10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3

General

Target

10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
Size

156KB
MD5

51c310181e3fed26d58655bd3cf171c0
SHA1

c2d050a868da1143e3627c81c41a1ba5420645d9
SHA256

10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3
SHA512

391d43e4477ca907c7af228f48f5021b16d70551e2e87f303edd74b7f853608fb4641d6fc4ba8027b43bf63554af872641333c17a33efcb841d36354946ca74b
SSDEEP

3072:O6M0dATPzlXJjHL/F9BRqKY5ntwexnLEHCGv:OMEzlZjHL/F9B0KY5ntP1EHtv

Score

8^/10

evasion

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 2 IoCs

pid	Process
1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
1804	IEXPLORE.EXE

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\xpsp11res.dll	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
File created	C:\Program Files (x86)\Common Files\xpsp11tdi.sys	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
File created	C:\Program Files (x86)\Common Files\xpsp11reg.sys	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
File created	C:\Program Files (x86)\Common Files\xp11update.exe	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2032	sc.exe
2040	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7942DA41-5814-11ED-90F1-D6AAFEFD221A} = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373873026"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
960	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
960	IEXPLORE.EXE
960	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2032	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	27
PID 1256 wrote to memory of 2032	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	27
PID 1256 wrote to memory of 2032	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	27
PID 1256 wrote to memory of 2032	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	27
PID 1256 wrote to memory of 2040	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	28
PID 1256 wrote to memory of 2040	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	28
PID 1256 wrote to memory of 2040	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	28
PID 1256 wrote to memory of 2040	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	28
PID 1256 wrote to memory of 1692	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	31
PID 1256 wrote to memory of 1692	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	31
PID 1256 wrote to memory of 1692	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	31
PID 1256 wrote to memory of 1692	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	31
PID 1692 wrote to memory of 960	1692	IEXPLORE.EXE	32
PID 1692 wrote to memory of 960	1692	IEXPLORE.EXE	32
PID 1692 wrote to memory of 960	1692	IEXPLORE.EXE	32
PID 1692 wrote to memory of 960	1692	IEXPLORE.EXE	32
PID 960 wrote to memory of 1804	960	IEXPLORE.EXE	34
PID 960 wrote to memory of 1804	960	IEXPLORE.EXE	34
PID 960 wrote to memory of 1804	960	IEXPLORE.EXE	34
PID 960 wrote to memory of 1804	960	IEXPLORE.EXE	34
PID 1256 wrote to memory of 1804	1256	10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe	34

C:\Users\Admin\AppData\Local\Temp\10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe
"C:\Users\Admin\AppData\Local\Temp\10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\sc.exe
  sc.exe stop KWatchSvc
  2⤵
  - Launches sc.exe
  PID:2032
- C:\Windows\SysWOW64\sc.exe
  sc.exe delete KWatchSvc
  2⤵
  - Launches sc.exe
  PID:2040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:960
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:960 CREDAT:275457 /prefetch:2
      4⤵
      Loads dropped DLL
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\xpsp11res.dll

Filesize
64KB

MD5
2525aaa5235d0162c375cc9d6e913d4b

SHA1
e3c0ebcd75bd28611e7cfe5928fb1288d256d07f

SHA256
28318f923a63c8c609f2fc2ff8f9926325503e8db33768b20d397d91d45f99de

SHA512
51a4a3c379f8ee6bf43126b1535ea1846f23acd891724a0729df678f8487edbb7ef8108b6c6b1ba7bccf563c57be1a5e5cf71d2ced0fd2e2cb70192cafcb518a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8RHE01CK.txt

Filesize
606B

MD5
ba6dcd5501bd22a1d339f515763a5809

SHA1
e5edead536551c59f273e2b7152a5a19e4c16d9b

SHA256
473bdd661f6aa7b9f100802ab100fe38581532d4b1ad3713e67139c963606b58

SHA512
1fbe2801bf3c7b023b5804584d57676f3b459ec3ea6ff7d39057006093059bd9deaa4770b924785fee5eba99c5a94d36cd501260ae6f11296f1d106ceb5ca6f7

Download Submit
\Program Files (x86)\Common Files\xp11update.exe

Filesize
156KB

MD5
51c310181e3fed26d58655bd3cf171c0

SHA1
c2d050a868da1143e3627c81c41a1ba5420645d9

SHA256
10293781bfa499552dffa54967f919aa9cbc9b308c1f8ac497c451c84278eda3

SHA512
391d43e4477ca907c7af228f48f5021b16d70551e2e87f303edd74b7f853608fb4641d6fc4ba8027b43bf63554af872641333c17a33efcb841d36354946ca74b

Download Submit
\Program Files (x86)\Common Files\xpsp11res.dll

Filesize
64KB

MD5
2525aaa5235d0162c375cc9d6e913d4b

SHA1
e3c0ebcd75bd28611e7cfe5928fb1288d256d07f

SHA256
28318f923a63c8c609f2fc2ff8f9926325503e8db33768b20d397d91d45f99de

SHA512
51a4a3c379f8ee6bf43126b1535ea1846f23acd891724a0729df678f8487edbb7ef8108b6c6b1ba7bccf563c57be1a5e5cf71d2ced0fd2e2cb70192cafcb518a

Download Submit
memory/1256-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing