fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d

General

Target

fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exe
Size

450KB
MD5

528240cd18bf97d591053d78fad6b4a4
SHA1

f9ce8648d597f64ca7af122d658a32715529063f
SHA256

fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d
SHA512

6e6f40a3c3886be9fe8528bb56d57ae1b6c83f097ad364a22cbd41bd312ab8e30a5767841704933074de4e817bdaca3eb6a108db966f26261081c2e1d59c8c54
SSDEEP

6144:kRHm2k9Iv2kGXevaiWdiRM3LxGofJvxZjBHif+B8TToUkbii2f9DhHW6L3RT1DWR:a+YvO0RMbxGo7FBJB8nkbmfJF1iXcY7

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375998775"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00fdb9ca76ffd801	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000b68f6da897bd4adad8383ba27b5114867ce9f8529de46ca4b87f7339943563ed000000000e800000000200002000000066a7face6ff23fbf23cb44c6ef1715964a5b8416f9c52a2aee9db9e6459129139000000090406bd52759acf6362548150cc1b758086779afa95b4a7316c1fb86a399f9856c5804fbd899dd477552ce186369db618cbcbd1697b23e7aaaa130b0cb6d4adc20d03e0e045d3faff0db6aa123034fb80b773b93361e7182523483a1f9f1fc7e54c989fd1187bf4cdfead5afc0c3577b84e6763ea5fbcee12c5cbfb0e9796d0325f28bbe40c2526528d13866f1b1074b40000000c3a552c4f0fd6afbe4c7e877b322bd79d44aa07fcf353f4a26b1f0fa8eae9fb62aa4bb7270fad34c97d14713933a9c46147633f0a8a0c20a19b1b00ff93f115f	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000001a2f0b3a365f3443be6787e8eb032f2ca91fe1cda7911f479c2f725765843c23000000000e8000000002000020000000bc2deb58cae2e654d0be7d1351d0d505b6fd0b5f9ed354e56049409af61634ff20000000a5bea05a6bc27fa9a9a3bf14d64efbad725ef9032ed7db0339e2c4024a8d294e40000000f91a8b9ee286f3600483be5e89309694e81a8ed0678538b78e263239016b90af66386f4e5a5abfff9b5b8ccf1c3a5256f09cecdbd3120dfee571bb2f8323210f	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E001AE11-6B69-11ED-8EAC-767CA9D977BF} = "0"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2004 IEXPLORE.EXE

pid	process
2004	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
2044	fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exe
2004	IEXPLORE.EXE
2004	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exeIEXPLORE.EXE

description	pid	process	target process
PID 2044 wrote to memory of 2004	2044	fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exe	IEXPLORE.EXE
PID 2044 wrote to memory of 2004	2044	fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exe	IEXPLORE.EXE
PID 2044 wrote to memory of 2004	2044	fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exe	IEXPLORE.EXE
PID 2044 wrote to memory of 2004	2044	fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exe	IEXPLORE.EXE
PID 2004 wrote to memory of 1884	2004	IEXPLORE.EXE	IEXPLORE.EXE
PID 2004 wrote to memory of 1884	2004	IEXPLORE.EXE	IEXPLORE.EXE
PID 2004 wrote to memory of 1884	2004	IEXPLORE.EXE	IEXPLORE.EXE
PID 2004 wrote to memory of 1884	2004	IEXPLORE.EXE	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exe
"C:\Users\Admin\AppData\Local\Temp\fd92c941d59463fe09482b1242f5e823ffc67cb00146afc69d3f4fa5d5ca083d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.97199.com/install2/?sl3
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6POBV1O1.txt

Filesize
600B

MD5
9ec8c6ba229d47e13d5db5c8660a1475

SHA1
ce4ead381d8d502b7fdcd878e3ceb010937466c1

SHA256
825c23b4472a0212ce9495d52d33c4267e385af50c246adce7411887320ca917

SHA512
f21a73c1a3337bee6fd5dad1b61087cfbe241ba3f6b38bdbb84d4b519c1ac60100ee00191e2d48a6ef3d5c5d2ab2e0a7a7012b39c1f820eb3f78bcc8d924a447

Download Submit
memory/2044-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2044-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads