547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf

General

Target

547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe
Size

1.6MB
MD5

2b53a3d5ffc830758df4246831b15d72
SHA1

72aa3b03cfce102b779915662b5ba5739511c278
SHA256

547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf
SHA512

c9b39bc4c3e1973abd85a8e3e74161fa293eeef0612e1da6a455343221aa695d1532d95f570fb63aefd5af4a0a4d0df69a839502fd9fc3b0f097af7a0d277987
SSDEEP

49152:gozQWhYdil2eTZaqdwk0c05HGie1Kf+6D4:vFedil2eYqdwkLcHHGys

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll	upx
behavioral1/memory/1764-56-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe

pid process

1764 547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c198aab596811146a31c3b4553b2d95300000000020000000000106600000001000020000000bc75da8ae2259abd4920ba28b62232ca9697cc3cbe4caf0167ba36bcf7d3ba45000000000e80000000020000200000003f26db7094324280f143f520362a7b3f3adaf199c1f4a807cc81311c2db0816a2000000084db0550d2fa3dc5985c65fbcca39c1ce4c98c9671e4b56389d77657228e8e32400000009e1c3cce958262dca4ff79097925aaa9733e9c8943ba23394a19ab7474ceaf2b670735f718815cb76f7c91e4236cc12cc8ba04b1cad584a4286bd5f5aa69256c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376173589"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c08a1aca0d01d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c198aab596811146a31c3b4553b2d9530000000002000000000010660000000100002000000096afa825524dd7761a90690e3a4aa48bfe413983c30d2d702b3ad7b6bbb9a050000000000e80000000020000200000009f3c2b77a1644b20413a1e1f803946d84d8f2e0d565d632f239ed8a5ec5a0d35900000004ce20f8e57e945ad992c191f566972f66ef8d548a69451449b39f5504071b8c90b3856e36f8f44d529768fcb123907b7457ab84d012d3ab28e3959aaa8e6619c2e20b18640b8ef20bb5b0eb997501ad010f739b842b04389c8739a732ffc18fd8334b4e71a92fa3dbcfdd3b4b48fd51a215ede874a1940adb55b2da01dd28653bd650b9978d7ba2ef528a0881a65a8f840000000880de535be4e8ca58fbf211bc16012b19d88fa2861251248d9bf92f290aad2241b2356707f554f72fb664c8c6ff01417ad632ed239d265d724c944a8978798a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4C765F1-6D00-11ED-9AAE-C6457FCBF3CF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

768 iexplore.exe

pid	process
768	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exeiexplore.exeIEXPLORE.EXE

pid	process
1764	547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe
1764	547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe
1764	547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe
768	iexplore.exe
768	iexplore.exe
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exeiexplore.exe

description	pid	process	target process
PID 1764 wrote to memory of 768	1764	547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe	iexplore.exe
PID 1764 wrote to memory of 768	1764	547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe	iexplore.exe
PID 1764 wrote to memory of 768	1764	547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe	iexplore.exe
PID 1764 wrote to memory of 768	1764	547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe	iexplore.exe
PID 768 wrote to memory of 1924	768	iexplore.exe	IEXPLORE.EXE
PID 768 wrote to memory of 1924	768	iexplore.exe	IEXPLORE.EXE
PID 768 wrote to memory of 1924	768	iexplore.exe	IEXPLORE.EXE
PID 768 wrote to memory of 1924	768	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe
"C:\Users\Admin\AppData\Local\Temp\547c224f624437d6a984324f72b47cd8289d57b700b989a44bae575a179f97cf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://qqxxjz.nl.ae/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
b6d266e7a459d0265f018f61b81540ce

SHA1
40d5101269c0b202ec194f48ef92e35bc0a324cd

SHA256
7c27d786c71ec452c6c314ff792ea74523d59a7776bef316834a97e6c29ae5fb

SHA512
e8b8e40ee7db0cf8faef94c6a1c50da9d5393f882625b31a9dd1699f81f65cf30cf37614eb73a52aa922c9419fc7c5176581f8208929309ee043cba30caaed97

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G96WMGE2.txt
Filesize
602B

MD5
3d1691222d3ea1099a1e088bdb2857b5

SHA1
f777cb23c75f2aba6ed097c69faebb65148c8243

SHA256
6a12aeafd19cef116f1fa2260232f80f016cc73435aa7183c93506e565934e4a

SHA512
f09697ab324f13432bba091bd82d9550dcdc580772cbd20736d657a64236d480824605301ea39a29abcff4f9b5625ccc6767cbc2b0d7d58397b60c12780f360d

Download Submit
\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/1764-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1764-56-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads