2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008

General

Target

2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe
Size

144KB
MD5

3679288947a53503a102845ed0474a79
SHA1

14c2591705a55fe64ac2e594dc3eab9412b81293
SHA256

2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008
SHA512

748a3d10d856157c51ba00ee755fbe1d08a9bfe3b8c0e27c1bc048ee865e1d7cb2146ead2ac652d48b02ef49c96dab46591aa7dd159d0cb9505f38eecc9fccaa
SSDEEP

1536:IVNVuA9uox768RPlyoeSyN6/J86HRwwHJBpetl5A00WPVfguRQxg+HdU/cOdFd:I0Av7Lf3yN6/J4SMtl5AADitHdU/3

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a75f1d89ffd801	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000536223bbbfda584487ed94ac7d07d1e200000000020000000000106600000001000020000000009b0296d3b24716d302757dff85833ee3cb79b852bba2feb5efcdc4022e36f2000000000e8000000002000020000000396e31df4ee3fc01da44912aaaebd499ee038f7bf8318fe2723896ac256be10620000000782357ae48b463e5ca94d32dc10ea0bf46f55e725b61096ef2145093d82701a5400000002198096aa49c13b163a69c4548297b43ee093990c18311e6265779ea3ebae024d105c4a2c4b1d600549fce68b53907952a1466ffa63a41e638a7ae597044fbc3	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\on86.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000536223bbbfda584487ed94ac7d07d1e200000000020000000000106600000001000020000000e38a5d943d0c86cdac081f352af0dc8583a01bf8762757bc48a71180a950be9b000000000e8000000002000020000000a063ea7d335e2914129a921e3e6af0aa25fea4695e298f5b78f75e68c1473e46200000006da6fffdb63b218192cb930c1e8b968570a8fc9fab0de949ae3b0e899972c0eb40000000bcfb7b3e55cc41c1650c023316ef1ab6e68f5def8a85effe6075354e1ac17f962981eb1e5581f9b733cb921543e0c15e062ee54615666e7c1e8cb34a530dcdb0	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375403581"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "134772414"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998409"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\on86.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{317A8BFE-6B7C-11ED-B696-E62BBF623C53} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "134772414"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "1008"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.on86.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.on86.com\ = "1008"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\on86.com\Total = "1008"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1008a92b89ffd801	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998409"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\on86.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe

description pid process

Token: SeIncBasePriorityPrivilege 3912 2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2524 IEXPLORE.EXE

description	pid	process
Token: SeIncBasePriorityPrivilege	3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe

pid	process
2524	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
3908	IEXPLORE.EXE
3908	IEXPLORE.EXE
3908	IEXPLORE.EXE
3908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exeIEXPLORE.EXE

description	pid	process	target process
PID 3912 wrote to memory of 2524	3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe	IEXPLORE.EXE
PID 3912 wrote to memory of 2524	3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe	IEXPLORE.EXE
PID 2524 wrote to memory of 3908	2524	IEXPLORE.EXE	IEXPLORE.EXE
PID 2524 wrote to memory of 3908	2524	IEXPLORE.EXE	IEXPLORE.EXE
PID 2524 wrote to memory of 3908	2524	IEXPLORE.EXE	IEXPLORE.EXE
PID 3912 wrote to memory of 3896	3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe	IEXPLORE.EXE
PID 3912 wrote to memory of 3896	3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe	IEXPLORE.EXE
PID 3912 wrote to memory of 2656	3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe	cmd.exe
PID 3912 wrote to memory of 2656	3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe	cmd.exe
PID 3912 wrote to memory of 2656	3912	2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe
"C:\Users\Admin\AppData\Local\Temp\2e6dcfd2134ba80bc44f9d62f9474cb980ecc9f0853f83ace585a249d3564008.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3912

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.on86.com
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:17410 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3908

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://down.xingkongjisu.com/flashplayer.htm?52c
2⤵
- Modifies Internet Explorer settings
PID:3896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2E6DCF~1.EXE
2⤵
PID:2656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2656-135-0x0000000000000000-mapping.dmp

Download
memory/3912-134-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3912-136-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads