27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63

General

Target

27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63.exe
Size

244KB
MD5

17c90fb4c2d6c8503a52212d68740319
SHA1

fe8483c33b14ca013da36afdc1278ac220b8bd3d
SHA256

27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63
SHA512

c978c6303a89125723aeb2cadcbeb945ed1f7341bb956f231f6c3104c02f4aa68a61041a59ee800edcea1623bf8b76bd6e84f6e987749462ab43ef0cc07af74a
SSDEEP

6144:1ND+xKDtDAr6GBzeS5bzQiOTn+fD3sUGMBjMu:KxCDAm0eS5bzQiOTn+fD39Bj

Score

10^/10

adware evasion spyware stealer trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	24112022.exe

Executes dropped EXE 1 IoCs

pid	Process
3968	24112022.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	24112022.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	24112022.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\	24112022.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\NoExplorer = "1"	24112022.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30998551"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3189970501"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30998551"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3190126013"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E256DDA2-6C0A-11ED-919F-FE1968EF3A40} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
668	27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63.exe
3968	24112022.exe
1984	iexplore.exe
1984	iexplore.exe
4988	IEXPLORE.EXE
4988	IEXPLORE.EXE
4988	IEXPLORE.EXE
4988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 3968	668	27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63.exe	83
PID 668 wrote to memory of 3968	668	27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63.exe	83
PID 668 wrote to memory of 3968	668	27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63.exe	83
PID 3968 wrote to memory of 3276	3968	24112022.exe	84
PID 3968 wrote to memory of 3276	3968	24112022.exe	84
PID 3968 wrote to memory of 3276	3968	24112022.exe	84
PID 3968 wrote to memory of 2860	3968	24112022.exe	85
PID 3968 wrote to memory of 2860	3968	24112022.exe	85
PID 3968 wrote to memory of 2860	3968	24112022.exe	85
PID 3968 wrote to memory of 1984	3968	24112022.exe	86
PID 3968 wrote to memory of 1984	3968	24112022.exe	86
PID 1984 wrote to memory of 4988	1984	iexplore.exe	87
PID 1984 wrote to memory of 4988	1984	iexplore.exe	87
PID 1984 wrote to memory of 4988	1984	iexplore.exe	87

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	24112022.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	24112022.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	24112022.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ = "1"	24112022.exe

C:\Users\Admin\AppData\Local\Temp\27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63.exe
"C:\Users\Admin\AppData\Local\Temp\27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668
- C:\Users\Admin\24112022.exe
  "C:\Users\Admin\24112022.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Installs/modifies Browser Helper Object
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3968
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\SysWOW64\regsvr32.exe /s c:\Users\Admin\cckwfsmm\cckwfsmm.dll
    3⤵
    PID:3276
- - C:\Windows\SysWOW64\regsvr32.exe
    C:\Windows\system32\regsvr32.exe /s c:\Users\Admin\cckwfsmm\cckwfsmm.dll
    3⤵
    PID:2860
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:17410 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:4988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\24112022.exe

Filesize
244KB

MD5
17c90fb4c2d6c8503a52212d68740319

SHA1
fe8483c33b14ca013da36afdc1278ac220b8bd3d

SHA256
27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63

SHA512
c978c6303a89125723aeb2cadcbeb945ed1f7341bb956f231f6c3104c02f4aa68a61041a59ee800edcea1623bf8b76bd6e84f6e987749462ab43ef0cc07af74a

Download Submit
C:\Users\Admin\24112022.exe

Filesize
244KB

MD5
17c90fb4c2d6c8503a52212d68740319

SHA1
fe8483c33b14ca013da36afdc1278ac220b8bd3d

SHA256
27412da38fde9ef39250693ad281dbb222b83a032322460fe3f0144ee80b0d63

SHA512
c978c6303a89125723aeb2cadcbeb945ed1f7341bb956f231f6c3104c02f4aa68a61041a59ee800edcea1623bf8b76bd6e84f6e987749462ab43ef0cc07af74a

Download Submit
C:\Users\Admin\24112022.tmp

Filesize
106B

MD5
674e88b726353f6a2cabd4359176f65b

SHA1
c1d09063837b46390120b6a7d55697f695dfa6da

SHA256
8677e683e8bffb8a65cede2fcd0977a377d3640aa5a140a1e2b12c79afa15e1a

SHA512
0735a0123d03b18869ba3f9901c0baf913504687cd79911760c86e2b504ad79707796a6f62c26c4ca8c371c755b8dd1513e954908a580b6d972699513f1e9221

Download Submit
memory/2860-141-0x0000000000000000-mapping.dmp

Download
memory/3276-140-0x0000000000000000-mapping.dmp

Download
memory/3968-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads