Analysis
-
max time kernel
119s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 02:59
Static task
static1
Behavioral task
behavioral1
Sample
adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe
-
Size
76KB
-
MD5
7ba912af2aef3afb969f67f5afc9a6d0
-
SHA1
522af879ba9b007f48d69ef6888739022addab84
-
SHA256
adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb
-
SHA512
b3f1f6d0576bbbe4da78e13c99d452ef6cbb4b9912123e11cf430678bc35f3a61d2b7471f30b44f1c6e36f3cfb553fd90bca958e6d570dd89a877dcbff30a706
-
SSDEEP
768:jxDI8Nwl34ETcpcbCgHjSJ070vvLXmJuBGNgj5mMjI1t0cT4qf7hOZR6f6Y:jxDXwTQcbCg29nLXcu8h7hOZRhY
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 112 regsvr32.exe -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C} regsvr32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\hdbt.dll adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "372231089" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000e7183f5b7c2a6c09c3a9bfd906c78562aea1d3469936400a3abd44d325644597000000000e8000000002000020000000e402c38b46d075969e02e2cfe34a99868e0f1f30dc9d46957e16a1829dbaf5cf90000000d72765261f627a110953d75800a7b40abec15ffe4cdfdd745f2718d3a1d06dc62432a9eee9176d4f9e17bd1f060364cf6fbe8a8257b45ee428dfd5356bd0a25584c6b88f10eca4156ddcba4cf67d53306bc191008b50d1d2667e73279cc3f1c0f28c13be0dc65dfaa0ee07fdbf2080f17b0e9e7253fd6edf9ecae1856735d5352f30c8eb96015bbad05cd31f675183f740000000af51a24b948d999f41cb5c721262342186814cf88181868af8fc6f6574b36933ccf7b47de14c084014a7fa9a484c3f57f5c303c70937b51de5ee28e0dc3e2a2c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d3b98f5693c0d24b85f349229339c59c00000000020000000000106600000001000020000000bb2ff0a0e9d9fb9ea75d20b27be8138746f083a42b7b25914816d52f65bbd7e9000000000e80000000020000200000004b1e5ae9e185458e44b1bde119b9400c9c60e21c22c3515ce40e18fd4df4f2b2200000001373c78c0b81a85da9df698d9e414c22895b50eeeeb30c8033e9ee189ba9079b40000000c905c0c9087eff60af1f1ae40131893e51c36275497c190d3f5e88a46c4a3cfed6dac056b9d321b0e347a549213c427c0cde6962012b016838b9cfe4635c0cd3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{81FF8691-4925-11ED-B40B-E20468906380} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0be366c32ddd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Modifies registry class 60 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\ = "IE Story" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\ProgID\ = "Gorpy" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Gorpy regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Gorpy\ = "IE Story" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Gorpy\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\ = "Type Library" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ = "IBho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ = "_IBhoEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\hdbt.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\ = "IE Story" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Gorpy\CLSID\ = "{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CLSID\ = "{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\InprocServer32\ = "C:\\Windows\\SysWow64\\hdbt.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ = "_IBhoEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\VersionIndependentProgID\ = "BhoNew.Bho" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ = "IBho" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoNew.Bho\CurVer\ = "Gorpy" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A83359CE-23D4-4E1A-9D4E-C94AEDD1A67C}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C1D4354E-C81A-4C16-9C41-D6FB49AA31A8}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib\ = "{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{15C7D7AD-A87A-4C0D-9D8B-637FCD3488EF}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{049652C3-55AE-4A6E-84CE-0C5B733E8F82}\TypeLib regsvr32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1432 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1432 iexplore.exe 1432 iexplore.exe 576 IEXPLORE.EXE 576 IEXPLORE.EXE 576 IEXPLORE.EXE 576 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2044 wrote to memory of 1432 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 27 PID 2044 wrote to memory of 1432 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 27 PID 2044 wrote to memory of 1432 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 27 PID 2044 wrote to memory of 1432 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 27 PID 2044 wrote to memory of 112 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 28 PID 2044 wrote to memory of 112 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 28 PID 2044 wrote to memory of 112 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 28 PID 2044 wrote to memory of 112 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 28 PID 2044 wrote to memory of 112 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 28 PID 2044 wrote to memory of 112 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 28 PID 2044 wrote to memory of 112 2044 adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe 28 PID 1432 wrote to memory of 576 1432 iexplore.exe 30 PID 1432 wrote to memory of 576 1432 iexplore.exe 30 PID 1432 wrote to memory of 576 1432 iexplore.exe 30 PID 1432 wrote to memory of 576 1432 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe"C:\Users\Admin\AppData\Local\Temp\adaec2245a4b01d2ff9f68260ed9a3ce9ce6754b22a0032d3812e00472a925bb.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://hotvid44.com/bind2.php?id=39133672⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1432 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:576
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\hdbt.dll"2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
606B
MD5abcee64c4c71877eda8aea66b0f6e602
SHA1c9f783309aa09f14693986922d4e31c5dad00402
SHA2566e84f134b78912f913ffc02cb1fd7e343fe4024bcab461339790d7c9959027e7
SHA5128ab0f9babbd34c48bead76a71a41d8507f524cea6d380f914301fe52da9d7ec2d48a8ad7a63270a841ed4d3aa8bf878f46a5f3a437b2f64df6796740e11ab1ad
-
Filesize
52KB
MD5f6a2a59a84cd7d3bb109ad6acdd7ba39
SHA1c0dc3e9ee183fbe659830d8b65791f6dd993e668
SHA256a221c8b0bdbce003df66f7bed5236b304980f70a297ee85c56f94ed1dac67c9d
SHA512f1d2239da5562e1f8a9fb089077288d1c0bed0908bd669a5638e97a6c874bcdd0bfc48b1be2a77837f984465f4a50bb17ca34291f1e0f97ac49f14451ebf3d7b
-
Filesize
52KB
MD5f6a2a59a84cd7d3bb109ad6acdd7ba39
SHA1c0dc3e9ee183fbe659830d8b65791f6dd993e668
SHA256a221c8b0bdbce003df66f7bed5236b304980f70a297ee85c56f94ed1dac67c9d
SHA512f1d2239da5562e1f8a9fb089077288d1c0bed0908bd669a5638e97a6c874bcdd0bfc48b1be2a77837f984465f4a50bb17ca34291f1e0f97ac49f14451ebf3d7b