9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165

General

Target

9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
Size

1.3MB
MD5

4d528c349a52e5e6c2895232b7aa6e2d
SHA1

e948bb66219631d078d556c25442364129312044
SHA256

9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165
SHA512

e95f44f81701275b8c2a60b6980522c5ccd8d1c5f7724019f33780735cdaafae8dc6a87d5e8a03b2bbeab0b2ea7e0ba38271b07550d7162b2c0a9fe1b128e5c7
SSDEEP

24576:YUU3jIP9B0ua2tdRUV5G0329TqgszJLZ5TGpszIokcF0K+QjX:cQ0x2tdmXgqgszJLbTMqhtF0PQ

Score

8^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/1552-54-0x0000000000400000-0x0000000000671000-memory.dmp	vmprotect
behavioral1/memory/1552-58-0x0000000000400000-0x0000000000671000-memory.dmp	vmprotect
behavioral1/memory/1552-62-0x0000000000400000-0x0000000000671000-memory.dmp	vmprotect

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376358341"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC7A2E80-6EAE-11ED-BB5A-5A9C998014C3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000032cab4d78fb289869631e1a1a2ec79e2c1013b67bf7251dbf15ca6d1c530fbf3000000000e8000000002000020000000b532fa15c2e331a1e5346b14ad9babf51f0f31d2a405341237ebaa4f5b311a732000000039d10a19df7114969b63aa1a3f8ffaf08c540b0e11f85f3fa8fdb9134583af1f400000007ef089fa415e9d10395a071381784d1d32ac4c94de07302f40f0dce7cbff20c8e47e29f3c19c7d12a8ed5a477de4a460494629ef2d1f3591a8aebd8978e46dad	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000004bea0d9a7a94e5b880d9744799f90749f10ea65e9358eb9aaf44277e22eca845000000000e8000000002000020000000ff4ada00abf7f47ae2f0a36593d9e31977caa092a666080858434780dc63d15c90000000eddb468f8a03c9e89d1c07d4ffe8e636446ceac264f4d6750be131e3b82348ccc7c1522b52e97df1f5936f5502aab0892aff3683bc55d9b47a072d3b3daf349593ac73d87da43bdef47390351f3f1444bdaa38db65578b1ba2341394105e79b6e8b8bf002826c0f358b0f16a109371822c98eaaba3fd68063227ded56aaa60169917bb42a1a15c0948856d6c0c35b36a4000000044243bf7dc09ecab6f8de3ba35535e98d32144b701663e4ba8d78f76491f34c0ff9453862397aef52c2de19f18f52dc96934e9f58b0fa879027f373b69f10a39	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05311d6bb02d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe

pid	process
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe

description pid process

Token: SeDebugPrivilege 1552 9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exe

pid process

316 iexplore.exe
316 iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe

Suspicious use of SetWindowsHookEx 18 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
316	iexplore.exe
316	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
684	IEXPLORE.EXE
684	IEXPLORE.EXE
1068	IEXPLORE.EXE
1068	IEXPLORE.EXE
1824	IEXPLORE.EXE
1824	IEXPLORE.EXE
316	iexplore.exe
316	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1068	IEXPLORE.EXE
1068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exeiexplore.exe

description	pid	process	target process
PID 1552 wrote to memory of 316	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe	iexplore.exe
PID 1552 wrote to memory of 316	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe	iexplore.exe
PID 1552 wrote to memory of 316	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe	iexplore.exe
PID 1552 wrote to memory of 316	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe	iexplore.exe
PID 316 wrote to memory of 1724	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1724	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1724	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1724	316	iexplore.exe	IEXPLORE.EXE
PID 1552 wrote to memory of 812	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe	iexplore.exe
PID 1552 wrote to memory of 812	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe	iexplore.exe
PID 1552 wrote to memory of 812	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe	iexplore.exe
PID 1552 wrote to memory of 812	1552	9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe	iexplore.exe
PID 316 wrote to memory of 684	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 684	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 684	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 684	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1068	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1068	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1068	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1068	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1824	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1824	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1824	316	iexplore.exe	IEXPLORE.EXE
PID 316 wrote to memory of 1824	316	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe
"C:\Users\Admin\AppData\Local\Temp\9ef5d445226e34dedc82b6b0d708bfd40d1c191072f4dc1840f537d56b962165.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://зябука.рф/
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:316

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1724

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:209939 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:684

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:472080 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:406543 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1824

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://зябука.рф/chity/klient-games/chity-na-warface/42-chit-na-warface.html
2⤵
PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
fa60995ceb0673562c5774b2021f63e9

SHA1
4baca5003b98c7fe2d9206f1ad49a1fcab8661c7

SHA256
e0cf4d30a2ef5fd10342a816685ef1c85ed9535049a8731a6b8113f1242e8386

SHA512
ab07ced6b763069c830ec3693092a5f94b77e676450b6888c71ca360fbab372342ecc830bbd58c82317650512b53a7d7b60026b4c9c0003994409aeba301fc79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
44528f7ee21b50cbaf854461eaaa1dbd

SHA1
3e99a79feccedf935be82820bba0e32e00b7a1b1

SHA256
3d19dda02b25c9ba073f4e844484d792c9a6de70ec3e894a63d6193e3e54ae60

SHA512
9f6ab98e4a8b162c9277fa3b85bc5facba0c554c0e98b7823ec271cc47f6deccc0d5be280ae24da80fb7c4e220d4648da6338b46b127d1376d7c2100aaab672e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
44528f7ee21b50cbaf854461eaaa1dbd

SHA1
3e99a79feccedf935be82820bba0e32e00b7a1b1

SHA256
3d19dda02b25c9ba073f4e844484d792c9a6de70ec3e894a63d6193e3e54ae60

SHA512
9f6ab98e4a8b162c9277fa3b85bc5facba0c554c0e98b7823ec271cc47f6deccc0d5be280ae24da80fb7c4e220d4648da6338b46b127d1376d7c2100aaab672e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat
Filesize
10KB

MD5
f54f9454ce7d4c8257fd65bc0ce766f9

SHA1
f8a6ec34f843e97965ee765263dae5414215c040

SHA256
1b6f9c9e6ee8e4914a8e0d61f95a2db7f9d37157433131b66f00bb4c0aed84ed

SHA512
b4a9ae4660c46fe7be334b31f965f0cf85464d764aa746947fd6ed3598b2f93780c90c3c033dadb1abef21106a751ed7ff99285e097c410e6cf1b65547873a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat
Filesize
10KB

MD5
f54f9454ce7d4c8257fd65bc0ce766f9

SHA1
f8a6ec34f843e97965ee765263dae5414215c040

SHA256
1b6f9c9e6ee8e4914a8e0d61f95a2db7f9d37157433131b66f00bb4c0aed84ed

SHA512
b4a9ae4660c46fe7be334b31f965f0cf85464d764aa746947fd6ed3598b2f93780c90c3c033dadb1abef21106a751ed7ff99285e097c410e6cf1b65547873a88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PULJ7CSW\favicon[1].png
Filesize
4KB

MD5
d41fa4f682279a0c77159080255b3b9e

SHA1
7cdf65f129f33ddf76146c9fc0bb30bb80d25065

SHA256
25dfe61842345c39cb13beeee5b921cfe1c16b5f774067416728f8046c56f925

SHA512
39539b6378a59af4bef107fdab92ab7ebbcc9c480a104c3b6389f10d427244be1d818bf4b2a06012c3d68082a91d33351ad81a4a3217423f7d142eecf44cf929

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\J6J9XGC5.txt
Filesize
266B

MD5
0b1a687d0456d88a2d5cd7b0f69b1d40

SHA1
820b25dae5a33ae8cde2e5dfb60aec4114d16673

SHA256
bab616dda25e09999e0cf223bb7303ac7e359b75590ebf2c77d02d9aac4641eb

SHA512
1dada3e4a8603c6c0221e769e7d8f2cc4986d4dcaa11830adb7be67cab83ee3dec97350d6b39576cef0300dfbea3272dd150f87e4e8d8ab401dc0b13e7dfee05

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V2FT7MJ7.txt
Filesize
601B

MD5
63ae81e6da85ffed6e5a5c1a83dff368

SHA1
9bc6f1b1ee0a1d67bcf0b1ddac63470396a0e33b

SHA256
11136148cdc0ca63cb7816d6e0943e6ed7231a572a22d11346c81f50ce47b1a0

SHA512
3ea6d54b02311bfc36d9016cca1cd588215cb167c49aba5c262d3caab59aad01184b322949dfcc6df3817a0fdf45dcbbf8aed53009ea72c483054b40969a205e

Download Submit
memory/1552-59-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1552-62-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/1552-63-0x0000000004DBA000-0x0000000004DCB000-memory.dmp

Filesize
68KB

Download
memory/1552-61-0x0000000004DBA000-0x0000000004DCB000-memory.dmp

Filesize
68KB

Download
memory/1552-60-0x00000000026F0000-0x0000000002728000-memory.dmp

Filesize
224KB

Download
memory/1552-54-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/1552-58-0x0000000000400000-0x0000000000671000-memory.dmp

Filesize
2.4MB

Download
memory/1552-57-0x0000000002380000-0x000000000241A000-memory.dmp

Filesize
616KB

Download
memory/1552-56-0x0000000002490000-0x000000000252A000-memory.dmp

Filesize
616KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads