d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118

General

Target

d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exe
Size

524KB
MD5

6c19c1ecacdc6d1138dacee8fc2f7462
SHA1

a00cfa95c2c3ac7d678d4712d964f55fe4cf9009
SHA256

d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118
SHA512

6f027984c3a81abdb472f435814de4c902f897b071d76a421d86fc5e42b357cef2b90e08c2642a54fc1de0ca7e0211b2178ca1ec423e9fbe5fb218c5340c32a7
SSDEEP

12288:wcWdFsA8qBzzptQnZwCBkK8oNFBtjv39xt4veL+ZR:k+A9tp0Rn8iN3fPG

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70658d7c4bd7d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9A71EC01-433E-11ED-BDAB-FE41811C61F5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000495570678ba29113c7158793faad04f5fcfcf2999a196547a87ef1e6d5d0ff5f000000000e80000000020000200000004d023326ded3e4b00ee0b2d4850a97bfad3e4c459204a3d5b0663f84f0934849200000004566202d7cf2a5239021da0d3c81891a823af9182cdf72239ec24883e1bcdcc7400000000c6652bb19ca61ef5b4d7ebf08f46bcf34ca1b80754af1c4b2df64d0801d40f98c7fb4e75541b44053b757ff3eb4c2b92736051ce18c60b9d964c03728957ed0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371582146"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e0f3d159765a7f43b6bf060b4b70c9a300000000020000000000106600000001000020000000ad8e5db678a39bf7a7022d8d5adf7d85f086b7ac2502de97d6ad0ecc8dad9380000000000e8000000002000020000000beeab5df271a94f4fa5e1cf2ac527c62dd8af0fa524499ae6f58b896b35d829790000000024ea0a47e0e6048bbb194702d6bb46cfe447a9a2c2dd3a5eea99d40d870ecff850c9b82444e4c11e2182d351451b179015988610c79638bc35cf0cb2d3593603645043fbbea4ca2b72feaed16c5b74381a254bb12070300b89e4372abb5ba5ddbfee916fe95dd7af586e057cecb8119ea38ee2292b7bf6c5e9ac3e0c9ff25c17a9ae1333160e395b29e3d0c1a8ba52c40000000eb31583bf4179cfc2645344c37fef12fdce7f6a33e9a4acec5a3bcef1f2c0e4e51e0baae2398bbc0a8bcc341950f73fc3355624eaec723ed92c4a607449daf10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1168 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1168 iexplore.exe
1168 iexplore.exe
1196 IEXPLORE.EXE
1196 IEXPLORE.EXE
1196 IEXPLORE.EXE
1196 IEXPLORE.EXE

pid	process
1168	iexplore.exe

pid	process
1168	iexplore.exe
1168	iexplore.exe
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE
1196	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exeiexplore.exe

description	pid	process	target process
PID 1900 wrote to memory of 1168	1900	d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exe	iexplore.exe
PID 1900 wrote to memory of 1168	1900	d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exe	iexplore.exe
PID 1900 wrote to memory of 1168	1900	d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exe	iexplore.exe
PID 1900 wrote to memory of 1168	1900	d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exe	iexplore.exe
PID 1168 wrote to memory of 1196	1168	iexplore.exe	IEXPLORE.EXE
PID 1168 wrote to memory of 1196	1168	iexplore.exe	IEXPLORE.EXE
PID 1168 wrote to memory of 1196	1168	iexplore.exe	IEXPLORE.EXE
PID 1168 wrote to memory of 1196	1168	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exe
"C:\Users\Admin\AppData\Local\Temp\d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d48cfcdf9b4d4f6a7bbdbc0a7d7ecde0332ad5b43b5bc063d1403aafac2d1118.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1168

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1168 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1196

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GH5IQ0PZ.txt
Filesize
608B

MD5
6e045d234f88c02eb65c852c1fa8d0a8

SHA1
bc35703a3b3b909ade717f3cf880943fbdee8bae

SHA256
fa7c540612d053df0137024c97a7892de1c396c785c91731da26272d244199d5

SHA512
c4bc5e7c10960aa57d40d664d8cceb5ffc7b6c6f2225f30002c47a0489ea462339839aa52bd9d386db3c6e4d0ca847c5692f57137a811708aeeac1f851c38d25

Download Submit
memory/1900-55-0x0000000013BC0000-0x0000000013C46000-memory.dmp

Filesize
536KB

Download
memory/1900-58-0x00000000020A1000-0x00000000020A5000-memory.dmp

Filesize
16KB

Download
memory/1900-57-0x0000000000260000-0x0000000000299000-memory.dmp

Filesize
228KB

Download
memory/1900-56-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1900-59-0x0000000013BC0000-0x0000000013C46000-memory.dmp

Filesize
536KB

Download
memory/1900-60-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1900-61-0x0000000013BC0000-0x0000000013C46000-memory.dmp

Filesize
536KB

Download
memory/1900-62-0x0000000000260000-0x0000000000299000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing