514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6

General

Target

514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe
Size

281KB
MD5

1c7eda40466e8e7d18af1bd904e76db3
SHA1

1e1ac4a142f0a9468e8e849865cf5a020bffad38
SHA256

514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6
SHA512

6698e4feda6a2e2f251056ac2088f11a01bc5e9068c43288c45a2c9a8ade64166a2cfea8b5a12c1265f32fe250173715b6b53e628c72e1e8b5e0b368f803c398
SSDEEP

6144:8IUCzQKe0cg9bmM4RF5Y4iEtooAkcJJpJpxfTm:8sO0cg9bmjZfiEeo3GvLxf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000002efba6eb9591126491ba215fd8c0ebe2067e81a0aea6aec697aba0233791d640000000000e800000000200002000000014dd8c5360c499e44e93c9d6a919605af3c967afa110a8426a3e6d48c0d46c3020000000eeaf4bbc2952b2658532015bcfb9169abb62765e839b10159e6f9da34a12ebde4000000006a9a837f8ce45878ea695021698d3a5d11d4f273b51c9b909f8f1c2dff211053729036e781381f4a214afcf145b298ac912f4d68862dee126eb5f8d5121a458	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B68EC71-6DDE-11ED-8DFC-667719A561AF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376268786"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bcce65eb01d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000ff32a942858344e9947a3c84eb1c0a251aba3ffc9455c4c27512a988d7b0c39c000000000e80000000020000200000003a7098c8d5f9e369033de4bdc73b7a1707b964287edc43ba778578260a1d6525900000009acdd54fbc7974aa5b7e8fe9c2d2090a93a68f1d5a66e0dbe3b911551b7536f3d9b9a706ffd203a7d1c7d37e576ab7f765a518891b6a522ff4e75e3f4512f6c7b650de8a06e35e54ad826139496ffbe57e3d8386357ec319386fdcb8ab3b1374253cbda153c99920805369169293f528f2c9ee103785c7197e9ee8aa28380b425e675ec54cdde0fb05d0313ea8e48bcb40000000ebf6dd19f72cfed74ef68259bc1db22622c9b1fff9292c2edd7e8e7381e2e79142f31885352eb237f7ba68d39147470253723110185aca19b3ca96c0b10ad8b1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe

pid process

1672 514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe

description pid process

Token: SeDebugPrivilege 1672 514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1520 iexplore.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1520 iexplore.exe
1520 iexplore.exe
1484 IEXPLORE.EXE
1484 IEXPLORE.EXE

pid	process
1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe

description	pid	process
Token: SeDebugPrivilege	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe

pid	process
1520	iexplore.exe

pid	process
1520	iexplore.exe
1520	iexplore.exe
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exeiexplore.exe

description	pid	process	target process
PID 1672 wrote to memory of 1520	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe	iexplore.exe
PID 1672 wrote to memory of 1520	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe	iexplore.exe
PID 1672 wrote to memory of 1520	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe	iexplore.exe
PID 1672 wrote to memory of 1520	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe	iexplore.exe
PID 1520 wrote to memory of 1484	1520	iexplore.exe	IEXPLORE.EXE
PID 1520 wrote to memory of 1484	1520	iexplore.exe	IEXPLORE.EXE
PID 1520 wrote to memory of 1484	1520	iexplore.exe	IEXPLORE.EXE
PID 1520 wrote to memory of 1484	1520	iexplore.exe	IEXPLORE.EXE
PID 1672 wrote to memory of 2020	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe	dw20.exe
PID 1672 wrote to memory of 2020	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe	dw20.exe
PID 1672 wrote to memory of 2020	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe	dw20.exe
PID 1672 wrote to memory of 2020	1672	514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe	dw20.exe

C:\Users\Admin\AppData\Local\Temp\514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe
"C:\Users\Admin\AppData\Local\Temp\514678b447d7ca453dc5a92c1227357d78a4d803e0c9f7448cee31f1a88edec6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://i.imgur.com/TxNjdF8.jpg
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1520 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1484

C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
dw20.exe -x -s 1672
2⤵
PID:2020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
3dcf580a93972319e82cafbc047d34d5

SHA1
8528d2a1363e5de77dc3b1142850e51ead0f4b6b

SHA256
40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

SHA512
98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
23abb35b661133e13597c8234a023967

SHA1
e7558f633e459857a523a78237d8ca6dc59c6fd0

SHA256
5e2fda6f15a44bca48b63bd650f36719dec3a6318f9362187542d79da8669259

SHA512
a6419ce3c0b96deb3028fdd5e51f483c9f8f2b36d185b0e1ac94d69abb5f08e5157106849451bc34bc1e67fc258a190354652ce9dd961ff2fe26108d68beb37e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b86c1beebd033c35e51248f4dba3f3bc

SHA1
503cccc5000802bf110531e09ae028464ae4e5a9

SHA256
48779e87ff929d798a63a64c5d3b680d833c164155dec5b802fa2abf846f843e

SHA512
ba52a2acdc8920660511b2cae042239f4587abf57b890e5b4f03d4bf429ab7c896c8f612a85e1123f31e95d41d74cd727b15537658c0f1740ce0e79ce97254f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
38KB

MD5
fbd46264d7ebd84dea502c5a00b2ba77

SHA1
80583acfb92331d44bb0fa9bda8b39ab5491bd62

SHA256
54cf8e48ea6489d2a0dc6240cea8ac6164157392d0e57d6ca396014b6edd000c

SHA512
1aae97f2f12222a41446189b43c743c6ff4411355245a2262d016255a2d6c4d248afb55148e1c91501d013404eaa1b52e99f6de9590aaff9cac6eaa213549094

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3GDU8I26.txt
Filesize
603B

MD5
0eae2b09935b1faf1a044875c73c0463

SHA1
090953e3cdb3b5242f019520251ce38627c266bc

SHA256
af022f41713f81cf8df73e5af0df631acf4d37829894097f81754cfec8f64e7f

SHA512
c046be54f2effbfc25f8df6f5273f430838104baf574c13d5e178e0cb986e2acdb2e615da484609e551710acc228cd2fd75f634247d604ad9a7be0c3076dd00e

Download Submit
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1672-55-0x0000000074170000-0x000000007471B000-memory.dmp

Filesize
5.7MB

Download
memory/1672-61-0x0000000074170000-0x000000007471B000-memory.dmp

Filesize
5.7MB

Download
memory/2020-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing