fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322

General

Target

fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe
Size

3.3MB
MD5

f0d5d001f92db94dc330066157c043c8
SHA1

d969e55b1c0e4e11d37a41479f6487284f3c1968
SHA256

fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322
SHA512

72453668d01e69bb9bdb113776343a96f53575a85ed196ca7e62abffb2fe2434c1b35b381b92e64cbc4327c48b04f791b5193a19b9556a193f67bbbde5df74cf
SSDEEP

98304:uyq0jSL7hP77sToyQK3MtHKVZKesVydbve2Idy6CBr1bY0:xq0jSLVf3yQAMtHqZOViv7IdsBre0

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1660	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp

Loads dropped DLL 4 IoCs

pid	Process
2012	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe
1660	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp
1660	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp
1660	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1660	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1660	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp
1660	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1660	2012	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe	28
PID 2012 wrote to memory of 1660	2012	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe	28
PID 2012 wrote to memory of 1660	2012	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe	28
PID 2012 wrote to memory of 1660	2012	fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe	28

C:\Users\Admin\AppData\Local\Temp\fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe
"C:\Users\Admin\AppData\Local\Temp\fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\is-963BJ.tmp\fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-963BJ.tmp\fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp" /SL5="$80124,3182084,51712,C:\Users\Admin\AppData\Local\Temp\fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-963BJ.tmp\fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp

Filesize
693KB

MD5
8043631ef861d1eb646331cf93293b1f

SHA1
6b6b031842b16c5cb51a6269fe56dd9e3ee8df7e

SHA256
21331a4a3acc8690e8c60b060f29f91705a917ace48c7c032385171ae1c2d1a8

SHA512
426c3dd1e12088484cef3c2ce75fe819cb0ae7ea4f5619110dc021493ca9fc083f9c252b928c8c565db3f779ecaba20fb655e0eaa70221b74fe3d0f7de2a01bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-963BJ.tmp\fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp

Filesize
693KB

MD5
8043631ef861d1eb646331cf93293b1f

SHA1
6b6b031842b16c5cb51a6269fe56dd9e3ee8df7e

SHA256
21331a4a3acc8690e8c60b060f29f91705a917ace48c7c032385171ae1c2d1a8

SHA512
426c3dd1e12088484cef3c2ce75fe819cb0ae7ea4f5619110dc021493ca9fc083f9c252b928c8c565db3f779ecaba20fb655e0eaa70221b74fe3d0f7de2a01bb

Download Submit
\Users\Admin\AppData\Local\Temp\is-963BJ.tmp\fee0ad9a0ec00120734f452c42a8cd89475f7d6006ccf82118533d0e898a0322.tmp

Filesize
693KB

MD5
8043631ef861d1eb646331cf93293b1f

SHA1
6b6b031842b16c5cb51a6269fe56dd9e3ee8df7e

SHA256
21331a4a3acc8690e8c60b060f29f91705a917ace48c7c032385171ae1c2d1a8

SHA512
426c3dd1e12088484cef3c2ce75fe819cb0ae7ea4f5619110dc021493ca9fc083f9c252b928c8c565db3f779ecaba20fb655e0eaa70221b74fe3d0f7de2a01bb

Download Submit
\Users\Admin\AppData\Local\Temp\is-DN8KR.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-DN8KR.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-DN8KR.tmp\webctrl.dll

Filesize
8KB

MD5
d0372bedb70710aeff382818ad683f54

SHA1
f960deffdde9cd5cb5fd3608185a49a91d398f3e

SHA256
b3daff58c8e7ca8ce6fe155ca78c681a7d3144a538c3ed4c2913e91a1d2bd717

SHA512
4b24a990ba155b664bad58884810123898f99f3ffe3d9704662c9576d31d60f1889c7a368589af7c3c9559e5fb9921cf87bc4faf73b4b83d1262b50c9bb5f706

Download Submit
memory/2012-54-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2012-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing