d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1

General

Target

d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe
Size

2.6MB
MD5

288919c82b6ba6df332a71fd70ae0bc2
SHA1

e0a83a58809ab4ffe0f48bf6ce69b2e2a0faebdd
SHA256

d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1
SHA512

61797d26bd164d2a413521b932a195fce21dd1c1880c7ac3dbf734b48a3be445a74609deb0d99ac98559edf0c24ca1c5f7a9005e26663b9818c13ceef29b0a6a
SSDEEP

49152:2jKxFXDxXQeUqmBjbygbKWkEC2J0yz+6lewP4xEc5nlpbKKjDI:22xnXeBfHbKWkEz0yKuDAxZ5nyKjDI

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2044-54-0x0000000000400000-0x00000000009AC000-memory.dmp	vmprotect
behavioral1/memory/2044-56-0x0000000000400000-0x00000000009AC000-memory.dmp	vmprotect
behavioral1/memory/2044-58-0x0000000000400000-0x00000000009AC000-memory.dmp	vmprotect
behavioral1/memory/2044-59-0x0000000000400000-0x00000000009AC000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e9891d9fffd801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376016090"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F90F621-6B92-11ED-8EB5-F263091D6DCE} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000863f7bd52eb5bc8b14cda992307fc91ebd2ecf726ea72ed7ed0e0e61de1e611f000000000e80000000020000200000008710c848d76cea589ae2c21c84a1352846f24b73ed0a72bb456b5e264579868f2000000042830e7b7bc02ffb883d523a7ac287637e93ceb9b94594d017ea0ea0afb7cbfc40000000540a4f7a8cdcbf21af125984fa69d62c70c150a9fbc2c64908f02d23605e7b7b50c0e82baaf1aa9587201f0253f732554dd094ecada75212c5442d0c4db6a5f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a100000000020000000000106600000001000020000000bbff24267a13d8a4acdde926c8e551aa122db7f895acde44b5fb2e3418cedaa6000000000e8000000002000020000000d2e5227b3d80e74ff92fa148401c7b89bd4123587d0a19329970f3f0283baa7d900000006eecc904d2b454803cee9ea5b059a8a7f87162e96e585700903dadd652295a685f6b9f956beaf465fc2d95abdd388e19abcbbb82010168e2d8426b861d0202c8f5d7c59f0db96ce3696e61e4bd6e546bf7b355d65611ebcdfc573f017a97879e4688fde29b813291c4e900120a665ac89f1164ccf0b6a6e55fa0060149e328e702e82a18bad78ef78148817d7c80ca98400000006b1b70b73f646d30c53e89c91a701666fbdf824199368589a0e28c0b04140db341460a3fe6541b750ab43d3790706eb90200375b9cb05f863d246355f0719dbd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe

pid process

2044 d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1868 iexplore.exe

pid	process
1868	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exeiexplore.exeIEXPLORE.EXE

pid	process
2044	d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe
2044	d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe
2044	d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe
2044	d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe
1868	iexplore.exe
1868	iexplore.exe
1220	IEXPLORE.EXE
1220	IEXPLORE.EXE
1220	IEXPLORE.EXE
1220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exeiexplore.exe

description	pid	process	target process
PID 2044 wrote to memory of 1868	2044	d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe	iexplore.exe
PID 2044 wrote to memory of 1868	2044	d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe	iexplore.exe
PID 2044 wrote to memory of 1868	2044	d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe	iexplore.exe
PID 2044 wrote to memory of 1868	2044	d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe	iexplore.exe
PID 1868 wrote to memory of 1220	1868	iexplore.exe	IEXPLORE.EXE
PID 1868 wrote to memory of 1220	1868	iexplore.exe	IEXPLORE.EXE
PID 1868 wrote to memory of 1220	1868	iexplore.exe	IEXPLORE.EXE
PID 1868 wrote to memory of 1220	1868	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe
"C:\Users\Admin\AppData\Local\Temp\d12e0f4e2a1279a25233ee9fc957024153ec5372955e53426bfc352d887db4b1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.x5tl.com/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
967d11f54581f41608574f50a45bab75

SHA1
0e0a362b980a0006f15d9539e128757638447f91

SHA256
1609c0cdeb00e4f65905a9e60996b908d9d3e18316eff7928aed60b031d26e5e

SHA512
683bd1d9c4e292dd763b20e8d85ee0e598a7e15f5a3bac9d8e29e82b24f943c4a1920da31f6fe338d0c45de338edd6170a943173f6a91f674e5c4997a1da215e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MPYQ48IV.txt
Filesize
601B

MD5
ab2962d8f2bb4de13ae79bfed0d60a2e

SHA1
64d25819a37b8214ee0fa2aee700bb22474b144f

SHA256
9842e44b047d8b3c9dc8e029ce4101dec943a9b8c57c82c6c6a9092f6c3281d8

SHA512
9d0e0d3aa2cdfa8df3b471eacd78d3be31c1e320b6fa22685efc1c878468c9f10bb28428187d6721ce3a079903f88354f15973997de375105cb3e209a931b384

Download Submit
memory/2044-54-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2044-55-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2044-58-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download
memory/2044-59-0x0000000000400000-0x00000000009AC000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads