9a78c58d515e501abd5f93d196f8452c1a62736454b7313e8ee26d1fbd20b0d2

General

Target

9a78c58d515e501abd5f93d196f8452c1a62736454b7313e8ee26d1fbd20b0d2.dll
Size

497KB
MD5

91e468a26d3874218232010daf7242fe
SHA1

99d849b7b1949ce57d08baa46873aecb5cc6f304
SHA256

9a78c58d515e501abd5f93d196f8452c1a62736454b7313e8ee26d1fbd20b0d2
SHA512

baf343f5e5f74179450071521e56eb0fbefff00c815ca01626185442e5b16438334eef44f59f3846a880658ca3af65df45b39353e8e3fbcc8bd41aa581e49c77
SSDEEP

12288:xNrMi/MhNrcnzlElRcsUhOsyG3s1AsEOO:/D/MhNgyRc5sJYns

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

896 takeown.exe
592 icacls.exe
Loads dropped DLL 2 IoCs

Processes:

IEXPLORE.EXE

pid process

1784 IEXPLORE.EXE
1784 IEXPLORE.EXE
Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

592 icacls.exe
896 takeown.exe
Drops file in System32 directory 2 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\msimg64.dll rundll32.exe
File opened for modification C:\Windows\SysWOW64\msimg64.dll rundll32.exe

pid	process
896	takeown.exe
592	icacls.exe

pid	process
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

pid	process
592	icacls.exe
896	takeown.exe

description	ioc	process
File created	C:\Windows\SysWOW64\msimg64.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\msimg64.dll	rundll32.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F739A121-5023-11ED-BDDC-626677DD231B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a0000000002000000000010660000000100002000000086ae0a909bf60de5c1ef4710525d959211a1e27bd4284c4538793f6015451f88000000000e80000000020000200000004fa2164e9ba3d53d23468d26a9eaaa8ea4bf31c54a44aa49aa179126d667ea73900000008f978de435c25f911f8873d73414addc40dccce6427d0623052ff2d0c8a552cf7a0cd27dd2b84b9771efd197658b919ac1d5d6b570b15b2aca522aa61756e800d0116ab854b2c36c121a0e292dbe8bf078554612116d8e8947c65f0d9556e78bd824a7fe97021ada40a7d868826e290a2721b237cfae7b4d2121ecce8a1349eb3c2e1388abad9339b105fb8848f0aac2400000003975ebc3e6269785f557f7d3fd14ba61731b51a07b2b07381185fb98683cd6405bbd059163a7799253bfa20c50e757a6f7c22a3d7bf465271a46405a8fc48b0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373000066"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506d72d130e4d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000003dbef06e089d77325248121a94b4dfbcfc11377b81c3795540824078de8d1b0a000000000e80000000020000200000000496a692338b792039f33735ad28e1e50301c490e70efb5431897a7a96ed301c200000001e3d6b7210774c1c00b00283e4b9b4f859a4780c79aa2f76e2a4abbae93c915440000000e62d407f3fc189a4895b02a2b156090d5a2b29b6b62661852504113928c66ba9cfcba965f772272f982d5fbda665952fbb61ef52c5510a97a69a1474ca404b25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1352 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1352 iexplore.exe
1352 iexplore.exe
1784 IEXPLORE.EXE
1784 IEXPLORE.EXE
1784 IEXPLORE.EXE
1784 IEXPLORE.EXE

pid	process
1352	iexplore.exe

pid	process
1352	iexplore.exe
1352	iexplore.exe
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE
1784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

rundll32.exerundll32.execmd.exeiexplore.exe

description	pid	process	target process
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1552 wrote to memory of 1612	1552	rundll32.exe	rundll32.exe
PID 1612 wrote to memory of 1548	1612	rundll32.exe	cmd.exe
PID 1612 wrote to memory of 1548	1612	rundll32.exe	cmd.exe
PID 1612 wrote to memory of 1548	1612	rundll32.exe	cmd.exe
PID 1612 wrote to memory of 1548	1612	rundll32.exe	cmd.exe
PID 1612 wrote to memory of 1352	1612	rundll32.exe	iexplore.exe
PID 1612 wrote to memory of 1352	1612	rundll32.exe	iexplore.exe
PID 1612 wrote to memory of 1352	1612	rundll32.exe	iexplore.exe
PID 1612 wrote to memory of 1352	1612	rundll32.exe	iexplore.exe
PID 1612 wrote to memory of 1352	1612	rundll32.exe	iexplore.exe
PID 1548 wrote to memory of 896	1548	cmd.exe	takeown.exe
PID 1548 wrote to memory of 896	1548	cmd.exe	takeown.exe
PID 1548 wrote to memory of 896	1548	cmd.exe	takeown.exe
PID 1548 wrote to memory of 896	1548	cmd.exe	takeown.exe
PID 1548 wrote to memory of 592	1548	cmd.exe	icacls.exe
PID 1548 wrote to memory of 592	1548	cmd.exe	icacls.exe
PID 1548 wrote to memory of 592	1548	cmd.exe	icacls.exe
PID 1548 wrote to memory of 592	1548	cmd.exe	icacls.exe
PID 1352 wrote to memory of 1784	1352	iexplore.exe	IEXPLORE.EXE
PID 1352 wrote to memory of 1784	1352	iexplore.exe	IEXPLORE.EXE
PID 1352 wrote to memory of 1784	1352	iexplore.exe	IEXPLORE.EXE
PID 1352 wrote to memory of 1784	1352	iexplore.exe	IEXPLORE.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a78c58d515e501abd5f93d196f8452c1a62736454b7313e8ee26d1fbd20b0d2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1552

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9a78c58d515e501abd5f93d196f8452c1a62736454b7313e8ee26d1fbd20b0d2.dll,#1
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f "C:\Windows\system32\msimg64.dll" && icacls "C:\Windows\system32\msimg64.dll" /grant administrators:F
3⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\SysWOW64\takeown.exe
takeown /f "C:\Windows\system32\msimg64.dll"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:896

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\system32\msimg64.dll" /grant administrators:F
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:592

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" www.google.com
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1352

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1352 CREDAT:275457 /prefetch:2
4⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1784

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f4ad42187647f9247c23128b89f11ab0

SHA1
12c6dd4f1ea665c20b1ee1024fff3bedef9d8140

SHA256
3973d1717ec0b533fa0c5cffefba466b6483dfbfb0dadebd8b6983eac194226b

SHA512
b1c9542f1fe82b7559633f4bafa94e1c2c4bfa6d30449dea8e6df18aa812275f3994d9d9b37024233ff1e30bc4f2df5afedc02ede0431d9e90720e0b0314b458

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
9KB

MD5
5d6e31c2f8fdb54a6d2c6f5918fa356b

SHA1
d49e223d145048793819f2e00694923c9705c5b2

SHA256
d9127655f8cd3400cb8c7ff7c6eda1bf28c0d9af14922ddc1269c98074f29082

SHA512
fbdbd767b780eaf45c4209e28eca4b2d1ddd7c12836ca3ba932185c863dde836402629f8a8c6f2646ee60652f956a5e1a5767156789abf36c35f37d50f19eb6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MQM0YDBZ.txt
Filesize
608B

MD5
88e1ce85e061a260afd2b7db8027df37

SHA1
8ca865719e7ea999d81116a360b7ae2c6593e542

SHA256
27020eefd2fd5ffcb1458c36975eb97c5c67a6f40c0605f83e13d9c588013583

SHA512
080c8351ceac3003a860ac81e09eaf303149e5398851e5c883893a5d9afd0be8c67d048338f27d4c753a048f0c27da7e88d724eaaa7dfdf24b66b0f965cdeae6

Download Submit
C:\Windows\SysWOW64\msimg64.dll
Filesize
178KB

MD5
81cfde0d21674039ba098ac02b541d5e

SHA1
49b09c5afd5b7292030e8bc7f12be160f1e17c88

SHA256
8ffc41824530337e072481d3dbf091be3065facd95749775b205768c2d91e33d

SHA512
03c1dd0c2b059f81911d3d6c790d640ec01be3c40ac5c38b1d491ef75a4b73d4fe8df3da9803aa7db4a3bd0ba93c95950b6cc82d765db224cfe1cada69fad2f4

Download Submit
\Windows\SysWOW64\msimg64.dll
Filesize
178KB

MD5
81cfde0d21674039ba098ac02b541d5e

SHA1
49b09c5afd5b7292030e8bc7f12be160f1e17c88

SHA256
8ffc41824530337e072481d3dbf091be3065facd95749775b205768c2d91e33d

SHA512
03c1dd0c2b059f81911d3d6c790d640ec01be3c40ac5c38b1d491ef75a4b73d4fe8df3da9803aa7db4a3bd0ba93c95950b6cc82d765db224cfe1cada69fad2f4

Download Submit
\Windows\SysWOW64\msimg64.dll
Filesize
178KB

MD5
81cfde0d21674039ba098ac02b541d5e

SHA1
49b09c5afd5b7292030e8bc7f12be160f1e17c88

SHA256
8ffc41824530337e072481d3dbf091be3065facd95749775b205768c2d91e33d

SHA512
03c1dd0c2b059f81911d3d6c790d640ec01be3c40ac5c38b1d491ef75a4b73d4fe8df3da9803aa7db4a3bd0ba93c95950b6cc82d765db224cfe1cada69fad2f4

Download Submit
memory/592-59-0x0000000000000000-mapping.dmp

Download
memory/896-57-0x0000000000000000-mapping.dmp

Download
memory/1548-56-0x0000000000000000-mapping.dmp

Download
memory/1612-54-0x0000000000000000-mapping.dmp

Download
memory/1612-55-0x0000000075681000-0x0000000075683000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing