f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b

General

Target

f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe
Size

10KB
MD5

0607cdf1834565e3e3b6e2ab7f8a8ef1
SHA1

ba78be7e8d6f91042bf06306ac266e9d129b068f
SHA256

f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b
SHA512

2300973dcd70365d0e833bc282e40c794a7b4293b58f54921a0d5bc1a12f9f31978429af4554866fd76606df206acb02c88a7eb995c941782cf9ebae0000ce29
SSDEEP

96:/Ne+JVUpaq8wmPVde6YNXFIa3cpcLdl1cmo8C9YKBECCn5GqiYC+9g7qmNLICD81:/JJYGFN5YNVIajZlWmSYKuVoamNW1

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 16 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Cleared = "1"	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms\Storage2	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395168194"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Cleared_TIMESTAMP = a031a06a2c03d901	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395168194"	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe
1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 1668	1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe	28
PID 1644 wrote to memory of 1668	1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe	28
PID 1644 wrote to memory of 1668	1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe	28
PID 1644 wrote to memory of 1668	1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe	28
PID 1644 wrote to memory of 1668	1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe	28
PID 1644 wrote to memory of 1668	1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe	28
PID 1644 wrote to memory of 1668	1644	f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe	28
PID 1668 wrote to memory of 1396	1668	rundll32.exe	30
PID 1668 wrote to memory of 1396	1668	rundll32.exe	30
PID 1668 wrote to memory of 1396	1668	rundll32.exe	30
PID 1668 wrote to memory of 1396	1668	rundll32.exe	30

C:\Users\Admin\AppData\Local\Temp\f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe
"C:\Users\Admin\AppData\Local\Temp\f37df6a9cf8b2d9fc16249e0e53c79379e216c7bd2ed9a5058c92dec91e0d14b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 4351
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -ResetDestinationList
    3⤵
    PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1644-55-0x0000000074240000-0x00000000747EB000-memory.dmp

Filesize
5.7MB

Download
memory/1644-59-0x0000000074240000-0x00000000747EB000-memory.dmp

Filesize
5.7MB

Download
memory/1668-58-0x000000006EE01000-0x000000006EE03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing