

SHA1
7a260db073f691c3679bd1e8cf17ba934d290b18

SHA256
ae87350bcdda0fba4914ae063686574767ac37794fb9355125e27030fd17ae97

SHA512
7315ae09c0b3f0f8a3e35c3360a93d2381ebba3c515a3dee138fad9dc22b527684f988057e3f3f4e502d9f4d4c99591d83e2a3eed0f573819dac8885bfa44486

Download Submit
memory/1364-55-0x0000000000000000-mapping.dmp

Download
memory/1836-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads