af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913

General

Target

af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe
Size

4.5MB
MD5

1cf03e6ef499298e250a6b259c2501a1
SHA1

b0dca7a4f2ad82d97ee26c32283a10c5d5391b71
SHA256

af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913
SHA512

6b4e44706b7aed37849d01de973d4e135cbdf4cb40a4dd103f3a3b2f0eb91f7a0aa7f6057aafe3f910aa2216429a5fc7c4b86ec3a7f007490424612802e28d6d
SSDEEP

98304:k0kM8Sa3crpn9IKnfltncYcp9r7GAUqbzdqxNcBuYd5/aRJP1NmAe2r5zF:k0K/+x9TflxcP9PGAH9qLc5/6P1JeczF

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4816	winsealxp.exe

Loads dropped DLL 3 IoCs

pid	Process
4816	winsealxp.exe
4816	winsealxp.exe
4816	winsealxp.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\orange-install.ico	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe
File created	C:\Windows\SysWOW64\GLBSINST.%$D	winsealxp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\Codepage = "65001"	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\DisplayName = "°Ù¶È"	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\URL = "http://www.baidu.com/s?wd={searchTerms}&tn=leizhen&cl=3&ie=utf-8"	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\SearchScopes	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{24588FA4-10F1-41D7-B19D-6E22361E47FA}"	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 4816	3548	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe	81
PID 3548 wrote to memory of 4816	3548	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe	81
PID 3548 wrote to memory of 4816	3548	af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe	81

C:\Users\Admin\AppData\Local\Temp\af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe
"C:\Users\Admin\AppData\Local\Temp\af065e766e54e1421fd89887a4a707c529be4466ee139678b9eec63b49f84913.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Users\Admin\AppData\Local\Temp\nss8EB9.tmp\winsealxp.exe
  C:\Users\Admin\AppData\Local\Temp\nss8EB9.tmp\winsealxp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:4816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GLC91E4.tmp

Filesize
161KB

MD5
8c97d8bb1470c6498e47b12c5a03ce39

SHA1
15d233b22f1c3d756dca29bcc0021e6fb0b8cdf7

SHA256
a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a

SHA512
7ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLK9214.tmp

Filesize
33KB

MD5
517419cae37f6c78c80f9b7d0fbb8661

SHA1
a9e419f3d9ef589522556e0920c84fe37a548873

SHA256
bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11

SHA512
5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40

Download Submit
C:\Users\Admin\AppData\Local\Temp\GLK9214.tmp

Filesize
33KB

MD5
517419cae37f6c78c80f9b7d0fbb8661

SHA1
a9e419f3d9ef589522556e0920c84fe37a548873

SHA256
bfe7e013cfb85e78b994d3ad34eca08286494a835cb85f1d7bced3df6fe93a11

SHA512
5046565443cf463b6fa4d2d5868879efc6a9db969bf05e3c80725b99bd091ce062cfe66c5551eb1cc5f00a38f2cfcda1f36fb4d60d9ff816c4ec3107b5a0df40

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8EB9.tmp\winsealxp.exe

Filesize
4.3MB

MD5
c2f8eae737f507ed6ae9a052b2fdeccf

SHA1
3f8fdc62a6b907b174f4110227daa024b1838b5e

SHA256
60ffd0caff1f221f9051f69fe44433012b17ad7a336e781da7cc2575e92095e4

SHA512
865c8c679b6c2355d75ea7c6a2bfff24b3de0f56b1c5c40d46f758810506cd657b3ced2020d7a038b89af713af99c346d47f827cda5b216aef7667b9f42b043b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nss8EB9.tmp\winsealxp.exe

Filesize
4.3MB

MD5
c2f8eae737f507ed6ae9a052b2fdeccf

SHA1
3f8fdc62a6b907b174f4110227daa024b1838b5e

SHA256
60ffd0caff1f221f9051f69fe44433012b17ad7a336e781da7cc2575e92095e4

SHA512
865c8c679b6c2355d75ea7c6a2bfff24b3de0f56b1c5c40d46f758810506cd657b3ced2020d7a038b89af713af99c346d47f827cda5b216aef7667b9f42b043b

Download Submit
memory/4816-138-0x0000000002221000-0x0000000002223000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing