b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c

General

Target

b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe
Size

610KB
MD5

aa11dfd8b7f848595d4252db8f31ca05
SHA1

dc333aac83e4d3586bdf030bc81ba51e96ac6499
SHA256

b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c
SHA512

628bda240bfd73de4d6b268df462a85160f7b50f9cfd962f0d6fac0c67afa7bb42df6509649a8142e588c7316b84c41bc77d37677a696be64080545f265ecaa8
SSDEEP

12288:ZZ4DjeEs3opA/7QQ5BYLNLlNYp63xdusjHXNGxOFrZHU04B2BgL+:T4U/7QQPYd2ECsrXN+0mPDa

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1376	Explorer.EXE

Loads dropped DLL 1 IoCs

pid	Process
2016	regsvr32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\XegiKhimp = "regsvr32.exe \"C:\\ProgramData\\XegiKhimp\\UiweGyay.ojr\""	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\XegiKhimp = "regsvr32.exe \"C:\\ProgramData\\XegiKhimp\\UiweGyay.ojr\""	Explorer.EXE

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2016	regsvr32.exe
1972	wmiprvse.exe
1972	wmiprvse.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1376	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2016	regsvr32.exe
Token: SeDebugPrivilege	2016	regsvr32.exe
Token: SeCreateGlobalPrivilege	1376	Explorer.EXE
Token: SeShutdownPrivilege	1376	Explorer.EXE
Token: SeDebugPrivilege	1376	Explorer.EXE
Token: SeShutdownPrivilege	1376	Explorer.EXE
Token: SeShutdownPrivilege	1376	Explorer.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2016	1736	b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe	28
PID 1736 wrote to memory of 2016	1736	b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe	28
PID 1736 wrote to memory of 2016	1736	b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe	28
PID 1736 wrote to memory of 2016	1736	b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe	28
PID 1736 wrote to memory of 2016	1736	b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe	28
PID 1736 wrote to memory of 2016	1736	b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe	28
PID 1736 wrote to memory of 2016	1736	b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe	28
PID 2016 wrote to memory of 1008	2016	regsvr32.exe	16
PID 2016 wrote to memory of 1008	2016	regsvr32.exe	16
PID 2016 wrote to memory of 1376	2016	regsvr32.exe	13
PID 2016 wrote to memory of 1376	2016	regsvr32.exe	13
PID 2016 wrote to memory of 748	2016	regsvr32.exe	10
PID 2016 wrote to memory of 748	2016	regsvr32.exe	10
PID 2016 wrote to memory of 1704	2016	regsvr32.exe	9
PID 2016 wrote to memory of 1704	2016	regsvr32.exe	9
PID 2016 wrote to memory of 1972	2016	regsvr32.exe	7
PID 2016 wrote to memory of 1972	2016	regsvr32.exe	7

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1972

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1704

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:748

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1376
- C:\Users\Admin\AppData\Local\Temp\b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe
  "C:\Users\Admin\AppData\Local\Temp\b685bb88cef526f9f7360d44455305603fbe15e9076f202877d9e6ba7628896c.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\\~006CAEA8.tmp"
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2016

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\XegiKhimp\UiweGyay.ojr

Filesize
280KB

MD5
5c96388c2af777962b6d863c97cdac29

SHA1
4bb2c2df85b29e158890ec5a0c2de7aaf47a368b

SHA256
5e85ee202d30a99889f3c138215031e1b3f3d820266b29332a918ecda1d7176d

SHA512
42c93bcbd693bdd4a2c2966f3aed8ffbb22a8f08873b8cfadb4034525089ca7f4676d245c81f341777d8ea1165aaa5faafeb107c6abb74382f2e01dc52ae0089

Download Submit
C:\Users\Admin\AppData\Local\Temp\~006CAEA8.tmp

Filesize
280KB

MD5
5c96388c2af777962b6d863c97cdac29

SHA1
4bb2c2df85b29e158890ec5a0c2de7aaf47a368b

SHA256
5e85ee202d30a99889f3c138215031e1b3f3d820266b29332a918ecda1d7176d

SHA512
42c93bcbd693bdd4a2c2966f3aed8ffbb22a8f08873b8cfadb4034525089ca7f4676d245c81f341777d8ea1165aaa5faafeb107c6abb74382f2e01dc52ae0089

Download Submit
\Users\Admin\AppData\Local\Temp\~006CAEA8.tmp

Filesize
280KB

MD5
5c96388c2af777962b6d863c97cdac29

SHA1
4bb2c2df85b29e158890ec5a0c2de7aaf47a368b

SHA256
5e85ee202d30a99889f3c138215031e1b3f3d820266b29332a918ecda1d7176d

SHA512
42c93bcbd693bdd4a2c2966f3aed8ffbb22a8f08873b8cfadb4034525089ca7f4676d245c81f341777d8ea1165aaa5faafeb107c6abb74382f2e01dc52ae0089

Download Submit
memory/1008-69-0x0000000001CD0000-0x0000000001D28000-memory.dmp

Filesize
352KB

Download
memory/1376-84-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1376-82-0x000007FFFFF00000-0x000007FFFFF6D000-memory.dmp

Filesize
436KB

Download
memory/1376-73-0x00000000025A0000-0x00000000025F8000-memory.dmp

Filesize
352KB

Download
memory/1736-59-0x0000000002BA0000-0x0000000002CC0000-memory.dmp

Filesize
1.1MB

Download
memory/1736-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/1736-55-0x0000000002BA0000-0x0000000002CC0000-memory.dmp

Filesize
1.1MB

Download
memory/2016-65-0x0000000075090000-0x00000000750C7000-memory.dmp

Filesize
220KB

Download
memory/2016-63-0x0000000075090000-0x00000000750F9000-memory.dmp

Filesize
420KB

Download
memory/2016-80-0x0000000075090000-0x00000000750F9000-memory.dmp

Filesize
420KB

Download
memory/2016-83-0x0000000075090000-0x00000000750C7000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads