fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb

General

Target

fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe
Size

1.2MB
MD5

52b140ea6e3079f98a0bee3ed83c0318
SHA1

7eae09b09f6116c0988243a4511c54dc4229fd25
SHA256

fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb
SHA512

a924a9ae4fa7b1b7b2eecddad293aedf38caaa1b1376d1352449f2b7657c08d136b2ac2e53a85cb8555969dd26664fc5a18df0286f227555aec443f8a71893d9
SSDEEP

24576:5s1EV2AnLKFtHjdL9JF4AAG+YNUZuszAnCQTp+FA3V0df3M1xbVAb0mk:iWV2OSZjdT2xYGDzjQF+a3V0dixAb0n

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

hchchc.exehchchc.exe

pid process

1552 hchchc.exe
1504 hchchc.exe

pid	process
1552	hchchc.exe
1504	hchchc.exe

Loads dropped DLL 2 IoCs

Processes:

fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe

pid	process
1836	fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe
1836	fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\chgfxvxv = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\hchchc.exe"	fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

hchchc.exe

description pid process target process

PID 1552 set thread context of 1504 1552 hchchc.exe hchchc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 1552 set thread context of 1504	1552	hchchc.exe	hchchc.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9DC6DA91-7035-11ED-8D6F-660C31E8D015} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20650d7e4204d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000041cd77016d19134f9b6d691e8df87595000000000200000000001066000000010000200000009c95b8b0931e3e1a372eb3c1895659778228eba3fa1306deb113edaaa64332e6000000000e8000000002000020000000bb85f6d6c127bf9e444598c153953cb1d2b02e947c8b9a579e69dc3197a43a4790000000779c711c57e4f0eac0fc7af46ccb0415a16ee4b13e45f542b081173e14bc75239b603328e74341ab28e13762d8de170b14a2d9b0805b2fd0fd5fda68203bfd36b8b43d947aef6eef2d4a9e9dc3eb8ca443b94beea4b166e845e17480b59e5ce24244854e0520c38ef2b9a5bd4553770f5517fb72f605099f1a01e560dab0b61d5a8ee5c76d73f0e5a92b1366cc4a0f3a400000003677188787f97607aea83ed6b0a86fb99a0d1fa142154d3ca13a8029ecb925ef4e6ca66ab4d41f8dbb9b7cea8bf14ed6c5b520140de3fdc6f062cffc30d2de83	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000041cd77016d19134f9b6d691e8df8759500000000020000000000106600000001000020000000fdea29dc5335a107f6f89f8377b06fe1add81737f7ab473d626beae9900756c2000000000e80000000020000200000009103d18394b00594a2f5759df3e8d4c500e1d38f3f4eaad1d5f939b95cdca9d020000000ae7adfac61478c7bf2e4dc220df7b53640b519edeccab396cb30a9eac7217d1d400000009c57cdfa87323bf6e675a5121f99d8625574b37de48e3be8d86d5ba62fbeb49585241fccc383bcd707db95f2ace8bf41a1a0d00a35595cc598c88ea8a378a9ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376526094"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

892 iexplore.exe

pid	process
892	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exehchchc.exeiexplore.exeIEXPLORE.EXE

pid	process
1836	fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe
1552	hchchc.exe
892	iexplore.exe
892	iexplore.exe
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE
1644	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exehchchc.exehchchc.exeiexplore.exe

description	pid	process	target process
PID 1836 wrote to memory of 1552	1836	fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe	hchchc.exe
PID 1836 wrote to memory of 1552	1836	fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe	hchchc.exe
PID 1836 wrote to memory of 1552	1836	fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe	hchchc.exe
PID 1836 wrote to memory of 1552	1836	fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1552 wrote to memory of 1504	1552	hchchc.exe	hchchc.exe
PID 1504 wrote to memory of 892	1504	hchchc.exe	iexplore.exe
PID 1504 wrote to memory of 892	1504	hchchc.exe	iexplore.exe
PID 1504 wrote to memory of 892	1504	hchchc.exe	iexplore.exe
PID 1504 wrote to memory of 892	1504	hchchc.exe	iexplore.exe
PID 892 wrote to memory of 1644	892	iexplore.exe	IEXPLORE.EXE
PID 892 wrote to memory of 1644	892	iexplore.exe	IEXPLORE.EXE
PID 892 wrote to memory of 1644	892	iexplore.exe	IEXPLORE.EXE
PID 892 wrote to memory of 1644	892	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe
"C:\Users\Admin\AppData\Local\Temp\fd4c392950e20f14b417551aaf3d583372954b7be53995b3318995168096bdcb.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1836

C:\Users\Admin\AppData\Roaming\subfolder\hchchc.exe
"C:\Users\Admin\AppData\Roaming\subfolder\hchchc.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552

C:\Users\Admin\AppData\Roaming\subfolder\hchchc.exe
"C:\Users\Admin\AppData\Roaming\subfolder\hchchc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=hchchc.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:892 CREDAT:275457 /prefetch:2
5⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZJPA9TF7.txt
Filesize
608B

MD5
5821bf725d9a1cc04b6dd20a5f50b20a

SHA1
cb316430561a5fc848c28967e5d4bf627daceaf3

SHA256
563cd666a08b80f89186e7bc827c467de6c62ea45cb3e8e98b9c06e66f181650

SHA512
4d9fa4320be5cefa6f00fe1ec937f1d019374f6c530c743d4cc24c77de4359235a43486c47c5be056b49cb0c1aedefbc3b023229bfc2ea511cf729a6312079d7

Download Submit
C:\Users\Admin\AppData\Roaming\subfolder\hchchc.exe
Filesize
1.2MB

MD5
8e07e8b0140a26c29103aad01d01f436

SHA1
f5670f9cc9a8008aaea6708e16078eea74a4b971

SHA256
a58ee41e2e32d4c1ea2040265f740b2d8d5ab18f251649c1f2416613ecd18722

SHA512
719f1bf396501108d7ebaaa0e70d6ed57c96b50484686ca877a5c1c55eb2039f284616921b609913290df625d32ddb04137d090202f39a0e8b02b2aa013b65d5

Download Submit
C:\Users\Admin\AppData\Roaming\subfolder\hchchc.exe
Filesize
1.2MB

MD5
8e07e8b0140a26c29103aad01d01f436

SHA1
f5670f9cc9a8008aaea6708e16078eea74a4b971

SHA256
a58ee41e2e32d4c1ea2040265f740b2d8d5ab18f251649c1f2416613ecd18722

SHA512
719f1bf396501108d7ebaaa0e70d6ed57c96b50484686ca877a5c1c55eb2039f284616921b609913290df625d32ddb04137d090202f39a0e8b02b2aa013b65d5

Download Submit
C:\Users\Admin\AppData\Roaming\subfolder\hchchc.exe
Filesize
1.2MB

MD5
8e07e8b0140a26c29103aad01d01f436

SHA1
f5670f9cc9a8008aaea6708e16078eea74a4b971

SHA256
a58ee41e2e32d4c1ea2040265f740b2d8d5ab18f251649c1f2416613ecd18722

SHA512
719f1bf396501108d7ebaaa0e70d6ed57c96b50484686ca877a5c1c55eb2039f284616921b609913290df625d32ddb04137d090202f39a0e8b02b2aa013b65d5

Download Submit
\Users\Admin\AppData\Roaming\subfolder\hchchc.exe
Filesize
1.2MB

MD5
8e07e8b0140a26c29103aad01d01f436

SHA1
f5670f9cc9a8008aaea6708e16078eea74a4b971

SHA256
a58ee41e2e32d4c1ea2040265f740b2d8d5ab18f251649c1f2416613ecd18722

SHA512
719f1bf396501108d7ebaaa0e70d6ed57c96b50484686ca877a5c1c55eb2039f284616921b609913290df625d32ddb04137d090202f39a0e8b02b2aa013b65d5

Download Submit
\Users\Admin\AppData\Roaming\subfolder\hchchc.exe
Filesize
1.2MB

MD5
8e07e8b0140a26c29103aad01d01f436

SHA1
f5670f9cc9a8008aaea6708e16078eea74a4b971

SHA256
a58ee41e2e32d4c1ea2040265f740b2d8d5ab18f251649c1f2416613ecd18722

SHA512
719f1bf396501108d7ebaaa0e70d6ed57c96b50484686ca877a5c1c55eb2039f284616921b609913290df625d32ddb04137d090202f39a0e8b02b2aa013b65d5

Download Submit
memory/1504-66-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/1504-67-0x000000000051BAFE-mapping.dmp

Download
memory/1504-71-0x0000000000402000-0x000000000051BC00-memory.dmp

Filesize
1.1MB

Download
memory/1504-70-0x0000000000402000-0x000000000051BC00-memory.dmp

Filesize
1.1MB

Download
memory/1552-59-0x0000000000000000-mapping.dmp

Download
memory/1836-61-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1836-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads