3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9

General

Target

3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe
Size

28KB
MD5

111526ca76dedf1ce5d24f3dfe648e90
SHA1

f7d48d581ed80c00beadc80ddab64666605bf7aa
SHA256

3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9
SHA512

2d9776d6ed6ef0b10a3434e35ec5d20abd44a8fc67cfc8bd0c617bc2d212d83677cc3d5275a758c62b4830767af23d360fd537d840ec2c1d3a6c3a56f2570f74
SSDEEP

192:6JsBhcPCHpAjDdFLa26jZ4chMceZ4myrNqQJHlD941Wmw:msv8CQDdFW26jZbw4qwHlD941Wmw

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsass.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
1716	lsass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "C:\\Windows\\lsass.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsass.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\lsass.exe	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe
File opened for modification	C:\Windows\lsass.exe	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://thecoolpics.net"	lsass.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe
1716	lsass.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2020	1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe	27
PID 1672 wrote to memory of 2020	1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe	27
PID 1672 wrote to memory of 2020	1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe	27
PID 1672 wrote to memory of 2020	1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe	27
PID 1672 wrote to memory of 1716	1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe	29
PID 1672 wrote to memory of 1716	1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe	29
PID 1672 wrote to memory of 1716	1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe	29
PID 1672 wrote to memory of 1716	1672	3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe	29

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	lsass.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	lsass.exe

C:\Users\Admin\AppData\Local\Temp\3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe
"C:\Users\Admin\AppData\Local\Temp\3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\explorer.exe
  explorer C:
  2⤵
  PID:2020
- C:\Windows\lsass.exe
  C:\Windows\lsass.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Modifies Internet Explorer start page
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1716

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\lsass.exe

Filesize
28KB

MD5
111526ca76dedf1ce5d24f3dfe648e90

SHA1
f7d48d581ed80c00beadc80ddab64666605bf7aa

SHA256
3ccca5e5c7d69e22e18f488f5bc7adaaf065d0d58e5bcdaa60704cb2ca752ae9

SHA512
2d9776d6ed6ef0b10a3434e35ec5d20abd44a8fc67cfc8bd0c617bc2d212d83677cc3d5275a758c62b4830767af23d360fd537d840ec2c1d3a6c3a56f2570f74

Download Submit
memory/1632-60-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Filesize
8KB

Download
memory/1632-65-0x00000000039B0000-0x00000000039C0000-memory.dmp

Filesize
64KB

Download
memory/1672-59-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1672-66-0x00000000003E0000-0x00000000003E7000-memory.dmp

Filesize
28KB

Download
memory/1672-68-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1716-67-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1716-69-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2020-57-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/2020-58-0x0000000074BF1000-0x0000000074BF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads