e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690

Analysis

max time kernel
128s
max time network
183s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe
Size

110KB
MD5

1b80b4ad493be6b717e5bacb9f1a7502
SHA1

41b2582bd2c4d730938a5f5b9ff12a20ffd08320
SHA256

e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690
SHA512

4a84e92c7fa41f59d2c8be32a16f0110d8c823dc0cc3fd2824ea67f8543b3acf943947922342b5c99d14f4ca11fcf1de033bc84d30fb16a90f07d34f61cba331
SSDEEP

1536:WdSsBR1aUeveIMwQaCkqXkbsJPJcwA5F+hOcIxK:WX3aUqhiksJPJvA5F+hOcIxK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376452529"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803799439703d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ac7d8e56cea2649a5226d0e41623fda00000000020000000000106600000001000020000000ab45e1506b626f7b30dc9f262a60bdeed14646960f6de2be62cf151cd3163eca000000000e800000000200002000000003fa7c4b50784ac478e02dc54caaa3e91630016b828e0c8315c23217786eae7890000000fbc2e5395a5a3b56663e8207ec5fb75b49ae662d89469a6cf4af9c7f56b2355c8d2cff6e1b3c30815ad94fbd37f53d36dc4ad66020e3ef7722a075515fe1c5298fcb51d6ff5255be0dccdaa6827da5bffcf1a9ed8629956b2a47744950927f6873f841545029567f4fbadc1461d9d92dd9fad5aff83cdafd696cc552babe40b89e60a80cdf3b5ad97b095fa08a053f96400000001da30d47d09b70089634fe7f80f337c717b766341f859e38ab2394b6e98569a9701689a119046b53e23f0b3fa3f856fc22b5a7a39c9aa0b89d39c11d27b295c7	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A3FBD11-6F8A-11ED-A50E-C6457FCBF3CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005ac7d8e56cea2649a5226d0e41623fda00000000020000000000106600000001000020000000503208e021e9e865e756c8b3187917d2c8e754456c8494ab17ef77e1f3e78ce5000000000e800000000200002000000077aeb90aed5a101ce9db9ce1cd8bd0d519cd444efde4eab8287ada4e52f6ad7820000000bbf607acafc7ce2f850f9858652eb3ac09ba2ca8f041736378bcef98187c3d8f4000000013a83f11363dc1a1949e25127aa4cd80d484d67b7d2fd2ac25c6ad3a5f4be95978d8a670e98cf655b8bf25a44fd9df91ab217ef38e624284fe9edf237d2d54a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1536	e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe
1776	iexplore.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1536	e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1776	iexplore.exe
1776	iexplore.exe
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1672	1536	e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe	30
PID 1536 wrote to memory of 1672	1536	e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe	30
PID 1536 wrote to memory of 1672	1536	e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe	30
PID 1536 wrote to memory of 1672	1536	e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe	30
PID 1672 wrote to memory of 1776	1672	cmd.exe	32
PID 1672 wrote to memory of 1776	1672	cmd.exe	32
PID 1672 wrote to memory of 1776	1672	cmd.exe	32
PID 1672 wrote to memory of 1776	1672	cmd.exe	32
PID 1776 wrote to memory of 836	1776	iexplore.exe	33
PID 1776 wrote to memory of 836	1776	iexplore.exe	33
PID 1776 wrote to memory of 836	1776	iexplore.exe	33
PID 1776 wrote to memory of 836	1776	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe
"C:\Users\Admin\AppData\Local\Temp\e3b79ce4710e4271ebbefe4e7d8452b46bb9c4e5e057c298986bb62986b17690.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "start http://securedfileinfo.com/404.jsp?chid=4300107^&rsn=plde^&details=^|v6.1.7601x64sp1.0ws^|tt36^|dt0^|dc100^|fs-2^|dh0^|ec13^|se12007^|dr4^|ds0^|rs0^|p1"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://securedfileinfo.com/404.jsp?chid=4300107&rsn=plde&details=|v6.1.7601x64sp1.0ws|tt36|dt0|dc100|fs-2|dh0|ec13|se12007|dr4|ds0|rs0|p1
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
1449add840e9160cae5f5b565c634b70

