bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a

General

Target

bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
Size

496KB
MD5

576cc14912b19973f40c02f701663ddf
SHA1

c1ba8dba803f4cfb5dca36c59d12132f7fa77b1e
SHA256

bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a
SHA512

5bae87b6e404212a9f470a610b047a76a0677b3f2ccfd36711cbc1a91ffe7edb6565151bd6fb2484b74ef99c7e74c30c6c63347adffd6667bc27da2fe000c073
SSDEEP

6144:6eyyVa+lsNGfwm+yQmcGnJ7DUnMMvbTeeqmDpQ2f8SVEHr99Kw:pzVTfN+yPXByP2M8SW5

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

qThKPwNiqesWYCe.exe

pid process

4932 qThKPwNiqesWYCe.exe

pid	process
4932	qThKPwNiqesWYCe.exe

Drops file in System32 directory 2 IoCs

Processes:

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\s5er4.dat
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\s5er4.dat

Drops file in Windows directory 3 IoCs

Processes:

bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exeqThKPwNiqesWYCe.exe

description	ioc	process
File opened for modification	C:\Windows\bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.INI	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
File created	C:\Windows\qThKPwNiqesWYCe.exe	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
File opened for modification	C:\Windows\qThKPwNiqesWYCe.INI	qThKPwNiqesWYCe.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4876	1716	WerFault.exe	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
3812	4932	WerFault.exe	qThKPwNiqesWYCe.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exeqThKPwNiqesWYCe.exe

pid	process
1716	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
1716	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
4932	qThKPwNiqesWYCe.exe
4932	qThKPwNiqesWYCe.exe
4932	qThKPwNiqesWYCe.exe
4932	qThKPwNiqesWYCe.exe
4932	qThKPwNiqesWYCe.exe
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

qThKPwNiqesWYCe.exe

pid process

4932 qThKPwNiqesWYCe.exe

pid	process
4932	qThKPwNiqesWYCe.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exeqThKPwNiqesWYCe.exe

description	pid	process
Token: SeDebugPrivilege	1716	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
Token: SeDebugPrivilege	4932	qThKPwNiqesWYCe.exe
Token: SeDebugPrivilege	772

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exeqThKPwNiqesWYCe.exe

pid	process
1716	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
1716	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
4932	qThKPwNiqesWYCe.exe
4932	qThKPwNiqesWYCe.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe

description	pid	process	target process
PID 1716 wrote to memory of 4932	1716	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe	qThKPwNiqesWYCe.exe
PID 1716 wrote to memory of 4932	1716	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe	qThKPwNiqesWYCe.exe
PID 1716 wrote to memory of 4932	1716	bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe	qThKPwNiqesWYCe.exe

C:\Users\Admin\AppData\Local\Temp\bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
"C:\Users\Admin\AppData\Local\Temp\bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 656
2⤵
- Program crash
PID:4876

C:\Windows\qThKPwNiqesWYCe.exe
C:\Users\Admin\AppData\Local\Temp\bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a.exe
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 656
3⤵
- Program crash
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1716 -ip 1716
1⤵
PID:4960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4932 -ip 4932
1⤵
PID:2780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\qThKPwNiqesWYCe.exe

Filesize
496KB

MD5
576cc14912b19973f40c02f701663ddf

SHA1
c1ba8dba803f4cfb5dca36c59d12132f7fa77b1e

SHA256
bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a

SHA512
5bae87b6e404212a9f470a610b047a76a0677b3f2ccfd36711cbc1a91ffe7edb6565151bd6fb2484b74ef99c7e74c30c6c63347adffd6667bc27da2fe000c073

Download Submit
C:\Windows\qThKPwNiqesWYCe.exe

Filesize
496KB

MD5
576cc14912b19973f40c02f701663ddf

SHA1
c1ba8dba803f4cfb5dca36c59d12132f7fa77b1e

SHA256
bae6c9bb50353f4c13df759a52586551a0516456d27e55a471015a0706e6c71a

SHA512
5bae87b6e404212a9f470a610b047a76a0677b3f2ccfd36711cbc1a91ffe7edb6565151bd6fb2484b74ef99c7e74c30c6c63347adffd6667bc27da2fe000c073

Download Submit
memory/772-145-0x0000023CEC890000-0x0000023CEC8C0000-memory.dmp

Filesize
192KB

Download
memory/772-148-0x0000023CEC8C0000-0x0000023CEC8F5000-memory.dmp

Filesize
212KB

Download
memory/772-146-0x0000023CEC8C0000-0x0000023CEC8F5000-memory.dmp

Filesize
212KB

Download
memory/1716-133-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/1716-135-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/1716-132-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1716-141-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4932-136-0x0000000000000000-mapping.dmp

Download
memory/4932-144-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download
memory/4932-147-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4932-139-0x0000000000400000-0x000000000047C000-memory.dmp

Filesize
496KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads