074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc

General

Target

074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
Size

545KB
MD5

02c404001eb1428b67c4c84d93c62afe
SHA1

ccfd3c9e2730197b627be2e577a71e466494ab30
SHA256

074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc
SHA512

117ed5f86377b0bbda1e0ac8526dbe328a656c5445536d83507c9e57dcd05ac3be09d4544fb93d0fc98bf0744f675aa077027b6784461072d1d505d2187b8670
SSDEEP

6144:nUW/vqLbYZbFh0f3X2vuLL2BznK7XXlVshVrp3U4f3BglMgAMDzeLxJam0+cxosU:n7/CbY2v+ufAnC3sB03mdbqllTUxF

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
820	wmpscfgs.exe
1848	wmpscfgs.exe
2736	wmpscfgs.exe
3532	wmpscfgs.exe
3492	wmpscfgs.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	wmpscfgs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\program files (x86)\\internet explorer\\wmpscfgs.exe"	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe_Reader = "c:\\program files (x86)\\internet explorer\\wmpscfgs.exe"	wmpscfgs.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	\??\c:\program files (x86)\adobe\acrotray .exe	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
File created	\??\c:\program files (x86)\adobe\acrotray.exe	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
File created	\??\c:\program files (x86)\internet explorer\wmpscfgs.exe	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrotray .exe	wmpscfgs.exe
File opened for modification	\??\c:\program files (x86)\adobe\acrotray.exe	wmpscfgs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{64A627B4-43E9-11ED-89AC-F6DE28FD18F9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30988278"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30988278"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{64A627B6-43E9-11ED-89AC-F6DE28FD18F9}.dat = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "726862846"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "726862846"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
820	wmpscfgs.exe
820	wmpscfgs.exe
820	wmpscfgs.exe
820	wmpscfgs.exe
1848	wmpscfgs.exe
1848	wmpscfgs.exe
1848	wmpscfgs.exe
1848	wmpscfgs.exe
2736	wmpscfgs.exe
2736	wmpscfgs.exe
3492	wmpscfgs.exe
3492	wmpscfgs.exe
3532	wmpscfgs.exe
3532	wmpscfgs.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
Token: SeDebugPrivilege	820	wmpscfgs.exe
Token: SeDebugPrivilege	1848	wmpscfgs.exe
Token: SeDebugPrivilege	2736	wmpscfgs.exe
Token: SeDebugPrivilege	3492	wmpscfgs.exe
Token: SeDebugPrivilege	3532	wmpscfgs.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 820	1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe	82
PID 1392 wrote to memory of 820	1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe	82
PID 1392 wrote to memory of 820	1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe	82
PID 1392 wrote to memory of 1848	1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe	83
PID 1392 wrote to memory of 1848	1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe	83
PID 1392 wrote to memory of 1848	1392	074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe	83
PID 820 wrote to memory of 2736	820	wmpscfgs.exe	84
PID 820 wrote to memory of 2736	820	wmpscfgs.exe	84
PID 820 wrote to memory of 2736	820	wmpscfgs.exe	84
PID 820 wrote to memory of 3532	820	wmpscfgs.exe	92
PID 820 wrote to memory of 3532	820	wmpscfgs.exe	92
PID 820 wrote to memory of 3532	820	wmpscfgs.exe	92
PID 820 wrote to memory of 3492	820	wmpscfgs.exe	93
PID 820 wrote to memory of 3492	820	wmpscfgs.exe	93
PID 820 wrote to memory of 3492	820	wmpscfgs.exe	93
PID 2504 wrote to memory of 4100	2504	iexplore.exe	96
PID 2504 wrote to memory of 4100	2504	iexplore.exe	96
PID 2504 wrote to memory of 4100	2504	iexplore.exe	96

C:\Users\Admin\AppData\Local\Temp\074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe
"C:\Users\Admin\AppData\Local\Temp\074c6220e96258950dc00db2e0c6abd2608dfb60f8fb8af6ab8e8b410159f9bc.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392
- C:\program files (x86)\internet explorer\wmpscfgs.exe
  "C:\program files (x86)\internet explorer\wmpscfgs.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:820
- - C:\program files (x86)\internet explorer\wmpscfgs.exe
    "C:\program files (x86)\internet explorer\wmpscfgs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- - C:\program files (x86)\internet explorer\wmpscfgs.exe
    "C:\program files (x86)\internet explorer\wmpscfgs.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
- - C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
    C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3492
- C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
  C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1848

C:\Program Files (x86)\Internet Explorer\ielowutil.exe
"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
1⤵
PID:1892

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:17410 /prefetch:2
  2⤵
  PID:4100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
558KB

MD5
78aa146c31bf97ebc726ba0ed8124226

SHA1
6594316ad930205686fbb545e1899c94f7ab0c0a

SHA256
d4dbe91b63c42123a3c13678dbd56ba799cab0ace232b57ed3d042c134f4546f

SHA512
37acf82cf45dd712e5e4eba22ac83cd4379f4d3a5754415f8c8960ad20d8277c448045f2f450f70902f9855cb7a7bbfe99678c6c696f21b97c1b0d1006ebed05

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
558KB

MD5
78aa146c31bf97ebc726ba0ed8124226

SHA1
6594316ad930205686fbb545e1899c94f7ab0c0a

SHA256
d4dbe91b63c42123a3c13678dbd56ba799cab0ace232b57ed3d042c134f4546f

SHA512
37acf82cf45dd712e5e4eba22ac83cd4379f4d3a5754415f8c8960ad20d8277c448045f2f450f70902f9855cb7a7bbfe99678c6c696f21b97c1b0d1006ebed05

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
558KB

MD5
78aa146c31bf97ebc726ba0ed8124226

SHA1
6594316ad930205686fbb545e1899c94f7ab0c0a

SHA256
d4dbe91b63c42123a3c13678dbd56ba799cab0ace232b57ed3d042c134f4546f

SHA512
37acf82cf45dd712e5e4eba22ac83cd4379f4d3a5754415f8c8960ad20d8277c448045f2f450f70902f9855cb7a7bbfe99678c6c696f21b97c1b0d1006ebed05

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
558KB

MD5
78aa146c31bf97ebc726ba0ed8124226

SHA1
6594316ad930205686fbb545e1899c94f7ab0c0a

SHA256
d4dbe91b63c42123a3c13678dbd56ba799cab0ace232b57ed3d042c134f4546f

SHA512
37acf82cf45dd712e5e4eba22ac83cd4379f4d3a5754415f8c8960ad20d8277c448045f2f450f70902f9855cb7a7bbfe99678c6c696f21b97c1b0d1006ebed05

Download Submit
C:\Program Files (x86)\Internet Explorer\wmpscfgs.exe

Filesize
558KB

MD5
78aa146c31bf97ebc726ba0ed8124226

SHA1
6594316ad930205686fbb545e1899c94f7ab0c0a

SHA256
d4dbe91b63c42123a3c13678dbd56ba799cab0ace232b57ed3d042c134f4546f

SHA512
37acf82cf45dd712e5e4eba22ac83cd4379f4d3a5754415f8c8960ad20d8277c448045f2f450f70902f9855cb7a7bbfe99678c6c696f21b97c1b0d1006ebed05

Download Submit
C:\program files (x86)\internet explorer\wmpscfgs.exe

Filesize
558KB

MD5
78aa146c31bf97ebc726ba0ed8124226

SHA1
6594316ad930205686fbb545e1899c94f7ab0c0a

SHA256
d4dbe91b63c42123a3c13678dbd56ba799cab0ace232b57ed3d042c134f4546f

SHA512
37acf82cf45dd712e5e4eba22ac83cd4379f4d3a5754415f8c8960ad20d8277c448045f2f450f70902f9855cb7a7bbfe99678c6c696f21b97c1b0d1006ebed05

Download Submit
\??\c:\program files (x86)\adobe\acrotray.exe

Filesize
588KB

MD5
0f4d47bca7cb28a45a4ee7251afb82b6

SHA1
4fe4fbf86903d3b491f0968e9e5740b053c96f33

SHA256
16707f9756c83459e93b1893a33f02c4c419b50e3e6a1fbd85164d42907aee01

SHA512
fcb3b480654670af45a52ca160ea5d7b76a553fbfd38635f26aa0155d13eb17cbb5667e9363973b7809df5e3a3274ad2b6cb87d578b1b19e23ca27d40f3c9b37

Download Submit
memory/1392-132-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads