48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d

General

Target

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
Size

259KB
MD5

a20d46664d06744d2515d69eeff57508
SHA1

7c1dd71389b6661c36f7c0d64531d03c4e71fc29
SHA256

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d
SHA512

60bf71e7b80e447e2a9197ff365805d8e5e257b3f4f3787b6fb9940a9d40f710d5880f1910689d5f8cbe79cbbb1f4478afc6aa3eb134b61b3b741c4ab1e268cf
SSDEEP

1536:ltPixznncp3vKONOI0Z/IY9Vt1jFmyBoI9uAnBSGFeXA9jJbZjwSrSMLDhKOzxf2:bPixnncpSONDyRTkwQAbOCzNx/TtOLf

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

pid process

860 48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
Loads dropped DLL 1 IoCs

Processes:

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

pid process

584 48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

pid	process
860	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

pid	process
584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

description	pid	process	target process
PID 584 set thread context of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

Drops file in Windows directory 2 IoCs

Processes:

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch.new	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.cch.new	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB44F450-6DE6-11ED-B76D-4EFAD8A2B6A5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

NTFS ADS 1 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe:ZONE.identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

pid process

860 48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

pid	process
860	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

description	pid	process
Token: SeDebugPrivilege	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
Token: SeDebugPrivilege	860	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1668 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1668 iexplore.exe
1668 iexplore.exe
452 IEXPLORE.EXE
452 IEXPLORE.EXE
452 IEXPLORE.EXE
452 IEXPLORE.EXE

pid	process
1668	iexplore.exe

pid	process
1668	iexplore.exe
1668	iexplore.exe
452	IEXPLORE.EXE
452	IEXPLORE.EXE
452	IEXPLORE.EXE
452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exeiexplore.exe

description	pid	process	target process
PID 584 wrote to memory of 636	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	cmd.exe
PID 584 wrote to memory of 636	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	cmd.exe
PID 584 wrote to memory of 636	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	cmd.exe
PID 584 wrote to memory of 636	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	cmd.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 584 wrote to memory of 860	584	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
PID 860 wrote to memory of 1668	860	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	iexplore.exe
PID 860 wrote to memory of 1668	860	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	iexplore.exe
PID 860 wrote to memory of 1668	860	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	iexplore.exe
PID 860 wrote to memory of 1668	860	48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe	iexplore.exe
PID 1668 wrote to memory of 452	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 452	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 452	1668	iexplore.exe	IEXPLORE.EXE
PID 1668 wrote to memory of 452	1668	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
"C:\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe":ZONE.identifier & exit
2⤵
- NTFS ADS
PID:636

C:\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
"C:\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://steamcommunity-a.akamaihd.net/economy/image/fWFc82js0fmoRAP-qOIPu5THSWqfSmTELLqcUywGkijVjZYMUrsm1j-9xgEObwgfEh_nvjlWhNzZCveCDfIBj98xqodQ2CZknz5wOuqzNQhlZxDWBLJYUOwF9QnTDyY27fhvXdC-44QKKE644ZyUMuF-NY4eHJWEWv6Hbgys6E0-g6JZfZONqCK-3ivtaDwJDRHp-j0MhqbZ7VLOXRkn/360fx360f
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:452

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\mlf2v8h\imagestore.dat
Filesize
38KB

MD5
d009b95314d809835b9666947eb81068

SHA1
48543a9f1740eb39500c557a540a572d1b059f78

SHA256
a39178e1d6e57ce6c1b18923b380c74e34bae6264837ef8fdd56e13c5c157920

SHA512
8b5bafd8d57e9733ea5b39bfefc51c7e297feb3bcc0e2a8b3a398bc3830127926169e890be29c25b3c1ca8e43842c4d4a0eac38f448c0c5bf36712cb81e6eeb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
Filesize
259KB

MD5
a20d46664d06744d2515d69eeff57508

SHA1
7c1dd71389b6661c36f7c0d64531d03c4e71fc29

SHA256
48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d

SHA512
60bf71e7b80e447e2a9197ff365805d8e5e257b3f4f3787b6fb9940a9d40f710d5880f1910689d5f8cbe79cbbb1f4478afc6aa3eb134b61b3b741c4ab1e268cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
Filesize
259KB

MD5
a20d46664d06744d2515d69eeff57508

SHA1
7c1dd71389b6661c36f7c0d64531d03c4e71fc29

SHA256
48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d

SHA512
60bf71e7b80e447e2a9197ff365805d8e5e257b3f4f3787b6fb9940a9d40f710d5880f1910689d5f8cbe79cbbb1f4478afc6aa3eb134b61b3b741c4ab1e268cf

Download Submit
\Users\Admin\AppData\Local\Temp\48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d.exe
Filesize
259KB

MD5
a20d46664d06744d2515d69eeff57508

SHA1
7c1dd71389b6661c36f7c0d64531d03c4e71fc29

SHA256
48d192ac7197e3fcb1aa8d6b46a0cab2d41343e1630a190d4ca433b4eecddd3d

SHA512
60bf71e7b80e447e2a9197ff365805d8e5e257b3f4f3787b6fb9940a9d40f710d5880f1910689d5f8cbe79cbbb1f4478afc6aa3eb134b61b3b741c4ab1e268cf

Download Submit
memory/584-56-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/584-55-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/584-75-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/584-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

Filesize
8KB

Download
memory/636-57-0x0000000000000000-mapping.dmp

Download
memory/860-66-0x0000000000407C8E-mapping.dmp

Download
memory/860-65-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/860-64-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/860-63-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/860-69-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/860-71-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/860-73-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/860-74-0x00000000747E0000-0x0000000074D8B000-memory.dmp

Filesize
5.7MB

Download
memory/860-61-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/860-60-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads