ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a

General

Target

ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
Size

218KB
MD5

67741fbd56921fc432b0bb831d48d66c
SHA1

d78ad482ba0fdf5bd50aed35306f2e241e3b61fe
SHA256

ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a
SHA512

fcc06603e2aa368a7f095885e7582387a531b5106345c1e7c0b38275afb1f2b4e1859a487ec16037c7f85ea36e3fc9720f8bfc221ed7ce1a2725e9545fd9fa3f
SSDEEP

3072:QzgM2MYnR49BYIpjyynJFHKfF5Umv4V2AG:qgpepjyw1KfTa2AG

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe

description	pid	process	target process
PID 968 set thread context of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9588521-4213-11ED-9351-5A21EB137514} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371453761"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000a5e7317880f6c5a9323f7c3ff9ab207aa9b48a5a4ae6c70d5b34299df449020e000000000e80000000020000200000000d234084d49d6cf9e6913110862e8e527f5347c3b6c7972cb980413b61ebb82d9000000055180ba46c2dd4abb1ed8d821674be80089bdcb25643150a9f8fa0c7d81833d59b8c8e63087c33991db5c6c359e88b99ca06257f249d405b42d00516c4782cb78e5b37cb44b556149b7cada9175be5cda34de2e8d7dc4fa8c0a3270d26adf30ff712018ad60fc97c5a880d19a3cee0b56ddb022a256775c66155428f7220871c84318764f7974430cf5a66e32bd8882540000000fb7564b83d8a0214abc37843635b2f51abfd2718bcfde8ed48a0f1a2c8bf255c45ff9e27ef0c22281a92cda3d0f98173d22f2ed8aa71ba975a842967cdb8c745	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000b3584926e48d3965e1e4bb8823986aab0932eec20ec5e06764f7c939125322e4000000000e8000000002000020000000e8e81bbc9ef20cee6d48e97823e94606b0f8168baacf6f3e36fd3751b36d484b2000000096ef55b617e3ecfe62d7b4de6785610a7f3bb03a38180faf1a9f829153026d9c400000009b99985e0d7d6226d4777d52b1e9ea1691a6ad16b1e6e7748e1537cbb81cd214d2f9ac142a9066322479f12de0e9b14c1fd45817109c06d72d1848d77160b5c7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7012e18420d6d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2000 iexplore.exe

pid	process
2000	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exeiexplore.exeIEXPLORE.EXE

pid	process
968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
2000	iexplore.exe
2000	iexplore.exe
828	IEXPLORE.EXE
828	IEXPLORE.EXE
828	IEXPLORE.EXE
828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exeee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exeiexplore.exe

description	pid	process	target process
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 968 wrote to memory of 1708	968	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
PID 1708 wrote to memory of 2000	1708	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	iexplore.exe
PID 1708 wrote to memory of 2000	1708	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	iexplore.exe
PID 1708 wrote to memory of 2000	1708	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	iexplore.exe
PID 1708 wrote to memory of 2000	1708	ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe	iexplore.exe
PID 2000 wrote to memory of 828	2000	iexplore.exe	IEXPLORE.EXE
PID 2000 wrote to memory of 828	2000	iexplore.exe	IEXPLORE.EXE
PID 2000 wrote to memory of 828	2000	iexplore.exe	IEXPLORE.EXE
PID 2000 wrote to memory of 828	2000	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
"C:\Users\Admin\AppData\Local\Temp\ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968

C:\Users\Admin\AppData\Local\Temp\ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe
"C:\Users\Admin\AppData\Local\Temp\ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ee47690a894f91745ae23f234d36fe01744d6fd7d0a658d3ca343f81b733150a.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VTD6X5SA.txt
Filesize
608B

MD5
195f6b08aff1b9af32dd90c87cfa8163

SHA1
57b790b7f2798e8fab8acdd0178d1c44d40e75a6

SHA256
d507d370db5ed5e0fd021ecb852a0c248d124cb849223abf8bc665565400cf93

SHA512
3935f7afa91949d1fe5988b36f42e9e93f80b16d5274031f1dd52b2ce78c071914109f7456f56e03f97c0fe7a3b0cc7d82ebf3145d472f7388ad08fa88419566

Download Submit
memory/968-75-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/968-55-0x0000000000230000-0x0000000000240000-memory.dmp

Filesize
64KB

Download
memory/968-57-0x0000000000250000-0x0000000000260000-memory.dmp

Filesize
64KB

Download
memory/968-58-0x0000000000260000-0x0000000000270000-memory.dmp

Filesize
64KB

Download
memory/968-56-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/968-59-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download
memory/968-60-0x0000000000280000-0x0000000000290000-memory.dmp

Filesize
64KB

Download
memory/968-61-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/968-62-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/968-63-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/968-54-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/1708-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-68-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-70-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-74-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-72-0x0000000000418ECE-mapping.dmp

Download
memory/1708-67-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-76-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1708-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads