a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65

General

Target

a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exe
Size

441KB
MD5

0aa6f8dde56755dc07715030ba7b5500
SHA1

0844f6bbfdce65336cdc669ccbf78729cb90802f
SHA256

a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65
SHA512

187f2f0adaf8650e7d4325f8e568379c795dab1c3933899dcc50e4549d8c49c4889a52b8161e5b2fbbeb986385b5c36e07009b18c54a3eaf3726380e86ab7680
SSDEEP

12288:rs9DnIcuLAEYxU7uej3v+P2LXdxnEKY07gV:rwrIxLh37BSaXwV

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f6e6d911398b4b4a92e92af2842326b600000000020000000000106600000001000020000000c93ddfea79bdc3b5fbd1b97f3b573bca030b9f65a31a36a5bd3fef2b922f6a8a000000000e80000000020000200000008873da805bbe435edced70a99906abb8f72fa3bbfc6e018696b1185f9389b4f82000000078d5d2914a3acf234fa2d2cf0036f82a3581fa25842b19df1543eee630f9a910400000006b2da9ebf5b573e6470365889da59056b11589e3d56624f34c78763777d21377592a0a5cea2ac689eebfab4d4af465a2fcc5bcfcb106447b04f59f3e73a55bff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f6e6d911398b4b4a92e92af2842326b6000000000200000000001066000000010000200000009f2c9f224cdd4eef97b24a355e98a02095b683dd7312d7e8aad0b882d5931b65000000000e8000000002000020000000abeea7c2f16046799ac404ee4f11ad871fcdabba5c024b2ab9883f73b9292aef900000008ce4c1d47e1c9e7e6f5ee96dd8a50e2b4e4c383914151e9db7cc5952bcf0f58504176f3505a04c60214f8069d48c1a9e71329af0ed34a935b38ad0c325a33f483f2098e6a314717f53c9595930ddd91bf465c5d689436b596796ef6d5cf06de507b6190544d498813f77784327ab7d6f563c78ba553cf1a11c6b96da7962e8105658306ef77f9661c5fafeb50f20fe62400000002855d24142052d7a43ccb0c72ed0b3ed916d7d43f4c25540b0a524d71384b59c0e73f188463ec6570e7f64ef2493595005c23ecfd30a86c0482f4f370e14aef8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BAA1ED1-69A8-11ED-8C25-6AB3F8C7EA51} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0550ce9b4fdd801	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375805575"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1988 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1988 iexplore.exe
1988 iexplore.exe
988 IEXPLORE.EXE
988 IEXPLORE.EXE
988 IEXPLORE.EXE
988 IEXPLORE.EXE

pid	process
1988	iexplore.exe

pid	process
1988	iexplore.exe
1988	iexplore.exe
988	IEXPLORE.EXE
988	IEXPLORE.EXE
988	IEXPLORE.EXE
988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exeiexplore.exe

description	pid	process	target process
PID 1488 wrote to memory of 1988	1488	a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exe	iexplore.exe
PID 1488 wrote to memory of 1988	1488	a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exe	iexplore.exe
PID 1488 wrote to memory of 1988	1488	a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exe	iexplore.exe
PID 1488 wrote to memory of 1988	1488	a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exe	iexplore.exe
PID 1988 wrote to memory of 988	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 988	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 988	1988	iexplore.exe	IEXPLORE.EXE
PID 1988 wrote to memory of 988	1988	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exe
"C:\Users\Admin\AppData\Local\Temp\a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1488

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a2c45f4b4e8e9d412c8022c6fa7d1822ca82df8a773f8232a3e3b9115af6bb65.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X8GJB57T.txt
Filesize
601B

MD5
4fe87ebe3aa2a128e4458d355a0044b4

SHA1
c4e6b69a5670cf735b1eea0d2ebda990f7891290

SHA256
af2a239bb719a8b173652360f874d620edf9559870fc4ddbc12448b12bd2c7c1

SHA512
4adbc03f7c8adff214ab34e969863bd12a6db4a1af90978d8d078a3d9cca702d4ced77a54db71e86c2e02a5a3969bd1ec0fee9cbfc3d63f02068b2f88b8a0ea1

Download Submit
memory/1488-54-0x0000000001030000-0x0000000001127000-memory.dmp

Filesize
988KB

Download
memory/1488-55-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing