5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08

General

Target

5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
Size

126KB
MD5

0672c47aa14eced4fa4d2454d4b5f611
SHA1

f57e972527a7a0bf1450df2c7c5ab645a3490687
SHA256

5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08
SHA512

c26b149526751b69c2e13721a44dbc74d56422fbc0c6d21e2a7a6af494b5b6e3c969777c742f6549eb2a6d5c6128ac4814b2fdb353473b71044aeb77fa4a1ede
SSDEEP

1536:uF9iCnUrNQUF7UB8wug4Hvq/zkjDRwquoPIv6vH4fxuB4F0YZjyBFF8zRI:OQNQUlW8wuNi/o6qnfHyxu4FhZOv4a

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe

description	pid	process	target process
PID 1816 set thread context of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000006d5cd4b9444e5afb9cb1b3651e5180fdc0f6eff610c584b8535bcc487d64a75e000000000e80000000020000200000004dad485de9f25de2fe88359b6246823de7f5e8ae7772788b4ff8e68c5022f8eb20000000b2f480b3beeb8128c56963c09d24739e03eeaa9cbd56557e34f61a69abe865ea400000004248c3e93a5d4d649400ccb746475a3d128955d155e0d3119d1dc3595f55e0e8db546eb79f101e58505b94b08f03c7aea1bf801bc34f78ee239ddc672112e09e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376442360"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD919EB1-6F72-11ED-9FD0-D6EA6736E294} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402d31867f03d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000b24e3ce96af19240549d59d563247d3f8da993d12b79aa8d6346618ef3855d20000000000e800000000200002000000059fbda7806d5926b8948397b5ccf8309aac41faa9c3a7347828298c26e652657900000000f05041eb75eb6e7e67838bed73defec23623c4f1d54ebac6960c43851d7ed00a8039354c451f52a49a1e751e1fc4db915799714138acd74cddf189455829a801ff4b8f9b60bc41cd251c17abb44538dbfa2617a9b901a9c7033f32fe48a751d10e19d6d271e7c6b60085b032c4c9e9880ad2536dba546d6aa4d5ba1d7d5c06f5607b8b8fbed080c73fa6bd3e320248b40000000cc0988daa1c0538b7e1941b85b65d1a01e93c337e1b6dc22b2559e1207677108cc0c42cc36a48dd9cab108c3842c9502aaf65d0b1298a2f9da0bd75ba1403fb2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2020 iexplore.exe

pid	process
2020	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exeiexplore.exeIEXPLORE.EXE

pid	process
1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
2020	iexplore.exe
2020	iexplore.exe
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE
588	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exeiexplore.exe

description	pid	process	target process
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1816 wrote to memory of 1108	1816	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
PID 1108 wrote to memory of 2020	1108	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	iexplore.exe
PID 1108 wrote to memory of 2020	1108	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	iexplore.exe
PID 1108 wrote to memory of 2020	1108	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	iexplore.exe
PID 1108 wrote to memory of 2020	1108	5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe	iexplore.exe
PID 2020 wrote to memory of 588	2020	iexplore.exe	IEXPLORE.EXE
PID 2020 wrote to memory of 588	2020	iexplore.exe	IEXPLORE.EXE
PID 2020 wrote to memory of 588	2020	iexplore.exe	IEXPLORE.EXE
PID 2020 wrote to memory of 588	2020	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
"C:\Users\Admin\AppData\Local\Temp\5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe
  "C:\Users\Admin\AppData\Local\Temp\5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5744e638ae13767d77a9c354e9af4c9511728ac634f9ab9174f17be3fc9f0c08.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XBHKSJ07.txt

Filesize
603B

MD5
4cbf0beed8573a3bd123d9943b10fd4a

SHA1
2d12abf3a10e0f6170771483f289bd45acb6c175

SHA256
d2cb2dae03d3bd1477f8a62bcb0d3f7c1d7c6473566c1187ec9071474c53aef1

SHA512
a07d6ec65383f0dcb642ed981edd06c8571b3302191f94a942a22869ad6a9cdcd5eb170365d619d23a0ce4e5fce116fcbd1f22f1b518d1d051fef9d4cf08af4c

Download Submit
memory/1108-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1108-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1108-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1108-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1108-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1108-62-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1108-64-0x000000000040B07E-mapping.dmp

Download
memory/1108-67-0x0000000000402000-0x000000000040B200-memory.dmp

Filesize
36KB

Download
memory/1108-66-0x0000000000402000-0x000000000040B200-memory.dmp

Filesize
36KB

Download
memory/1108-68-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads