9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b

General

Target

9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe
Size

29KB
MD5

58df37c8507c0b74befe67dfb16b2aef
SHA1

dd07379b9c544cc3df5261e92b3a043d1a8e1a9a
SHA256

9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b
SHA512

77449ff17eb82dd1f6d78e533381c46b704997893d0b08848c6b2ac53b5b2b2a121d7dba97f1e9b750dfbf67de45da162c8c639a3871f6736faf48b3a81cf7a5

Score

7^/10

adware stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exeregsvr32.exe

pid process

2044 9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe
1164 regsvr32.exe
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

pid	process
2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe
1164	regsvr32.exe

Drops file in System32 directory 3 IoCs

Processes:

9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\9_tem.dll	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe
File created	C:\Windows\SysWOW64\IEAPIHELP.dll	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe
File opened for modification	C:\Windows\SysWOW64\IEAPIHELP.dll	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAAC83E1-C676-11EC-B9E3-66AE473A865F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "357862333"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Modifies registry class 42 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEOpenObj.IEOpenObj.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEOpenObj.IEOpenObj.1\ = "IEOpenObj Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\VersionIndependentProgID\ = "IEOpenObj.IEOpenObj"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEOpenObj.IEOpenObj\ = "IEOpenObj Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\ = "IEOpenObj Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEOpenObj.IEOpenObj.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEOpenObj.IEOpenObj\CurVer\ = "IEOpenObj.IEOpenObj.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\IEAPIHELP.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\ = "IIEOpenObj"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\TypeLib\ = "{31E055B2-4587-490D-BD22-46B0EC575D22}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEOpenObj.IEOpenObj\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\InprocServer32\ = "C:\\Windows\\SysWow64\\IEAPIH~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0\ = "IEOpened 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IEOpenObj.IEOpenObj.1\CLSID\ = "{31E055A0-4587-490d-BD22-46B0EC575D22}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\ProgID\ = "IEOpenObj.IEOpenObj.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{31E055B2-4587-490D-BD22-46B0EC575D22}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\TypeLib\ = "{31E055B2-4587-490D-BD22-46B0EC575D22}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IEOpenObj.IEOpenObj	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31E055A0-4587-490d-BD22-46B0EC575D22}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\ = "IIEOpenObj"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E055BF-4587-490D-BD22-46B0EC575D22}\ProxyStubClsid32	regsvr32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1640 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1640 iexplore.exe
1640 iexplore.exe
1636 IEXPLORE.EXE
1636 IEXPLORE.EXE
1636 IEXPLORE.EXE
1636 IEXPLORE.EXE

pid	process
1640	iexplore.exe

pid	process
1640	iexplore.exe
1640	iexplore.exe
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE
1636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exeiexplore.exe

description	pid	process	target process
PID 2044 wrote to memory of 1164	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	regsvr32.exe
PID 2044 wrote to memory of 1164	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	regsvr32.exe
PID 2044 wrote to memory of 1164	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	regsvr32.exe
PID 2044 wrote to memory of 1164	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	regsvr32.exe
PID 2044 wrote to memory of 1164	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	regsvr32.exe
PID 2044 wrote to memory of 1164	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	regsvr32.exe
PID 2044 wrote to memory of 1164	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	regsvr32.exe
PID 2044 wrote to memory of 1640	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	iexplore.exe
PID 2044 wrote to memory of 1640	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	iexplore.exe
PID 2044 wrote to memory of 1640	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	iexplore.exe
PID 2044 wrote to memory of 1640	2044	9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe	iexplore.exe
PID 1640 wrote to memory of 1636	1640	iexplore.exe	IEXPLORE.EXE
PID 1640 wrote to memory of 1636	1640	iexplore.exe	IEXPLORE.EXE
PID 1640 wrote to memory of 1636	1640	iexplore.exe	IEXPLORE.EXE
PID 1640 wrote to memory of 1636	1640	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe
"C:\Users\Admin\AppData\Local\Temp\9b7d59409a7bae930aaf6a7c86f8f6c000819667170d0210be8497642443233b.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\system32\regsvr32.exe" /s /c C:\Windows\system32\IEAPIHELP.dll
2⤵
- Loads dropped DLL
- Modifies registry class
PID:1164

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PARNG7WW.txt
Filesize
602B

MD5
68e4eedebee2ee057dbc289eb3ebebae

SHA1
2361c5cf16d653c4eec8b8d65ec1f23259b5f0f7

SHA256
7b62904348443e32ae9faf1946aa636b5577b09cc872d0b625f927073ec72f3d

SHA512
03faa9fa6d5df4f8f8746573a6facee2be1d344a4cd7f76cf6dbbad9c63690f27f030f91585a3147ad290331d14ec5a13c0cc2ae54c5e15fc42d7ca26b9ec8fa

Download Submit
C:\Windows\SysWOW64\IEAPIHELP.dll
Filesize
54KB

MD5
178a450d7c626f9b86bf5a63b16d2903

SHA1
9efe387993875936f9a2ca96c9a2aaab412ef459

SHA256
0c1a8d5d9acf0cb2591342225a806ab20d7ac7c32715326d2ee5f833bc87ece0

SHA512
2b0475927469b5d0d2804ebb21c8e846f2968f7033edae19e9cef297ad7f427ce26df1cfc43fe6a299c22a5da5a7d4880aa74c72f9357a760b644a8c48da8df5

Download Submit
\Windows\SysWOW64\9_tem.dll
Filesize
54KB

MD5
178a450d7c626f9b86bf5a63b16d2903

SHA1
9efe387993875936f9a2ca96c9a2aaab412ef459

SHA256
0c1a8d5d9acf0cb2591342225a806ab20d7ac7c32715326d2ee5f833bc87ece0

SHA512
2b0475927469b5d0d2804ebb21c8e846f2968f7033edae19e9cef297ad7f427ce26df1cfc43fe6a299c22a5da5a7d4880aa74c72f9357a760b644a8c48da8df5

Download Submit
\Windows\SysWOW64\IEAPIHELP.dll
Filesize
54KB

MD5
178a450d7c626f9b86bf5a63b16d2903

SHA1
9efe387993875936f9a2ca96c9a2aaab412ef459

SHA256
0c1a8d5d9acf0cb2591342225a806ab20d7ac7c32715326d2ee5f833bc87ece0

SHA512
2b0475927469b5d0d2804ebb21c8e846f2968f7033edae19e9cef297ad7f427ce26df1cfc43fe6a299c22a5da5a7d4880aa74c72f9357a760b644a8c48da8df5

Download Submit
memory/1164-56-0x0000000000000000-mapping.dmp

Download
memory/2044-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads