15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3

General

Target

15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3.exe
Size

1.0MB
MD5

6147c92355c4b9bcbb7cf708dcf492ba
SHA1

23e1f78d9a29c88324e3ac5e9ce7c186a247b08f
SHA256

15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3
SHA512

5bde522904576ad9375889ba935ffd5a8e762a60f0e7d8a4c071c6f4df0cfe63a2e14e010bac15240ba2e4dc6363678c896a7b6844406c953b5f65f775105412

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c000000000200000000001066000000010000200000001ce54f1b549563503abe26d51a520a3405274b4da09de602c1b0de550073a613000000000e800000000200002000000098793e55d63b47a26376c3aa4ac5b59f2b34c436a748529e3666f87f42a020dc20000000cbbdf2876ca9c5c25f56665cc1f474c20d8fc1b0bea925b795b68c208715a88640000000ad1e096f0faf8662712c68b11299d4daf305f1559cd541201b7edbc043baeda8197a92212dcbbc0442dddfd7ead87611a8c348412ac996d7c0f67d646b8ceb89	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000962422cf799f2f46a7e75b376cef3c3c000000000200000000001066000000010000200000000b9d0d364bdb400eb63c388947cd06ba1ae97e66a6385280ae1f423a2f7728ae000000000e800000000200002000000052a3337214e3d8999ad33de90d641d7c10c46f987b3e3a60e253c73c070557aa90000000f4d653f5397f854ec2fcdbe7562f24e60228cf885531dccee3e299160640d73fd7bdb81b6d1f32e9fad403f8d7fc425102543894be69ae9a605bf1fdbfe664e72c9cea9dea0b2969006d6ffe420a72dbd359e42fa9dc3edd3d8e4f8ff4dd5ed1e71d95f301de06661c1cb5edd64a2f3ba9e4d77cdfb7b7cdee0c21760161b2ec5f2c34a8a45afc9a006737d67facf4ff400000005dbec76ed6cd55fc9b3aac7b67d39da54b8c8394b41899679686f4b77dad4e93f017e1eed543e3c1cfa500d9200666a2e40a50b13d924de7c58c7b109d2f4445	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80626326846cd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43927BC1-D877-11EC-93AC-6280490416C4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "359841706"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2012 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2012 iexplore.exe
2012 iexplore.exe
972 IEXPLORE.EXE
972 IEXPLORE.EXE
972 IEXPLORE.EXE
972 IEXPLORE.EXE

pid	process
2012	iexplore.exe

pid	process
2012	iexplore.exe
2012	iexplore.exe
972	IEXPLORE.EXE
972	IEXPLORE.EXE
972	IEXPLORE.EXE
972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3.exeiexplore.exe

description	pid	process	target process
PID 784 wrote to memory of 2012	784	15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3.exe	iexplore.exe
PID 784 wrote to memory of 2012	784	15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3.exe	iexplore.exe
PID 784 wrote to memory of 2012	784	15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3.exe	iexplore.exe
PID 2012 wrote to memory of 972	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 972	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 972	2012	iexplore.exe	IEXPLORE.EXE
PID 2012 wrote to memory of 972	2012	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3.exe
"C:\Users\Admin\AppData\Local\Temp\15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_GOTO_CONTROLPANEL&version=v2.0&processName=15b250c6a5dba64cdda1abf3edf75d401333408894b5ea33800547cf4b6d9ef3.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
b9f21d8db36e88831e5352bb82c438b3

SHA1
4a3c330954f9f65a2f5fd7e55800e46ce228a3e2

SHA256
998e0209690a48ed33b79af30fc13851e3e3416bed97e3679b6030c10cab361e

SHA512
d4a2ac7c14227fbaf8b532398fb69053f0a0d913273f6917027c8cadbba80113fdbec20c2a7eb31b7bb57c99f9fdeccf8576be5f39346d8b564fc72fb1699476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
7b4206aa7bb86b712d1411bb2ee2c8cf

SHA1
18a4289d2eb5e504ba5ca2bed8c2efdf8dcd678c

SHA256
84e452c8384a70b524f9fc2cada245f496674297e4156c1b0e41b2bcdc19ca06

SHA512
69468d5755cb730faec8c9a1b5a0e1f647c8d1e2b3c023126c19701d7470f47872ccdfeaaad7b5527e55d87c548d28ed91e74606c5ba48351dc53c2033d1cb0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1b4wh1e\imagestore.dat
Filesize
21KB

MD5
b20f31730f850eb54154c2f21c3800bf

SHA1
6fe8d6a8c585c4eb898624210da0e704f8ad30b8

SHA256
7fdf8486f14118f0975558508900655a3ee28a8b535a7b8267117f9a559ffd69

SHA512
c8b327d1696a0e62a160aafc30971c9fc7707b4b041289c4a66883bacc2b4bf93afae5e6c311f57579ca985e5fc7ab7c9ca425ebe8775b689b46f185f55191a1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BF216FWG.txt
Filesize
599B

MD5
f311eaab9c0b3c23ea6cc9a29c755978

SHA1
65da654146174ae331ef6bf7c58d357ccac540ad

SHA256
e55a5acb6debaaba8127780ec582d6c08cc503c56c54250b1b79aa49bdc3c7d3

SHA512
ed157286c565472e986b62833b5ccaa9eacf64a0ff038654aed06a23af9bcdd4710096bd7855b1d827e15eea0a8e74f34ffcbfe0aae2392429c514b888b248c3

Download Submit
memory/784-54-0x000007FEFC061000-0x000007FEFC063000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing