5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d

General

Target

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Size

185KB
MD5

36256cc100b897cbbdbed4502c3c1ed3
SHA1

44bdf2347eed0b1884b8168e043395d9706990a2
SHA256

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d
SHA512

02737c62f291135f5972213b880721e078b1c498d28557195ab5a97988c6bacc530626b9ad841a18c150d0f1ed2c6ae621b8a83d597dfe1009d853b77f244a48
SSDEEP

3072:XTl6dciOrTFWCZttR8kMHfp76OiKABadqoKOqm0CpWPGhGdeadgtdKVP3w0w4pD+:jlJUWR8kMHd6rBadqohqOhGdItdKdv7+

Score

10^/10

evasion

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

Drops file in System32 directory 2 IoCs

Processes:

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\msscp.reg	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
File opened for modification	C:\Windows\SysWOW64\msscp.reg	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

Drops file in Program Files directory 2 IoCs

Processes:

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\taobao.ico	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
File opened for modification	C:\Program Files\Common Files\System\taobao.ico	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TYPEDURLS	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://n.srpkw.com"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://n.srpkw.com"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

Modifies registry class 31 IoCs

Processes:

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\DefaultIcon\ = "C:\\Program Files\\Common Files\\System\\taobao.ico"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\DefaultIcon\ = "C:\\Program Files\\Common Files\\System\\taobao.ico"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files\\internet explorer\\IEXPLORE.EXE,0"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\1 = "20221129"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.htm\ = "htmfile"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.htm\ = "htmfile"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.html\ = "htmlfile"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\ = "htmfileico"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" \"%1\""	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.html	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.htm	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\shell\open\command\ = "\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" \"%1\""	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\cdafile2 = "70359"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "1"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.html\ = "htmlfile"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.html	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\ = "htmfileico"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Play2a\10 = "0"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\.htm	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\DefaultIcon	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files\\internet explorer\\IEXPLORE.EXE,0"	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmfile\DefaultIcon	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

4808 regedit.exe
4692 regedit.exe

pid	process
4808	regedit.exe
4692	regedit.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe

description	pid	process	target process
PID 4224 wrote to memory of 4808	4224	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	regedit.exe
PID 4224 wrote to memory of 4808	4224	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	regedit.exe
PID 4224 wrote to memory of 4808	4224	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	regedit.exe
PID 4224 wrote to memory of 1320	4224	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
PID 4224 wrote to memory of 1320	4224	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
PID 4224 wrote to memory of 1320	4224	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
PID 1320 wrote to memory of 4692	1320	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	regedit.exe
PID 1320 wrote to memory of 4692	1320	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	regedit.exe
PID 1320 wrote to memory of 4692	1320	5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe	regedit.exe

C:\Users\Admin\AppData\Local\Temp\5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
"C:\Users\Admin\AppData\Local\Temp\5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4224

C:\Windows\SysWOW64\regedit.exe
C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
2⤵
- Runs .reg file with regedit
PID:4808

C:\Users\Admin\AppData\Local\Temp\5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
C:\Users\Admin\AppData\Local\Temp\5213a89e79fbf9985e0533f9edae85fb0c6a93c941cf464c88ac8110d1c3bc2d.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1320

C:\Windows\SysWOW64\regedit.exe
C:\Windows\regedit.exe /S C:\Windows\system32\msscp.reg
3⤵
- Runs .reg file with regedit
PID:4692

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

2

T1158

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\taobao.ico
Filesize
14KB

MD5
468fada123f5548ac87e57bae81f6782

SHA1
edb8f012c25906e6afd8bf335b495e16c440243d

SHA256
091c882bb307d57f2c7c42309e7ba8740130fef8c3ed772b0bc5e5505e37034d

SHA512
635ec26c88c2394dd4f2a81b9aea8f429a91adfeb37ae34e51b03f3cf8e503c123c3685938f40cea07d6146e0c7113aadbe62fa528f1f6d8b995e617fd68a4aa

Download Submit
C:\Windows\SysWOW64\msscp.reg
Filesize
228B

MD5
2d06a424ad1c7611ea9caad93892ea26

SHA1
a901e15c2ecea498f1ca8ffc5d5c32bd3f0169d8

SHA256
8c19027357bcb3170b6844aec44cd4c143c7b795d5df52ff89426615010f715c

SHA512
3199dffce9d7625d9e01d7a06c912d3629e5f3d98d3935763df6b323807d46f24a40876d78d5ae7f7ac83c90e498e7c4810d88993904dbca1036e8c06833ccdf

Download Submit
C:\Windows\SysWOW64\msscp.reg
Filesize
228B

MD5
2d06a424ad1c7611ea9caad93892ea26

SHA1
a901e15c2ecea498f1ca8ffc5d5c32bd3f0169d8

SHA256
8c19027357bcb3170b6844aec44cd4c143c7b795d5df52ff89426615010f715c

SHA512
3199dffce9d7625d9e01d7a06c912d3629e5f3d98d3935763df6b323807d46f24a40876d78d5ae7f7ac83c90e498e7c4810d88993904dbca1036e8c06833ccdf

Download Submit
memory/1320-135-0x0000000000000000-mapping.dmp

Download
memory/1320-139-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1320-140-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4224-132-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4224-141-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/4692-136-0x0000000000000000-mapping.dmp

Download
memory/4808-133-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads