cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af

General

Target

cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe
Size

188KB
MD5

b6bb775b5aa960c8ed84b1f748b96370
SHA1

48f25b01dfb4b71ac139f4dff9f146f9dd2fb3bb
SHA256

cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af
SHA512

d2ee3b10ccbf620d20b637350e826b0fec1fee5d09962887ffdcd99f2cb8b2cfd8544cdeeff603ce6201adcb749b38b74c894133899a5d6e8bccf10cc71a0df6
SSDEEP

3072:VHOEInXTLkYyxglKWN5VcNSfFKAvbTewL7KFL2XC6T:VHSLkFgfNU1Avb9L7Kd2XC6

Score

10^/10

adware evasion stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375970830"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF9DB321-6B28-11ED-B390-DA7E66F9F45D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1188 iexplore.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exeiexplore.exeIEXPLORE.EXE

pid process

108 cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe
1188 iexplore.exe
1188 iexplore.exe
1680 IEXPLORE.EXE
1680 IEXPLORE.EXE

pid	process
1188	iexplore.exe

pid	process
108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe
1188	iexplore.exe
1188	iexplore.exe
1680	IEXPLORE.EXE
1680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exeiexplore.exe

description	pid	process	target process
PID 108 wrote to memory of 1684	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1684	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1684	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1684	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1684	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1684	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1684	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1164	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1164	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1164	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1164	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1164	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1164	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1164	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	regsvr32.exe
PID 108 wrote to memory of 1188	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	iexplore.exe
PID 108 wrote to memory of 1188	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	iexplore.exe
PID 108 wrote to memory of 1188	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	iexplore.exe
PID 108 wrote to memory of 1188	108	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe	iexplore.exe
PID 1188 wrote to memory of 1680	1188	iexplore.exe	IEXPLORE.EXE
PID 1188 wrote to memory of 1680	1188	iexplore.exe	IEXPLORE.EXE
PID 1188 wrote to memory of 1680	1188	iexplore.exe	IEXPLORE.EXE
PID 1188 wrote to memory of 1680	1188	iexplore.exe	IEXPLORE.EXE

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ = "1"	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe

C:\Users\Admin\AppData\Local\Temp\cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe
"C:\Users\Admin\AppData\Local\Temp\cab99e0dd8cb9752b50f6af5c0aa0eade53123a4911a429448a2c015c10090af.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:108

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\SysWOW64\regsvr32.exe /s c:\Users\Admin\qdnjiflj\qdnjiflj.dll
2⤵
PID:1684

C:\Windows\SysWOW64\regsvr32.exe
C:\Windows\system32\regsvr32.exe /s c:\Users\Admin\qdnjiflj\qdnjiflj.dll
2⤵
PID:1164

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1188

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1188 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AMARXRMX.txt
Filesize
608B

MD5
a3d420b3e0c31be39b4da5ec0ed4edcc

SHA1
3a7968e00a5de21c3dd49c2cf786d526edd6a2bc

SHA256
5fdd90adfc422ba0fb8205fb5ff7433a0166658e17b45072dee8265fb4cea73c

SHA512
8e838fa514bbffa558b8aa3cfec2e571e2bb73f8369e7f311f95cc6e185584695b9d04e409c1da1f98008f10de34e6a68a8de36b684a0749fbf442f310d02ba7

Download Submit
memory/108-56-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1164-60-0x0000000000000000-mapping.dmp

Download
memory/1684-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads