Behavioral Report

General

Target

b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
Size

52KB
MD5

34642e15aac09c299214bacfb3f8d399
SHA1

cde7830a6b399f63dd8a12e44b7759b722519973
SHA256

b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf
SHA512

0e3e8634ae33285820c565ede6d3566dab75580114a3dbf57fc245d06055d961a26bfe5a8f9d16e8478c246b523ca0184b88b6577fcafcdf9b55c50864cf7265
SSDEEP

768:9R7+eNd28dSa/7uyrSMBe1QHgkm60GCEduramZ/OCr27c0ZovjU8:nieNfdS+iyjoQHOtzr27cHU

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext ⋅ 1 IoCs

Processes:

b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe

description	pid	process	target process
PID 620 set thread context of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe

Modifies Internet Explorer settings ⋅ 1 TTPs 34 IoCs

adware spyware

TTPs:

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f002a125ead6d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000f11d3fc904f653658220fe458e216eb8bb6a3665e61385d8a36c95ddea7cf9fe000000000e800000000200002000000018b6f10f21fafcd9f96ca6b7e886a9cbe915312a6c90c7d126aec0a060b6e3dd900000006bea35c8bfbc8c8fc0179e3e69f39974571b1f241a618173c7d55f8c250d2bd1468f4e69b3cd4423bc16293ac62c88a8bb3e0fa341e5b7c3c4751608b436f1778cef9f874d5e1cc2db1f8d900eeeb5eef589697cf98fda462c0364bedb4ed78241c373ee369691bba9791911880b2a0436f2dfc1ce4e3fe543aea2390984737a57599c81756cc44bd292c4e66e098ce940000000c3a1c01670088095d25a995cdb2e26454a2b651b381f821117249990d547ba83316d58426a91615ec8b50c2f8b77640bf3a7875ca559a311099589d48e943fca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371540349"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000003a81826fdf3f889d2447974eacc14ac8377cbf6e6ce8c4169c33db2704bbf058000000000e8000000002000020000000da2151499f9c9f14cc9a166c7a1777ecba83b3950eb3bad21f9298398644b00b20000000b1e5caed88b646031e55b042647ca9537dee62cd9acfe7f64f4ba75c55ef36ca40000000a2b4c6843d1e66ab027c44b913b31b409a5f7160695b0aaea9a2dedacc97962a66a056c405914b107c5e7c935b25bf26afcae05f93ab548f775594e24d0fe6ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BC4D5B1-42DD-11ED-BE8B-FAA138970F28} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow ⋅ 1 IoCs

Processes:

iexplore.exe

pid process

552 iexplore.exe
Suspicious use of SetWindowsHookEx ⋅ 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

552 iexplore.exe
552 iexplore.exe
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE
2040 IEXPLORE.EXE

pid	process
552	iexplore.exe

pid	process
552	iexplore.exe
552	iexplore.exe
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE
2040	IEXPLORE.EXE

Suspicious use of WriteProcessMemory ⋅ 17 IoCs

Processes:

b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exeb5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exeiexplore.exe

description	pid	process	target process
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 620 wrote to memory of 856	620	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe
PID 856 wrote to memory of 552	856	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	iexplore.exe
PID 856 wrote to memory of 552	856	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	iexplore.exe
PID 856 wrote to memory of 552	856	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	iexplore.exe
PID 856 wrote to memory of 552	856	b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe	iexplore.exe
PID 552 wrote to memory of 2040	552	iexplore.exe	IEXPLORE.EXE
PID 552 wrote to memory of 2040	552	iexplore.exe	IEXPLORE.EXE
PID 552 wrote to memory of 2040	552	iexplore.exe	IEXPLORE.EXE
PID 552 wrote to memory of 2040	552	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe

"C:\Users\Admin\AppData\Local\Temp\b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe"

Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory

PID:620

C:\Users\Admin\AppData\Local\Temp\b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe

C:\Users\Admin\AppData\Local\Temp\b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe

Suspicious use of WriteProcessMemory

PID:856

C:\Program Files\Internet Explorer\iexplore.exe

"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=b5f211e632089024c0ec3f7a10cac50a6f7541fbdfc588f8fdac5ba8b27d9fbf.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0

Modifies Internet Explorer settings
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory

PID:552

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:552 CREDAT:275457 /prefetch:2

Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx

PID:2040

Network

MITRE ATT&CK Matrix

Collection

Command and Control

Credential Access

Defense Evasion

Modify Registry

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G9UXGAKB.txt
MD5
be1cd4d67e6e6e681fd9a4c97bc9b60b

SHA1
97bdbd054be7b32915b2ce05af024da632b371fa

SHA256
3424cc5d8c2b0e3a8631e5e64d44fdabf58da0fd45538bf22c8c4beddfa8b4a7

SHA512
b953a2ecb9970ace2c8e44aee65af234134dc38908176d8d427b64d188be28e40e4df4d02fe5bdff4d9d88bdd9aa685f68e3d0ff867cf2a205cea6d62718ac86

Download Submit
memory/620-54-0x0000000000400000-0x000000000043E000-memory.dmp

Download
memory/620-65-0x0000000000400000-0x000000000043E000-memory.dmp

Download
memory/856-55-0x0000000000400000-0x000000000042A000-memory.dmp

Download
memory/856-56-0x0000000000400000-0x000000000042A000-memory.dmp

Download
memory/856-58-0x0000000000400000-0x000000000042A000-memory.dmp

Download
memory/856-60-0x0000000000400000-0x000000000042A000-memory.dmp

Download
memory/856-62-0x0000000000400000-0x000000000042A000-memory.dmp

Download
memory/856-64-0x000000000042407E-mapping.dmp

Download
memory/856-67-0x0000000000402000-0x0000000000425000-memory.dmp

Download
memory/856-68-0x0000000075711000-0x0000000075713000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Downloads