9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa

General

Target

9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
Size

1.8MB
MD5

3834b9c70f843e1377997bf12577631c
SHA1

b687fe27f0906c55a5feac0f742d63882458b080
SHA256

9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa
SHA512

8adbb2a8828d9621235dc6dc2c28c6157c96a34637ddc095d734f661f527e79dceef4a34d78c6f54eab6e587f8c4b37072b6c70a464e13e917a24b1580a90749
SSDEEP

24576:dRmJkcoQricOIQxiZY1iaia1fvTxG0uqPSKnevup7LddhFPa5Acksvoj:SJZoQrbTFZY1iaiaRvTxG69

Score

9^/10

Malware Config

Signatures

NirSoft MailPassView 6 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/1004-58-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/1004-61-0x000000000047EAFE-mapping.dmp	MailPassView
behavioral1/memory/1004-60-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/1004-59-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral1/memory/1004-63-0x0000000000402000-0x000000000047EC00-memory.dmp	MailPassView
behavioral1/memory/1004-64-0x0000000000402000-0x000000000047EC00-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1004-58-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/1004-61-0x000000000047EAFE-mapping.dmp	WebBrowserPassView
behavioral1/memory/1004-60-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/1004-59-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral1/memory/1004-63-0x0000000000402000-0x000000000047EC00-memory.dmp	WebBrowserPassView
behavioral1/memory/1004-64-0x0000000000402000-0x000000000047EC00-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1004-58-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/1004-61-0x000000000047EAFE-mapping.dmp	Nirsoft
behavioral1/memory/1004-60-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/1004-59-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral1/memory/1004-63-0x0000000000402000-0x000000000047EC00-memory.dmp	Nirsoft
behavioral1/memory/1004-64-0x0000000000402000-0x000000000047EC00-memory.dmp	Nirsoft

Suspicious use of SetThreadContext 1 IoCs

Processes:

9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe

description	pid	process	target process
PID 1340 set thread context of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3079ec4860ffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000584d6bf909247ed14f9bd9196799ad035ce21209460da90bdcdd15274b58f06c000000000e8000000002000020000000f9e931db41df624ef47f39e3fa34c966b772ef00843580f06ab3ac36ee811707900000001c355a76547bdd42c0d3eebbc210aa4cfd3e2942fba6c08ac5d9027f38a9653042ab43acfa2896c7f1dd152216afcbc258bbef619edf4b1b24e14621f8d99dcd9a0c426076969d57f72d4851224b1d0ff78ce46b02ad27362dcb9c9cde36e6a7b567f80a4211e2a4dea5d00a5c12cfb58d17ac915c482d69943c3efbf9e7de5e6e3b0cd8d40a5866ab755a329ad18291400000004a09bd37b5f147de9484f49c6813abc1f8e2b2d4c17e89a4a600c8c6f69b219ad66c27605290444b4920a0abc7dc792d735a0f1306d2633a6e18324a5b13d910	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375989112"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000a0120b1b9d72654dbeecd2d88c02bc45f41dace1e0716b57f203b3fab40ddb90000000000e8000000002000020000000edbf51af16af6625075ebbf3ee926f823d18baef53c08707dcbca1442c2cff0620000000d95f38058a079fcfaacb3d189d723b2daea7fe890b485c985e21c3550920188b400000001a83d234996af166201aabd02fed6f8e581964d0d73113cbcc197f20db1bb49791088f9932c3d3445b39e154f41031a5e8f6e24d5a523778a58ce44bb9486969	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AD70521-6B53-11ED-9956-4ADA2A0CA6C6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exeiexplore.exe

pid	process
1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
536	iexplore.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe

pid	process
1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

536 iexplore.exe
536 iexplore.exe
1472 IEXPLORE.EXE
1472 IEXPLORE.EXE
1472 IEXPLORE.EXE
1472 IEXPLORE.EXE

pid	process
536	iexplore.exe
536	iexplore.exe
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exeiexplore.exe

description	pid	process	target process
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1340 wrote to memory of 1004	1340	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
PID 1004 wrote to memory of 536	1004	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	iexplore.exe
PID 1004 wrote to memory of 536	1004	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	iexplore.exe
PID 1004 wrote to memory of 536	1004	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	iexplore.exe
PID 1004 wrote to memory of 536	1004	9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe	iexplore.exe
PID 536 wrote to memory of 1472	536	iexplore.exe	IEXPLORE.EXE
PID 536 wrote to memory of 1472	536	iexplore.exe	IEXPLORE.EXE
PID 536 wrote to memory of 1472	536	iexplore.exe	IEXPLORE.EXE
PID 536 wrote to memory of 1472	536	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
"C:\Users\Admin\AppData\Local\Temp\9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Local\Temp\9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe
"C:\Users\Admin\AppData\Local\Temp\9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=9add6351f3b679c5315c8599d85433a288bbc9d67deeefb342489d4111c5b2aa.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:536 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1472

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TI6J0YL6.txt
Filesize
608B

MD5
1706ca434e5e42c00df7ce2bf88add60

SHA1
a5d65e2d4f9bf6bb0b3253df565d6e52292e1a8b

SHA256
3aaca0f92e2e53742369bab22cc7041112e5f5b107804f36a15be66b48e8aa11

SHA512
97cde9815a7324e1e87982c5ddcf1008e331f45a4aa1b56e391b91766657956dd6929c76dbeda8dcd7de0b2d69d9792d661b22d41e472ef1f80dd2e52db0ea01

Download Submit
memory/1004-55-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1004-56-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1004-58-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1004-61-0x000000000047EAFE-mapping.dmp

Download
memory/1004-60-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1004-59-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1004-63-0x0000000000402000-0x000000000047EC00-memory.dmp

Filesize
499KB

Download
memory/1004-64-0x0000000000402000-0x000000000047EC00-memory.dmp

Filesize
499KB

Download
memory/1340-54-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads