e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b

General

Target

e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe
Size

1.7MB
MD5

11631a73f87eb8ba7a2f4d591662d3d6
SHA1

d208e89a769afa0dd5fd32d2bedb51bc1919a665
SHA256

e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b
SHA512

7d9f52991c354b05327e7792192bdade3a4c304b928e13e38d779e6f9e383646a0c95bcc7d1f118fbc9ed784f2c71c8b221b4a3e2fbfa50220f1b9a88e024408
SSDEEP

24576:9gcf9u/MzMX2Xos0kRhjVWgH48UreFnPgGQUx9UHQs63z/Lswr9V88mKP01fl:pf9lAsoFm2uIIlzz1r9C8mG01

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

Processes:

IEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d070a60336ffd801	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375971000"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29DCC9C1-6B29-11ED-A70D-7AAB9C3024C2} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

972 IEXPLORE.EXE

pid	process
972	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1724	e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe
1724	e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe
972	IEXPLORE.EXE
972	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE
268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exeIEXPLORE.EXE

description	pid	process	target process
PID 1724 wrote to memory of 972	1724	e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 972	1724	e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 972	1724	e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe	IEXPLORE.EXE
PID 1724 wrote to memory of 972	1724	e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe	IEXPLORE.EXE
PID 972 wrote to memory of 268	972	IEXPLORE.EXE	IEXPLORE.EXE
PID 972 wrote to memory of 268	972	IEXPLORE.EXE	IEXPLORE.EXE
PID 972 wrote to memory of 268	972	IEXPLORE.EXE	IEXPLORE.EXE
PID 972 wrote to memory of 268	972	IEXPLORE.EXE	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe
"C:\Users\Admin\AppData\Local\Temp\e0f0b2cb5c2981308e5640c164f0efc2a7d456bca2569fad361ac6f6c9f6429b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://dn-zero77.qbox.me/tc.html
2⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\WGS5JNMN.txt

Filesize
601B

MD5
1fc13878d22a8b566cfbd5ad3efbf6bf

SHA1
09c85945a72aae5a15649a3bf7598e38e5d0f976

SHA256
6e32c31c6394e7a80f76a9858536bb378bd822c65237525e43ac2af318a71cb6

SHA512
3d2da53a2b6210a09b5ff3564b5ac78d686034f86fb95deb0c2b0fc1fadbe3b7fc3070f84b16ccf31165ad486f6a7d4d427ebfdfe3dafd48bb138310223fdb8e

Download Submit
memory/1724-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads