0aeb86699aaeabff70d60aaad71285d9a942d8e9f0f230df858ed9789ab4a25a

General

Target

ppdjdafasqfz_gr/???????????6.06.exe
Size

1.9MB
MD5

189e90af285ac23f7c7e613455e78e43
SHA1

7353341eb1cdea65e69be679bd5d00c7faf9d63e
SHA256

fa640ccad7e977a775f19e69a317d07c163f9dce07a2e984d45f3579eefb4f30
SHA512

3702ed7e63d9bb0497e84e50e98309cc5d38032f2c0663d1d2b80bf78d3027cbe7f85bb52c7864d96262c9df96f32f02d54ec19877188054e721310d0a8f5353

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

___________6.06.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	___________6.06.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	___________6.06.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

___________6.06.exe

description ioc process

Key opened \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Wine ___________6.06.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

___________6.06.exe

pid process

684 ___________6.06.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Wine	___________6.06.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f014c50274d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAFE6D01-DFF5-11EC-850F-E6BBD082ACA2} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000d1018388b69a067c58b2e85b241baadc7c2dadf7d52d8552aba0b3adb0d59bbf000000000e8000000002000020000000902b9b25c6afd19639efc70433df2319ef13bbd7ac44de9e2293cabb4597c2f89000000089867f560f99c6815db53e57128e9e8c6c161d1e8a0f2545a1e49cc84423e022460ac821abc3eff0442bb925f7dd284869cef42e94f8d901107408eb3a3815a1b056245f095ec45b2ba832ab4944d05ab073c45465f304ea379d87d83063c88039b0da79b32beb3e50d961f6356c27a9c946cef5ae4ffb55540871c64ba5d1db33611504f9e53085a5074c025565a25a400000001ae0906b9101aa4724f6c035b5eecf70b0cc929cca0a92315ae70af5384cc2871a37308dbd25a1d5de67f3bac920052b8e608cf6393eed3756b69eb9ee8fcb14	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000358f16e0538341458b70f68dad1eafd400000000020000000000106600000001000020000000b8ce0bb1d068f87720a8c3da314bd48446ce7001138a983c0cade47211a40331000000000e80000000020000200000000b6306299db1763e42350ea9a37dbfeb8062bcbec1633973b49b1fc13c7d09dc200000002a5981969f74e3958b60c5a446718cfd79c92118aaf16610f8bc624e71b66f50400000005657bd7cdee4f7a4345cd4edab9ef603cf0043ee5edb7798177d4f53464849b007b0f256cb5786c7e791acf6b9940c2b79a51c38dfef59b1afa02e4ff41a7777	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "360665707"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

Processes:

___________6.06.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?k52910969"	___________6.06.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

___________6.06.exe

pid process

684 ___________6.06.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1296 iexplore.exe

pid	process
1296	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

___________6.06.exeiexplore.exeIEXPLORE.EXE

pid	process
684	___________6.06.exe
684	___________6.06.exe
684	___________6.06.exe
684	___________6.06.exe
1296	iexplore.exe
1296	iexplore.exe
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

___________6.06.exeiexplore.exe

description	pid	process	target process
PID 684 wrote to memory of 1296	684	___________6.06.exe	iexplore.exe
PID 684 wrote to memory of 1296	684	___________6.06.exe	iexplore.exe
PID 684 wrote to memory of 1296	684	___________6.06.exe	iexplore.exe
PID 684 wrote to memory of 1296	684	___________6.06.exe	iexplore.exe
PID 1296 wrote to memory of 1600	1296	iexplore.exe	IEXPLORE.EXE
PID 1296 wrote to memory of 1600	1296	iexplore.exe	IEXPLORE.EXE
PID 1296 wrote to memory of 1600	1296	iexplore.exe	IEXPLORE.EXE
PID 1296 wrote to memory of 1600	1296	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\ppdjdafasqfz_gr\___________6.06.exe
"C:\Users\Admin\AppData\Local\Temp\ppdjdafasqfz_gr\___________6.06.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:684

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.2345.com/?k52910969
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1296 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
26cf006188d29c9e576cf0060bbb6eec

SHA1
dd4782cdcfbebffafeb3a99d0c5a5269ec7107d2

SHA256
6e5761ed9dfc9e14308029c3c1e3e1b9c751bbf9f668a4f32d0d8b261fd6377f

SHA512
2ead9377be1eb688a8687147d038aa4b510b70d40f9a610cd4fcb237e004661d4f10cf6ce3dfd38846db0cf9d6cb86719688486f9319479d7405a48e4da4b2c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V517UX9G.txt
Filesize
603B

MD5
f0ea9163af20737c29854e0a1f294ab5

SHA1
5a0a87af67bed8d24525af43ef9179e28b880c69

SHA256
b2e8562535b1245c34d05b80a5ad0b364292ec3cc9adeec9ebe55b76109fd10d

SHA512
500daf6f8b55ea1a5d01d2ff3ef8fc6e8150f0fb9663b17fb52341f77616ab52c5e85119c571211d8d09374f36b18e8209d16f2e17b08740b95f394bd65177d2

Download Submit
memory/684-54-0x0000000000400000-0x0000000000884000-memory.dmp

Filesize
4.5MB

Download
memory/684-55-0x00000000753B1000-0x00000000753B3000-memory.dmp

Filesize
8KB

Download
memory/684-56-0x0000000077400000-0x0000000077580000-memory.dmp

Filesize
1.5MB

Download
memory/684-57-0x0000000000400000-0x0000000000884000-memory.dmp

Filesize
4.5MB

Download
memory/684-59-0x0000000000400000-0x0000000000884000-memory.dmp

Filesize
4.5MB

Download
memory/684-58-0x0000000077400000-0x0000000077580000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads