8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e

Analysis

max time kernel
135s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe
Size

180KB
MD5

92a87e16cc9c9c037311c0e0e5d2ab30
SHA1

16d84dff2316d1b91675e2ad3e4303613f34e4e5
SHA256

8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e
SHA512

2f4de87835bea511ec19a9ccbd45f6de85111673e63b24a9fdefdf66bd99e81af31a6a84f6284792ce4bfdb0806e0c61da2d2fc36732e6822d36381d8bd5310a
SSDEEP

3072:MyceLphuXKPGoOUz6zWWamDmCbLhZUQPBuC+TUs2TxKCyGeXeheyzyUWa+mq:Ye1h/m7xbrUgiTUs2T0CDUe/zyy8

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 516 set thread context of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993628"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "218394494"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "222924227"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373953229"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "218394494"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30993628"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30993628"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{38581EEE-58CF-11ED-B696-466E527D41B2} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe
4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe
4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4920	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe
Token: SeDebugPrivilege	4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe
Token: SeDebugPrivilege	1412	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4920	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4920	IEXPLORE.EXE
4920	IEXPLORE.EXE
1412	IEXPLORE.EXE
1412	IEXPLORE.EXE
1412	IEXPLORE.EXE
1412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 516 wrote to memory of 4980	516	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	82
PID 4980 wrote to memory of 4952	4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	83
PID 4980 wrote to memory of 4952	4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	83
PID 4980 wrote to memory of 4952	4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	83
PID 4952 wrote to memory of 4920	4952	iexplore.exe	84
PID 4952 wrote to memory of 4920	4952	iexplore.exe	84
PID 4920 wrote to memory of 1412	4920	IEXPLORE.EXE	85
PID 4920 wrote to memory of 1412	4920	IEXPLORE.EXE	85
PID 4920 wrote to memory of 1412	4920	IEXPLORE.EXE	85
PID 4980 wrote to memory of 1412	4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	85
PID 4980 wrote to memory of 1412	4980	8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe	85

C:\Users\Admin\AppData\Local\Temp\8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe
"C:\Users\Admin\AppData\Local\Temp\8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\AppData\Local\Temp\8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe
  "C:\Users\Admin\AppData\Local\Temp\8ef0a80f88fd32ba06e3c8bf6608bb3f364c1ec9b896d51624dcdb508250074e.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4920 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
5ddb1febcd291eb59d3d67d24a05bfd0

SHA1
fe957affe27cb991f332e7f5c86d3a15359bd3b9

SHA256
ec45a385c906b3d925ebbe6532d10adec9a14c1733c756c64db5133bd9d88dcb

SHA512
62d00893402fae125ae3428da2495b0eb864b125f975cd887f894f7298a4a86f361cf50aaa7c9b69f3dcb734a950c43472778ea4062b3146c3de5623d08dcd21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
434B

MD5
a4c69a3e14b1c606b1af271d57be3953

SHA1
5c23c47919cee89ff3c15e6b7e9b32ce3d995979

SHA256
78ea94eaead55beece237e59976d24d392337b8adf1a64630956068eda672b1d

SHA512
aaa843ba83d4dfd6fc911d7134e0451b19eb7de10dcccae0b400dc5ef3ec71de858da8e5ada021b945151000281a671292af0612b31850ec97520b0cb6b47e9d

Download Submit
memory/516-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-135-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-134-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4980-137-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/4980-138-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4980-139-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4980-140-0x0000000000620000-0x000000000066F000-memory.dmp

Filesize
316KB

Download