SHA1
dc889a8567e97e99d8b3186975f6b969de5aad6c

SHA256
ab53d0cb3f95f86c66a7e43185e7abce5c80b18270ebe804cfd73a7249174d36

SHA512
192c3eee32ad50022f2f561f4e08c03bfacd7a891e7709e5528ff2641d02a84deafdfd9deb0d086c02b4bedcf8ebf802746f1814a3b8f70afd309695181f4d83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
472B

MD5
a0fe20d41a043db700a84924cd9793f3

SHA1
c0da481fef6cd00558f6e68b074acb34bef8292f

SHA256
03caeb65ab9e22f6d6fe0d344d327950d20ee9ed144e2da0e5e062943a03fc56

SHA512
f9de5b16bd1312dcab9ae06c0a39a295a79354821552b39ee48bb456b42b7302d27e9d063243d3766cd0c2bc47255dee21eee7036b99e1c4df02f1c335e204e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
079d0d5c3e97b5a2f7cb16acdc179c59

SHA1
d6f9283c8db446a716599319aa13d80ab1b12fbd

SHA256
e0c9840acddaa1b238e0984de93648b6e67bdfe715dd0d3e6727f0538814fe31

SHA512
3e3bc1f3b038d3740ed2b94724ceb1dc77c1d00d494cf864a3ae9dd323d7079c565ba3c708f9c6a614f19a2a3b0ab2bae13b1b8456d60f846c9b594287b9ca65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_46F574BDF8F8E3AC29733131E4667BA4

Filesize
402B

MD5
9d8be0b107ecefca012a4c21513dec30

SHA1
1b7cf440a007b28b08f9ac17175ab5675d77e70c

SHA256
eecdd4c6835b56221a3c859999428646ddab099417679d2ec58f8e0f476d2778

SHA512
55e1ffd3eaf8e177ecad0824e6282bed0ebd70cedbba16d1c956e936f116202b3e358b31df9ac5a9b94069ba5d838620a1882d7aa8f75c54940aab3a8b0c3f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
340B

MD5
8bb000d67c50a59bf4a74dc56baf782d

SHA1
047dad4e87e4be98d0cfdd91b04f540496153d86

SHA256
ba67081c5306f3ce951082eea063051155efd739aee9184affd2ac39a26f2f8e

SHA512
db51f2c3698c0149394b91ee95890f01582fda8e1eb5bde9a17bba6aa339c6fd71110f02a17e3c261db6e2cb5dcdef375b119cbb616add4da2387b986254fca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

Filesize
392B

MD5
bcf09ce7980b11f93ae41264c3aebeb8

SHA1
45001fb9a394ee61e798fc2a64aa90448d669893

SHA256
8340536410b755c547a1453c585645afe903ff500701a5e1b0cecaa6d7b55ecb

SHA512
b5bbd3dcee224233a11eb8e043de707a6db92cbc761cf71640461ba66fab880e91e9fa3f8579c6a71d833df5b106a8d4c1285ca34a7ab062fa2dd8c44a9fa445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
72942969100d8c26a131435d18019e4e

SHA1
d73e9080913d8e8d523030a498fca36065b1c1f4

SHA256
fa3f0e4df6abba4a5c901f8db6065601db1408f3e8c6c4fd02f2dad34126753d

SHA512
95140317a94f0958e97118b59ac3e3edc136f2ff4c0194a91cea17f86978a205058dd33070d8897476e4fafb764402b30f579df200fac8b058e288899423065b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZD64D89X.txt

Filesize
608B

MD5
bcc9f3d7e8453f9b08026d52cb2e2524

SHA1
c8fb24f859cda4a677da5e032afe5a552e0d8609

SHA256
dec5bbc839ad547bf326b1fd9b0ed932be652ef28e4ba8737dc00e9da43f7481

SHA512
57f9d1f8555a956243219e1d5cf5b71e61c499af8a6866a38b626469d3055c486a3bca1977c5c199f34ec1370b5c9ffc5d9ec3a6692d0d01130c7be68c264d57

Download Submit
memory/1536-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download