ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac

General

Target

ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe
Size

289KB
MD5

5725a7142c9aae016bf49d3a827a5d97
SHA1

16b86d45da91715d65035ad968fec0b9074c3e7e
SHA256

ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac
SHA512

55abe0ee5fab60c98f26c5ffa9b81e11c9c52e5cc35358d470fbb0fc852c5c696ed8103e9a3f1d913791a82f527ed0332a6a072775b8ca48b54f0052c3feb1e5
SSDEEP

6144:t/0uo5P7yKRUWNjNhCHM1S9K/LdC+aAP7Y4:tJCfUa4H2Sy9zF

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

white.exe

pid process

1548 white.exe
Loads dropped DLL 2 IoCs

Processes:

ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exewhite.exe

pid process

1132 ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe
1548 white.exe

pid	process
1548	white.exe

pid	process
1132	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe
1548	white.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b000cb1d31d8d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000da0ff356bb7cfe2737676dca46af67e36fa995b698c7734c5a2743ece1be20f5000000000e80000000020000200000005c532eb533a9a16b6fccc921da656f8da6d1f2a3dd2e570a75d189afb7a613b690000000375297e16eaef45640679080e26c138266766b4ec9fb43ec8e855ac87e8f9c50e4dd42f8f44bce62068e3ccdd2d1a665290f1e77be95c85c5c6dff043ca45ef86a4a43e6d2ef15d809c55a81f5d4991574edb28d00119a808d22c9512bb3335533b9af3bd8df8088599bc07120da564c3f19e80c7654351c47cd9171c55c3056056085278536e8fd6fb87c1d37ad63a840000000e1550d5330bc2086e01d89938576c0197c8cce3930380f108ca21541991c99eeccb6d528f549b5424a4c92a2049b442bcb15898932d7b1078d9a9833b243b477	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000f73fbae2a1c3fabdbd82f2589d7b567b0bce9ddd1f65034e44d15694b15726b1000000000e80000000020000200000008b5cdf0acece8bd66e095d27a73c25035ddc84a63c9f766137e93b2b71c30fca200000006ef29945af34326cec170bd88b58c529b7dc976f68b40c1bee5d9ea80343a8e54000000057748f40afd0747893e2968c6f15d3be77ca1b735ed66fef014f7908883063dc11e25f1be1e0a097e02fc6acb40b5ed03cf7ce1472b85d94b27aba323779017e	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D017311-4424-11ED-85B0-72E6D75F6BEB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371680771"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1656 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1656 iexplore.exe
1656 iexplore.exe
564 IEXPLORE.EXE
564 IEXPLORE.EXE
564 IEXPLORE.EXE
564 IEXPLORE.EXE

pid	process
1656	iexplore.exe

pid	process
1656	iexplore.exe
1656	iexplore.exe
564	IEXPLORE.EXE
564	IEXPLORE.EXE
564	IEXPLORE.EXE
564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exewhite.exeiexplore.exe

description	pid	process	target process
PID 1132 wrote to memory of 1548	1132	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe	white.exe
PID 1132 wrote to memory of 1548	1132	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe	white.exe
PID 1132 wrote to memory of 1548	1132	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe	white.exe
PID 1132 wrote to memory of 1548	1132	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe	white.exe
PID 1132 wrote to memory of 1548	1132	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe	white.exe
PID 1132 wrote to memory of 1548	1132	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe	white.exe
PID 1132 wrote to memory of 1548	1132	ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe	white.exe
PID 1548 wrote to memory of 1656	1548	white.exe	iexplore.exe
PID 1548 wrote to memory of 1656	1548	white.exe	iexplore.exe
PID 1548 wrote to memory of 1656	1548	white.exe	iexplore.exe
PID 1548 wrote to memory of 1656	1548	white.exe	iexplore.exe
PID 1548 wrote to memory of 1656	1548	white.exe	iexplore.exe
PID 1548 wrote to memory of 1656	1548	white.exe	iexplore.exe
PID 1548 wrote to memory of 1656	1548	white.exe	iexplore.exe
PID 1656 wrote to memory of 564	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 564	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 564	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 564	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 564	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 564	1656	iexplore.exe	IEXPLORE.EXE
PID 1656 wrote to memory of 564	1656	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe
"C:\Users\Admin\AppData\Local\Temp\ecf9ce345d03547056b276e7b45af498210ca29a5895e2a19af4710ad072d3ac.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1132

