14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20

General

Target

14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
Size

185KB
MD5

13cdbce693c34ef15c805b11ca117285
SHA1

068da46a564765b947a70fceccb7a4a0f544e4de
SHA256

14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20
SHA512

4ed210be121d283d552cba427c9911db0d35f328e3aa2f331b74d87af76d13a13a89ed53daaa38e9933080d469881fc66b960aace1d79832aa589bb5d58e9262
SSDEEP

3072:6UWrwso1V8iyMs53jtSc7BREncUCzfKuzstLuICUItzDQIVUApAYAJjPeJ:6hrvQ8tF/xIncUCktLuICzDQqSg

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\JDK5SWFMZY = "C:\\Users\\Admin\\AppData\\Local\\Temp\\14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe"	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

Drops file in Windows directory 2 IoCs

Processes:

14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

description	ioc	process
File created	C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
File opened for modification	C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\International	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

pid	process
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

pid	process
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
940	14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe

C:\Users\Admin\AppData\Local\Temp\14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe
"C:\Users\Admin\AppData\Local\Temp\14c8df31433fa4f1e997904787c14b37da390f5c0a56b8b4db98b4b8657bfe20.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-54-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/940-55-0x00000000001A0000-0x00000000001AF000-memory.dmp

Filesize
60KB

Download
memory/940-56-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/940-57-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads