a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9

Analysis

max time kernel
49s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Size

1.1MB
MD5

4f17290eab9d44677090e3c27ff9d7e0
SHA1

e0dec5518445d852daac74e7327b64bef6032b8e
SHA256

a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9
SHA512

0e4ca4adbad6c7ca6dc038d49896ddaf5b6630d2f24baf184fa78d2e3957de02e2665f164eb5c5897c339a3e780fa71bda951d00792da50ba717911f87dfeb6c
SSDEEP

24576:liNaxSW+HP0wUt7pNgYagG6m9HBR60rzr4aA:6awWoNUttiYa9fHB/PsaA

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\DefaultValue = "yes"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_GPU_RENDERING\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "10"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\CheckedValue = "yes"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "9000"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "10"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\UncheckedValue = "no"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ACTIVEX_REPURPOSEDETECTION\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ACTIVEX_REPURPOSEDETECTION	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER\DefaultValue = "yes"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\UncheckedValue = "no"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_IMG\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe = "1"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_IMG	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SCRIPT_DEBUGGER_IE\CheckedValue = "yes"	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_Cross_Domain_Redirect_Mitigation	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
904	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
904	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
904	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
904	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
904	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
904	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
904	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
904	a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe

C:\Users\Admin\AppData\Local\Temp\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe
"C:\Users\Admin\AppData\Local\Temp\a39e9440d60b3a6cb05298a48783911136be12f50bbfd9e4d1536e63c21e50e9.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download