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1548

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=white.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:564

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exe
Filesize
344KB

MD5
b03b6280347d6f51a16cbf0930fee1bc

SHA1
ae90d123447132223332890f79f7c7dc60020716

SHA256
4c46b20b0a3d0fa22fa058e6becc05ec2b3179a1e90e8f674fb1b0195397b18d

SHA512
3086aca14963b45728403d9412f73f3e59e51eb56038e427519d70cec7d7881e822352802844dffccb6500b32e0e49abf86a0718e7811b40b17c02cf11ac4cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exe
Filesize
344KB

MD5
b03b6280347d6f51a16cbf0930fee1bc

SHA1
ae90d123447132223332890f79f7c7dc60020716

SHA256
4c46b20b0a3d0fa22fa058e6becc05ec2b3179a1e90e8f674fb1b0195397b18d

SHA512
3086aca14963b45728403d9412f73f3e59e51eb56038e427519d70cec7d7881e822352802844dffccb6500b32e0e49abf86a0718e7811b40b17c02cf11ac4cc0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JDA72F6X.txt
Filesize
593B

MD5
e888f88c046086250a8719651e3e5c65

SHA1
3a38c0bff833306d2d9028c4686707aff4bb3c56

SHA256
2acab8f5c64ce64cff690efd58e6650cac434ec5294036d11163a084deb1f796

SHA512
3cd3b67485dd8356887d4c2c71d73cdd3569b1bbff834ccb5914b450e765fe406a20a5d5328e2efaa49d939672ce4a9ec78db53cae81e214d7c9021d93ab502a

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exe
Filesize
344KB

MD5
b03b6280347d6f51a16cbf0930fee1bc

SHA1
ae90d123447132223332890f79f7c7dc60020716

SHA256
4c46b20b0a3d0fa22fa058e6becc05ec2b3179a1e90e8f674fb1b0195397b18d

SHA512
3086aca14963b45728403d9412f73f3e59e51eb56038e427519d70cec7d7881e822352802844dffccb6500b32e0e49abf86a0718e7811b40b17c02cf11ac4cc0

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\white.exe
Filesize
344KB

MD5
b03b6280347d6f51a16cbf0930fee1bc

SHA1
ae90d123447132223332890f79f7c7dc60020716

SHA256
4c46b20b0a3d0fa22fa058e6becc05ec2b3179a1e90e8f674fb1b0195397b18d

SHA512
3086aca14963b45728403d9412f73f3e59e51eb56038e427519d70cec7d7881e822352802844dffccb6500b32e0e49abf86a0718e7811b40b17c02cf11ac4cc0

Download Submit
memory/1132-54-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/1548-61-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1548-62-0x0000000000810000-0x000000000084D000-memory.dmp

Filesize
244KB

Download
memory/1548-63-0x0000000002261000-0x0000000002265000-memory.dmp

Filesize
16KB

Download
memory/1548-64-0x0000000002270000-0x0000000002370000-memory.dmp

Filesize
1024KB

Download
memory/1548-65-0x00000000003D1000-0x00000000003D5000-memory.dmp

Filesize
16KB

Download
memory/1548-66-0x0000000002370000-0x0000000002470000-memory.dmp

Filesize
1024KB

Download
memory/1548-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1548-68-0x0000000000810000-0x000000000084D000-memory.dmp

Filesize
244KB

Download
memory/1548-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads