e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d

General

Target

e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
Size

502KB
MD5

e9aacff08be163162dd01acaf2fe9e76
SHA1

430d77ec921c55bb03fd37716b96aee6992393df
SHA256

e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d
SHA512

585c135c010766acf261c4db360bbc6f0625df4cbfb6b67edc0334fea625949e1568f9241f7dc3bcca2a6b2f2ce4b87215200b89cde42c74698be581bfe12853
SSDEEP

6144:vwpJeUzgDpp405g9D2SEu5901EpH+K3mME48D/QV07zvnNeMwt:YpJD8DppJ5gEijxpC44O0H1eDt

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

pid process

1376 e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

pid	process
1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exeExplorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\LofxaRemfa = "regsvr32.exe \"C:\\ProgramData\\LofxaRemfa\\LofxaRemfa.dat\""	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\LofxaRemfa = "regsvr32.exe \"C:\\ProgramData\\LofxaRemfa\\LofxaRemfa.dat\""	Explorer.EXE

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE

Modifies registry class 6 IoCs

Processes:

Explorer.EXEe84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{2C00395A-51A8-46E0-AF44-36AA54B26C12}\{26FC32C9-5AB1-4E40-8A2D-69494F3C6FB8} = 6d60cab7	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{38DD32A8-138C-4F42-A56A-39CA60183B0C}\#cert = 31	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{38DD32A8-138C-4F42-A56A-39CA60183B0C}	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{38DD32A8-138C-4F42-A56A-39CA60183B0C}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c653834333134626438653664313663356637353963353239356231353631666139633030306362336565353934646661376236646363346662346162623238642e65786500	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{38DD32A8-138C-4F42-A56A-39CA60183B0C}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{2C00395A-51A8-46E0-AF44-36AA54B26C12}	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

pid process

1376 e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1240 Explorer.EXE

pid	process
1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

pid	process
1240	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exeExplorer.EXE

description	pid	process
Token: SeCreateGlobalPrivilege	1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
Token: SeDebugPrivilege	1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
Token: SeCreateGlobalPrivilege	1240	Explorer.EXE
Token: SeShutdownPrivilege	1240	Explorer.EXE
Token: SeDebugPrivilege	1240	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

pid process

1376 e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

pid	process
1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe

description	pid	process	target process
PID 1376 wrote to memory of 864	1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe	spoolsv.exe
PID 1376 wrote to memory of 864	1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe	spoolsv.exe
PID 1376 wrote to memory of 1240	1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe	Explorer.EXE
PID 1376 wrote to memory of 1240	1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe	Explorer.EXE
PID 1376 wrote to memory of 308	1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe	sppsvc.exe
PID 1376 wrote to memory of 308	1376	e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe	sppsvc.exe

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:864

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Users\Admin\AppData\Local\Temp\e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe
"C:\Users\Admin\AppData\Local\Temp\e84314bd8e6d16c5f759c5295b1561fa9c000cb3ee594dfa7b6dcc4fb4abb28d.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1376

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\LofxaRemfa\LofxaRemfa.dat

Filesize
276KB

MD5
9f377051e601536bcaa0afcf611210e8

SHA1
acdf08c2913652d3b4dafd776c8e2ede524d527d

SHA256
e553b2f14c570fe458201284498ab5d78cbc7ca0dbaee7be322abdcde9868cbc

SHA512
ac79ce3ec7a128c4333122a00d85a828bfad4e895fce3719ee43f4d3379351cde9f2d42be3b4297e5ff6e99fd2178b9a68569ab21d5f9ade0b354e59cb08afe3

Download Submit
\ProgramData\LofxaRemfa\LofxaRemfa.dat

Filesize
276KB

MD5
9f377051e601536bcaa0afcf611210e8

SHA1
acdf08c2913652d3b4dafd776c8e2ede524d527d

SHA256
e553b2f14c570fe458201284498ab5d78cbc7ca0dbaee7be322abdcde9868cbc

SHA512
ac79ce3ec7a128c4333122a00d85a828bfad4e895fce3719ee43f4d3379351cde9f2d42be3b4297e5ff6e99fd2178b9a68569ab21d5f9ade0b354e59cb08afe3

Download Submit
memory/864-61-0x0000000001C30000-0x0000000001C84000-memory.dmp

Filesize
336KB

Download
memory/1240-71-0x0000000002940000-0x0000000002994000-memory.dmp

Filesize
336KB

Download
memory/1240-72-0x0000000002AC0000-0x0000000002B2B000-memory.dmp

Filesize
428KB

Download
memory/1376-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1376-55-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1376-58-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1376-59-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/1376-70-0x0000000010000000-0x000000001006E000-memory.dmp

Filesize
440KB

Download
memory/1376-73-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1376-74-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads