991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254

General

Target

991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Size

45KB
MD5

350f475bf9e8c4662e55d1ee389f2b62
SHA1

db46099b531ecc00ad11604cf9ffb9790fadc0e5
SHA256

991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254
SHA512

229b9b5710b5132190eb35a0bf593a3a5e413a6d04a0e6525056c21c27549fd47d5916490d637474a2dc578a638d2ab0f37e78318e0295632d6b0713e99f57b0
SSDEEP

768:ywTukTPTBKhmGjam9HczJqoBRV+CsGlsdnBqhmef1hXLssk4fBf0YU7sw8XoT:yKNTPmTczJZbXPsdVI1lLh1Ysy

Score

10^/10

evasion

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

Drops file in Program Files directory 1 IoCs

Processes:

991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

description ioc process

File created C:\Program Files (x86)\Common Files\dao.ico 991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

description	ioc	process
File created	C:\Program Files (x86)\Common Files\dao.ico	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Window Title = "Microsoft Internet Explorer"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.ccc7.com"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.ccc7.com"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

Modifies registry class 30 IoCs

Processes:

991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pz\1 = "20221123"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\WantsParseDisplayName	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Pz	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)\Command	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\ = "´ò¿ªÖ÷Ò³(&H)"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideOnDesktopPerUser	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ = "Internet Explorer"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÊôÐÔ(&R)\Command\ = "Rundll32.exe Shell32.dll,Control_RunDLL Inetcpl.cpl"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)\Command\ = "iexplore.exe http://www.ccc7.com"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\DefaultIcon	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pz\5 = "51"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pz\9 = "1"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\É¾³ý(&D)\Command\ = "Rundll32.exe"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\Open(&O)	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Pz\9 = "0"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell\ÖØÃüÃû(&M)\Command\ = "Rundll32.exe"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\Attributes = "0"	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\ShellFolder\HideFolderVerbs	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA8}\Shell	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

description	pid	process	target process
PID 4880 wrote to memory of 4928	4880	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
PID 4880 wrote to memory of 4928	4880	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
PID 4880 wrote to memory of 4928	4880	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe	991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe

C:\Users\Admin\AppData\Local\Temp\991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
"C:\Users\Admin\AppData\Local\Temp\991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4880

C:\Users\Admin\AppData\Local\Temp\991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
C:\Users\Admin\AppData\Local\Temp\991c81ed9bad261d229ac655ff7a591e98ae2fdfd84a2279310f598c148e7254.exe
2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:4928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4880-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4880-135-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/4928-133-0x0000000000000000-mapping.dmp

Download
memory/4928-134-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads