bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3

General

Target

bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exe
Size

180KB
MD5

432a7d461e6cb31112b6a6d16b518081
SHA1

33d6546b0135dc4b4eb2ecf61ba2c426bb960a5e
SHA256

bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3
SHA512

a850d562626a95b05e01e353a15002b3186dea75bd1893e344c1c6e7dabf12db3f22d9a9709704aba2994d6513fb4e71541f34b2b10b1817d55862f4bd58099e
SSDEEP

768:/V5nO4rGQzTGfmgc33emu4v/eo4z7VP7LdGSu2HyTAzfMgTAzfM0CA4DIiKpohsJ:/AQVgd54v7uCXq54vTgzQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376006194"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{260BC381-6B7B-11ED-8538-4A4A572A2DE9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddc0426c953c394d9e8f7509446cd80b00000000020000000000106600000001000020000000baa82f97123957eb2e6e14074480a9133848e70a8f6577cd7b6bc1898c80763d000000000e800000000200002000000031baf4c03a5cc3f55bf56c344a68cdfe35d4c72cd1910b0df9f2dff0f8c40e69200000003de795b9fbb9efb4ee027c8c7f919c0948d30003a11118dc24f0f775210fe7394000000097799b7a2046ba9b21aa408f48be47c976390148fcb6f85078e344bc4ed064609fd961efe56209b9ee6d36503e0e82694b9bdc3ac2f1b8e5c9ab3da294503d2c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3019ac0c88ffd801	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddc0426c953c394d9e8f7509446cd80b00000000020000000000106600000001000020000000ce18bdc91b374375fddf0cd7634f90103bbae0ad9ca1bed4f07c25f48f4be5f3000000000e80000000020000200000004414979954ec712b9f4dcc7c275e5ef6392617810a2b51a63ae56caa6d7675299000000068a27a1ed0cab2a31c815b4dd87e2cabc6229c00ddddceb19ba42d3d382ecd1aadb04d466158ccef31fa9ffd19edb949725b3a08fd7422281bdb8e1ca533ae57c7b261c7a50d524d602dd6e7434d068d24c2050634d6032a6e9710f690e49fb583c604fabb6d8666f05f6d0aa35ef64cfcdc3e8d399354a4eeec754c353c00bd2fd15dc5a204dc31c63b0ed6826de8df40000000d36cd50a6f800d6a61658e6eae35ab1c24b4ceb9a3941df610cd3158a9a2be7d1a922ffe5ca2b16a7edd5a8a4e2b8de62986b952d16767f1329426f8a36dbccb	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1940 iexplore.exe

pid	process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exeiexplore.exeIEXPLORE.EXE

pid	process
1672	bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exe
1940	iexplore.exe
1940	iexplore.exe
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE
1972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exeiexplore.exe

description	pid	process	target process
PID 1672 wrote to memory of 1940	1672	bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exe	iexplore.exe
PID 1672 wrote to memory of 1940	1672	bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exe	iexplore.exe
PID 1672 wrote to memory of 1940	1672	bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exe	iexplore.exe
PID 1672 wrote to memory of 1940	1672	bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exe	iexplore.exe
PID 1940 wrote to memory of 1972	1940	iexplore.exe	IEXPLORE.EXE
PID 1940 wrote to memory of 1972	1940	iexplore.exe	IEXPLORE.EXE
PID 1940 wrote to memory of 1972	1940	iexplore.exe	IEXPLORE.EXE
PID 1940 wrote to memory of 1972	1940	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exe
"C:\Users\Admin\AppData\Local\Temp\bb07715a66bfdbe25100281d978aef2ed3c66a976840aa0f8799228108fed4c3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.stikom-bali.net/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5EA3JJFB.txt

Filesize
603B

MD5
7a8c7dbef20cda1c70688feb6bd15278

SHA1
01fa663ab43f5b25e991830233e76df646b018c6

SHA256
ace90269ffcc44108113afa5b2370f8649ae42172466131bb5b2cc90d1b7f460

SHA512
c52705a1c7d15cfecdd2e4da9bfe6d4581e8b5691668a83a15d8a90f36dd2dbd14336b118df38fcbb9e3c400189eed16189cf5765daabf33deb46116cacff9a7

Download Submit
memory/1672-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads