07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b

General

Target

07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe
Size

1.4MB
MD5

80463092a863fb1d17f0cf0ba8500ccc
SHA1

d4c174d12e08e277c62fc5cc7049d85392ea00ad
SHA256

07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b
SHA512

e5d29a8d90e506ff984947c45ea751e8bb139733353a94dd703b41cbb8f3953ef02714189be23542a29383891bbf201d43b794b6d9f6b76c1c47ec3955047019
SSDEEP

24576:fhCVHmFHgwBWSfRL0hD1wpZ2EgTzJAxiqhh1pivyM+I0GLAxEb:WiHgw5pL0hD1eMEKFQiqhAvrQG0S

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\jedata.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\jedata.dll	upx
behavioral1/memory/1768-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe

pid process

1768 07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe

pid process

1768 07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000f913c1f94eff4cc4b2081963eff75afbff5035f124113e0507a6b964aa78b0fe000000000e8000000002000020000000e2a48bf43e43534edd24aaaebe900e44860dc96a40285d516bca3f6fb7d773c49000000092ee2dd0efb6015e187dca22ea7b4bd3f6beeceb362ccfbf146e67e10f1c843a49b4c614a53438df2e8b678891af9f9bc6aa1e6a4fe3ce9ca6430a449358b103a6c353a652d31acdc85370b060e3bea11ecde6a7cfa67d882702a5c35eb28eeb8a855f84d3b4e0ce57994acb1e7a08cda7e0db5d908b502b41cda67dc500e76125f7189977443fcce45ef2c5df506e40400000001676ad6d490fdfbe7e808da41e846b38cb1a24114a9baaa5610e1dd7fa799bcedf3c1d00b4ec3f193e0525c182d1cc6bb5971c9e23dcda7880bb3310b4af7055	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000006431bae9c783ea09fdbcb90713e8a9e0fc1e1044d6fead0da28a37755967f1eb000000000e8000000002000020000000c8b74c64998e3c55684c3a40553d1a3bc58c04cf4c3a32891ac14782d724f57e200000003a67f0712e76a33e560b0c969f8c3fe1f58b5a5dcd399ead0e2d29ea6fba96c540000000f846c4a95c7f2a4c1208d395df24f6e80ad68384df98a24e6d04de035e861f143838604c949db67d3cf5500bd40ba4dd8ea7f616c9d863f6f96b782d5d55e371	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30047c412301d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376182825"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66C136C1-6D16-11ED-9ECC-C253C434FFA8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1764 iexplore.exe

pid	process
1764	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exeiexplore.exeIEXPLORE.EXE

pid	process
1768	07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe
1768	07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe
1768	07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe
1764	iexplore.exe
1764	iexplore.exe
884	IEXPLORE.EXE
884	IEXPLORE.EXE
884	IEXPLORE.EXE
884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exeiexplore.exe

description	pid	process	target process
PID 1768 wrote to memory of 1764	1768	07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe	iexplore.exe
PID 1768 wrote to memory of 1764	1768	07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe	iexplore.exe
PID 1768 wrote to memory of 1764	1768	07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe	iexplore.exe
PID 1768 wrote to memory of 1764	1768	07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe	iexplore.exe
PID 1764 wrote to memory of 884	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 884	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 884	1764	iexplore.exe	IEXPLORE.EXE
PID 1764 wrote to memory of 884	1764	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe
"C:\Users\Admin\AppData\Local\Temp\07c4c6172f2d35d1d6e2ee58fc835d9ec88d77e76dd767f60bf167760a362f6b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.499u.com/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1764 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2UROW0JJ.txt
Filesize
608B

MD5
2c3bb1009883cb53f7c77e6cc7eabcf5

SHA1
d2c37eaf780fe1f9636a6c2571c685613086a991

SHA256
2146fb8f0c2c41007e6ba87a4f99de597fa657f3445e5823563ea1a872fa58e9

SHA512
072d25f76d008d402c5bf077858e65b06c488ba7515320d3e03a031cc1a65682abade1cb5cabe51a2f72b21f138e19e17d420a96fef036db4a7e9c72adeaa57e

Download Submit
\Users\Admin\AppData\Local\Temp\jedata.dll
Filesize
86KB

MD5
114054313070472cd1a6d7d28f7c5002

SHA1
9a044986e6101df1a126035da7326a50c3fe9a23

SHA256
e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

SHA512
a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

Download Submit
memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1768-55-0x0000000000400000-0x00000000006DE000-memory.dmp

Filesize
2.9MB

Download
memory/1768-59-0x0000000000400000-0x00000000006DE000-memory.dmp

Filesize
2.9MB

Download
memory/1768-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1768-61-0x0000000000400000-0x00000000006DE000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads