8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650

General

Target

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
Size

64KB
MD5

0e86092083ffba208aebcc2f2e06220f
SHA1

32a377256694bb76552166c907f027c3589eed70
SHA256

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650
SHA512

5e978d5135dbc435de0de732ceb82149833d7144796ec4574919c4cdbb786df6316a56d1c1bf16b47d328e601b3c2264a2d7b7488b500260f8cabf708399bcff
SSDEEP

1536:51uW8edOvxgZH72W0oGEhwSp7EH8IchAWckV5gjupoCafgLo:zN2bSp7k/chNl0jupHWgL

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe"	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

pid	process
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

pid	process
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
2020	8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe

C:\Users\Admin\AppData\Local\Temp\8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe
"C:\Users\Admin\AppData\Local\Temp\8f38f6f3a7d8ff646aee41bc5e50a9983230225601cb5ab6d0e1b80545790650.exe"
1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-54-0x00000000002A0000-0x00000000002C1000-memory.dmp

Filesize
132KB

Download
memory/2020-55-0x0000000075EC1000-0x0000000075EC3000-memory.dmp

Filesize
8KB

Download
memory/2020-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2020-58-0x00000000002A0000-0x00000000002C1000-memory.dmp

Filesize
132KB

Download
memory/2020-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2020-59-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads