6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c

General

Target

6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Size

704KB
MD5

22c9c131b9afe97bc42c02b8806bbf3d
SHA1

08f6e7c939f2e0fbaa702c7b2fe60abc8489559d
SHA256

6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c
SHA512

26e0bba9a0ed8f4081292f5f07f9d706758f09486d85dfd6bd6c8ca5e1f2880c08f95c9b8c7f2b10e25586bd242a815c13420b4cef99efcfa100c1e3ac564656
SSDEEP

6144:0XS5J92W/FwOkNkHcuZuX723YqCm3wgY9IcK2G2dwzEnpjWw+eLO0dN/oHW8sb:0XS5jF74McuZurv7fxG2dwMpjJ+ez

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4340	ºüµºµþÅç17ºÅÐÞ¸´·Ç·¨.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\ºüµºµþÅç17ºÅÐÞ¸´·Ç·¨.exe	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\x5pd.com	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\x5pd.com\Total = "126"	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\x5pd.com	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\x5pd.com\NumberOfSubdomains = "1"	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.x5pd.com	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.x5pd.com\ = "63"	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\x5pd.com\Total = "63"	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.x5pd.com\ = "126"	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2384	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
2384	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
2384	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
2384	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 4340	2384	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe	83
PID 2384 wrote to memory of 4340	2384	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe	83
PID 2384 wrote to memory of 4340	2384	6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe	83

C:\Users\Admin\AppData\Local\Temp\6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe
"C:\Users\Admin\AppData\Local\Temp\6924d30402e2c92913a07adb5bc341b9ba89a19c60c07e9f2641311c2e3ce45c.exe"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\WINDOWS\ºüµºµþÅç17ºÅÐÞ¸´·Ç·¨.exe
  C:\WINDOWS\ºüµºµþÅç17ºÅÐÞ¸´·Ç·¨.exe
  2⤵
  - Executes dropped EXE
  PID:4340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\ºüµºµþÅç17ºÅÐÞ¸´·Ç·¨.exe

Filesize
72KB

MD5
e0ae6993d6c552357051518028704f45

SHA1
0bb203e5a0d57d427d82e544d6ce56b746f4dab5

SHA256
f60ed0315fc5dcef2f0cf8378a2352bc103ed057a5db90e4490b650694dea8a5

SHA512
a8954b6480d1364b0eb6bd4ba2a54a51c297d25d9ac1093a95e26358265f0baa15d229704cf727bffd363c98af7f683dc03c69dc39122f4f3294dcbb06f15740

Download Submit
C:\Windows\ºüµºµþÅç17ºÅÐÞ¸´·Ç·¨.exe

Filesize
72KB

MD5
e0ae6993d6c552357051518028704f45

SHA1
0bb203e5a0d57d427d82e544d6ce56b746f4dab5

SHA256
f60ed0315fc5dcef2f0cf8378a2352bc103ed057a5db90e4490b650694dea8a5

SHA512
a8954b6480d1364b0eb6bd4ba2a54a51c297d25d9ac1093a95e26358265f0baa15d229704cf727bffd363c98af7f683dc03c69dc39122f4f3294dcbb06f15740

Download Submit
memory/4340-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download

Analysis

Sharing