dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789

General

Target

dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exe
Size

172KB
MD5

3c66118313e326cbadbae173bd5f73a9
SHA1

445424426aac2ca7fbaaabcb4270c04e3a4d5f50
SHA256

dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789
SHA512

f4b47fe86c222c27961ee70fc3c63d14cde736c25fa5814ae019216c1149e1a8e0bfaa7d1da4d349573590a2feeab1dba1306c0c5241a8f02e811fc0180cadb2
SSDEEP

3072:flpEfu5mz5RqgF+Jn9bl9Z2mZTecyUCaHKG3+MKHdTrU0UFSp0:tpwukzt+Jn9bZ2mZT1yUCmZ0UAS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fd27a42ad8d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000094eaf23f1bd614a2a3e6bd7cbead4b12a69422531c4437fc741858eadf12f64c000000000e8000000002000020000000d128ab5794c6fdc67bee28b7e46dd7825d0ec70badbff7ed4f0259e6a76c4f1920000000ad800d20662bcec2f6f883ba979b7ce85e1b46cc564afecb6df668c1fdb0005e400000006a9b2dd926355855b001b54af4da25e289dc23f4e13fcf0e888b550b3f36806b17f7a01bc4da4d07bdcaabc1d0623c7af801935068f437953a86531922c16c94	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA0BA2F1-441D-11ED-A45B-DAC72961D548} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000b4b8d9c9ad54916e025ef0d563678cde3548556afb20b3866d19dd0cb2badc84000000000e800000000200002000000059924de64bff6ed27795ffb28769bfa143e9333b27b692b2f5d4efd7a67ee1ee90000000417c60ef15afc831997d947995d36f89b95e54f962b19579cf922d0446ab7dfc7edbc33900fb26779cc2517c3666fe2f2ce3749413940c93f42c137199dea5ab55a11250f73b9449c9a1c0229ca0e51abb5c53877e43a14c264e4e449e7c79c62288fe275d917d09dfe2bd53842c2fe6d8764082a84393b8649829eb343188cc9ce63775d8cfd760b9fe733b28a55efb4000000034940e4f17be1eb492d876eca3fee25c07534d9933a6f78fddcf935b857688889a3509a974310ce6e37357b4d9c5f39c670fade394f97d33b66bddd89048d4d9	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371678000"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1392 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1392 iexplore.exe
1392 iexplore.exe
1716 IEXPLORE.EXE
1716 IEXPLORE.EXE
1716 IEXPLORE.EXE
1716 IEXPLORE.EXE

pid	process
1392	iexplore.exe

pid	process
1392	iexplore.exe
1392	iexplore.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exeiexplore.exe

description	pid	process	target process
PID 1328 wrote to memory of 1392	1328	dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exe	iexplore.exe
PID 1328 wrote to memory of 1392	1328	dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exe	iexplore.exe
PID 1328 wrote to memory of 1392	1328	dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exe	iexplore.exe
PID 1328 wrote to memory of 1392	1328	dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exe	iexplore.exe
PID 1392 wrote to memory of 1716	1392	iexplore.exe	IEXPLORE.EXE
PID 1392 wrote to memory of 1716	1392	iexplore.exe	IEXPLORE.EXE
PID 1392 wrote to memory of 1716	1392	iexplore.exe	IEXPLORE.EXE
PID 1392 wrote to memory of 1716	1392	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exe
"C:\Users\Admin\AppData\Local\Temp\dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1328

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=dcefd56133f9aa62fbebaf85ff265d627b967c87db4581e1915b33ebab06e789.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1392

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1392 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B4QRTNM2.txt
Filesize
608B

MD5
dd93540a284f15c12f331b05d340f269

SHA1
2ddbbf87bedaa639567db3365c80624509a86dc1

SHA256
e5e6a39bbbcc6870aec668e870235fe3e39269d27bda5477f01665a6754b9d61

SHA512
a5feeb8ff87204dff89aec964cc9c88aac70e14c8d6ab350ed278a0dc883bf56a0cf8470e0db53b896b21929bc7304222c6ce13d39dcd133f57ab197b56affce

Download Submit
memory/1328-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1328-56-0x0000000000230000-0x0000000000234000-memory.dmp

Filesize
16KB

Download
memory/1328-57-0x0000000000270000-0x00000000002A9000-memory.dmp

Filesize
228KB

Download
memory/1328-58-0x0000000000551000-0x0000000000555000-memory.dmp

Filesize
16KB

Download
memory/1328-59-0x0000000001D80000-0x0000000001E80000-memory.dmp

Filesize
1024KB

Download
memory/1328-60-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1328-61-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1328-62-0x0000000000270000-0x00000000002A9000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing