4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d

General

Target

4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
Size

36KB
MD5

e284f66f6759911c7c032bd131332a24
SHA1

79edba44f0a1a55def326a6c6ba885f2478a4780
SHA256

4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d
SHA512

a5722e1d07cd61ccded507b97d69d00cd250b42b9a6c75327a7db69e1aceb1b29a58b6fbc0ca2e56aaba200470ae38c70bd18c3fe7b515a9cff6dbfe075178c8
SSDEEP

768:n+ssHLUCpqCXhcTW/Y20TlXjU12W3sGctza:n+sRKFc/xTBi1cc

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

Processes:

4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe

description	ioc	process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts.ics	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cfhack = "C:\\WINDOWS\\admin.exe"	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exeRunDll32.exeRunDll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

RunDll32.exeRunDll32.exe

pid process

1948 RunDll32.exe
820 RunDll32.exe

pid	process
1948	RunDll32.exe
820	RunDll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe

pid	process
1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe

description	pid	process	target process
PID 1364 wrote to memory of 820	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 820	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 820	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 820	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 820	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 820	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 820	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 1948	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 1948	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 1948	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 1948	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 1948	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 1948	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe
PID 1364 wrote to memory of 1948	1364	4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe	RunDll32.exe

C:\Users\Admin\AppData\Local\Temp\4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe
"C:\Users\Admin\AppData\Local\Temp\4dba6cbd83d9b07f305943ae904a3f6271ae9734ad962c67c2a02d75110c976d.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364

C:\Windows\SysWOW64\RunDll32.exe
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:820

C:\Windows\SysWOW64\RunDll32.exe
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/820-57-0x0000000000000000-mapping.dmp

Download
memory/1364-56-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1364-63-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1364-64-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1364-65-0x0000000003A81000-0x000000000492D000-memory.dmp

Filesize
14.7MB

Download
memory/1364-67-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1948-59-0x0000000000000000-mapping.dmp

Download
memory/1948-61-0x0000000072421000-0x0000000072423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads