e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0

General

Target

e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exe
Size

40KB
MD5

6479d246604563a018984d1fdafeddc0
SHA1

65d399c9435e8ba056568677b5f8b75c268661db
SHA256

e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0
SHA512

670e28900a1c1ccd1d4ed3a01abda5fba1842687be76554cb34531335f51cdd9b2f7962cf9606a0acbfbe08865cc62bfdd056cbc0a61ef987aab9c880357859d
SSDEEP

768:nk/traxXvVfjcR6/FXCCeFW0KSR/+yv3qKqKxeo4:YexN+6/Fte/rFiKtx

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371666043"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c0000000002000000000010660000000100002000000090935ede72c59063726bfea8d2144d9674b479c9bc7eced8aecf8cc2c09bf626000000000e8000000002000020000000ca27a9ec2f48d0fbcffccb7dffa9d2ba93a6d3d12ce2a5ba49c5f0e1c24c0dc12000000013438ab8cd6d2783c0aeb714f0534be3e2f9ec49c7763ff0a49924e9f40abf4840000000d6b12f0f1e83720de6300fe37674e8ff3e9086205cefe675cf4e98dd2648b37689adec8931dcb7dbec79690ceb5fb8c39a645a2732e7df57bd8bfba0063049b8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EE7F8500-4401-11ED-8B0A-7A3897842414} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600dcddb0ed8d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000fb57571b2dac2d2289c56f271f1c37591e4561263f789b05a53d74e55be30e87000000000e8000000002000020000000db44257c35674b261a9aa5cf0c46bb9e5eda9007edce353c19ea39600f08bf519000000079113925c1e5bf2ed14464bcc80dc94c25245e2386d1acf314c1e0da61f1e64c0aaa7076b7e67a12e3e845fc3dbfd264129c98f9452f19132c2c2869b034b09c925ea027cfdc9e0acb46f39fba38f66319dfd8cecfac464493f0153bd8bc57a78c1f3e3ac41a5f1962cb6b594f1650d7a7e68d81ce8be324c9a37969a42c73dad797e22c9a267556f329bf53efff3b1c40000000d7a4d439429cd4e8801416e6dcbc9c2e050e137b04bb5aaa52d063eaaddaa05681bc88615cbc0c1f3480cf3d17aaaa65a4cb3734f1786f2f57912b7fa82760a3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1856 iexplore.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1856 iexplore.exe
1856 iexplore.exe
920 IEXPLORE.EXE
920 IEXPLORE.EXE
920 IEXPLORE.EXE
920 IEXPLORE.EXE
920 IEXPLORE.EXE
920 IEXPLORE.EXE

pid	process
1856	iexplore.exe

pid	process
1856	iexplore.exe
1856	iexplore.exe
920	IEXPLORE.EXE
920	IEXPLORE.EXE
920	IEXPLORE.EXE
920	IEXPLORE.EXE
920	IEXPLORE.EXE
920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exeiexplore.exe

description	pid	process	target process
PID 1928 wrote to memory of 1856	1928	e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exe	iexplore.exe
PID 1928 wrote to memory of 1856	1928	e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exe	iexplore.exe
PID 1928 wrote to memory of 1856	1928	e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exe	iexplore.exe
PID 1928 wrote to memory of 1856	1928	e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exe	iexplore.exe
PID 1856 wrote to memory of 920	1856	iexplore.exe	IEXPLORE.EXE
PID 1856 wrote to memory of 920	1856	iexplore.exe	IEXPLORE.EXE
PID 1856 wrote to memory of 920	1856	iexplore.exe	IEXPLORE.EXE
PID 1856 wrote to memory of 920	1856	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exe
"C:\Users\Admin\AppData\Local\Temp\e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e7f36dfbd82a3edb752350bb48472e07e90a5ddc280cfd5f64f536f9b99e8ee0.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:920

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4AX71S70.txt
Filesize
606B

MD5
f998abb0416ff59c509aade8dbc9b909

SHA1
8ffb43995bceabec2a5dd418d44844852def4fa4

SHA256
2b8264e41f1fa51919fd036a02034e3bb16ad1ed953e210207f1ee795e03d74e

SHA512
cba18103ea92d6eb9409ca3eba725abad32e66ad691cb72d842bb38cb51ec9929111affab00f63ea2f5bba3c55ead9044ea9792fd3a0c726419990c8dc9fac6f

Download Submit
memory/1928-54-0x0000000000510000-0x000000000051E000-memory.dmp

Filesize
56KB

Download
memory/1928-55-0x0000000000030000-0x000000000003C000-memory.dmp

Filesize
48KB

Download
memory/1928-56-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing