54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934

General

Target

54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe
Size

33KB
MD5

92509af9b7a485ad0d9384e335b98760
SHA1

57eecbf4dca080971b143f731242b63c2b003e27
SHA256

54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934
SHA512

63ea72155764e9ccc331a0eb25f51189151eb7667c28b1b8c29e60504bc6e128e0e0f032d299c4ba0eea26365218c160ebebfa767e79bf17c0c104701f5eb560
SSDEEP

384:8ILsbCRufBonxlSru+kSBPi+8mKFLRoEjGsbiZOLT9npzl+1PZ0n5yf1kzauvkfn:3sQeonOxkSB0FdoXsVpMhiau8fn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
760	explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe"	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	RunDll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	RunDll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Cleared_TIMESTAMP = 000a0100dce3d801	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	RunDll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	RunDll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	RunDll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Cleared = "1"	RunDll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	RunDll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395168194"	RunDll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395168194"	RunDll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	RunDll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TypedURLs	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	760	explorer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1492	RunDll32.exe
336	RunDll32.exe
1120	RunDll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
760	explorer.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1492	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	27
PID 1368 wrote to memory of 1492	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	27
PID 1368 wrote to memory of 1492	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	27
PID 1368 wrote to memory of 336	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	28
PID 1368 wrote to memory of 336	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	28
PID 1368 wrote to memory of 336	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	28
PID 1368 wrote to memory of 1120	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	29
PID 1368 wrote to memory of 1120	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	29
PID 1368 wrote to memory of 1120	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	29
PID 1368 wrote to memory of 760	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	31
PID 1368 wrote to memory of 760	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	31
PID 1368 wrote to memory of 760	1368	54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe	31
PID 336 wrote to memory of 1116	336	RunDll32.exe	32
PID 336 wrote to memory of 1116	336	RunDll32.exe	32
PID 336 wrote to memory of 1116	336	RunDll32.exe	32

C:\Users\Admin\AppData\Local\Temp\54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe
"C:\Users\Admin\AppData\Local\Temp\54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:1492
- C:\Windows\system32\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -ResetDestinationList
    3⤵
    PID:1116
- C:\Windows\system32\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:1120
- C:\Users\Admin\AppData\Roaming\explorer.exe
  "C:\Users\Admin\AppData\Roaming\explorer.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\explorer.exe

Filesize
33KB

MD5
92509af9b7a485ad0d9384e335b98760

SHA1
57eecbf4dca080971b143f731242b63c2b003e27

SHA256
54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934

SHA512
63ea72155764e9ccc331a0eb25f51189151eb7667c28b1b8c29e60504bc6e128e0e0f032d299c4ba0eea26365218c160ebebfa767e79bf17c0c104701f5eb560

Download Submit
C:\Users\Admin\AppData\Roaming\explorer.exe

Filesize
33KB

MD5
92509af9b7a485ad0d9384e335b98760

SHA1
57eecbf4dca080971b143f731242b63c2b003e27

SHA256
54db64a84496755b91d94c070eea3ce26459ca2213242a6248e3704c44a11934

SHA512
63ea72155764e9ccc331a0eb25f51189151eb7667c28b1b8c29e60504bc6e128e0e0f032d299c4ba0eea26365218c160ebebfa767e79bf17c0c104701f5eb560

Download Submit
memory/760-69-0x000007FEF2B50000-0x000007FEF3BE6000-memory.dmp

Filesize
16.6MB

Download
memory/760-68-0x000007FEF3BF0000-0x000007FEF4613000-memory.dmp

Filesize
10.1MB

Download
memory/1368-54-0x000007FEF3BF0000-0x000007FEF4613000-memory.dmp

Filesize
10.1MB

Download
memory/1368-67-0x0000000000B06000-0x0000000000B25000-memory.dmp

Filesize
124KB

Download
memory/1368-56-0x0000000000B06000-0x0000000000B25000-memory.dmp

Filesize
124KB

Download
memory/1368-55-0x000007FEF2B50000-0x000007FEF3BE6000-memory.dmp

Filesize
16.6MB

Download
memory/1492-58-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads