95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9

General

Target

95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
Size

190KB
MD5

b38e43486d01a84cccde5e4e1239f86e
SHA1

1dba2bb6e1157963d8f8846cddb7b6eac8e17ac5
SHA256

95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9
SHA512

3ad8c288a12103a1f19abe607dd427efa0be86b70c4df92db3a9fc564135f882869e0b3574d21a23c9994dc21a5be3719daa85c2a636b097b938c0a207946ec6
SSDEEP

3072:zfetsEYRfmnCgiKPkDtkFhqmFyzqjLRu3fa2oumGA+DumCp0+TiVHKvrRl9uw4:bekROyD2FUmUqifa9ZEum20+qKvEb

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe

description	pid	process	target process
PID 1536 set thread context of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{726F8721-706C-11ED-8803-52E8C5FCC7C7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376549637"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd4efa49b19d344c875bc52e9f71d303000000000200000000001066000000010000200000008e08891da983cc5c9cf2aac86f25c365a58f2ab43df37ba64c05a1325f6bf4df000000000e8000000002000020000000a74c67686d37cc923341616140346aeb05897f883da4387c39c6040722a7113020000000829aaa34ef26dab9e49f2830ecd8af667e9d60ea0f6d075b2761fa47415fa78440000000cd7183bdf14fcd6d5e305ba8ea8120a2dc8f9e42e7597596748f80e7cadf0f247543338dcbc7e5b062a7248b2984c5548d9cacc87b9098d2c7a8e36b9340f3b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0e8c54d7904d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd4efa49b19d344c875bc52e9f71d30300000000020000000000106600000001000020000000b826ff62a21725ec6f0d96178b9efc4f346be3327cdbe83f7bcacec764925466000000000e800000000200002000000020b75bb0984acf43448f03fec6fa6ced481fcb6539f252b3598b88446815460290000000cfa31763c7320a75b29fddadf7ab244e92ec7fffe5e5bfb54325c8b6c90017eb0246ad11c650d421bbfad85afb008675ac98e11e3b6895c977d04ed10bf07d03d9dccfcbb25942bf4fb96d264ae95ae5cd96d6adc8eac76944483e62c6896ebf4208a5b874b4b59f8b0b33ed8f5c95cc4e1d811e03ab88b80a375316f4c27e7ccfd7722f88a8e448b32276c2a149e4e9400000007be6236bef90553fb984d680b3a251b982e4b61cf3e19947bf26f500473dc96a4df4c9daffc0abb026ab024ec57210625fbf417c82e37c479bb13f073d9a6c8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

972 iexplore.exe

pid	process
972	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exeiexplore.exeIEXPLORE.EXE

pid	process
1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
972	iexplore.exe
972	iexplore.exe
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE
1836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exeiexplore.exe

description	pid	process	target process
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 1536 wrote to memory of 2040	1536	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
PID 2040 wrote to memory of 972	2040	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	iexplore.exe
PID 2040 wrote to memory of 972	2040	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	iexplore.exe
PID 2040 wrote to memory of 972	2040	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	iexplore.exe
PID 2040 wrote to memory of 972	2040	95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe	iexplore.exe
PID 972 wrote to memory of 1836	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 1836	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 1836	972	iexplore.exe	IEXPLORE.EXE
PID 972 wrote to memory of 1836	972	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
"C:\Users\Admin\AppData\Local\Temp\95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1536

C:\Users\Admin\AppData\Local\Temp\95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
C:\Users\Admin\AppData\Local\Temp\95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=95135056599933fb8efe83a10ce5ac0ff79a6c3442a34610e6c96c913ea111f9.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:972

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:972 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1836

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BZU0ZIIU.txt
Filesize
608B

MD5
ac563bed3a2c9e7df8b36eee9de85f2c

SHA1
60514d169191d181bf102945232b5a8c99d685d7

SHA256
3bd6ed48e0f5cc42c1f495b3037c968c23a7741b2bb9b7ec2861807859810066

SHA512
8338a0cd144600e48e52d8acb63c1d5bd6962c841995af4d06c0faccc6af08ac9007f28abf807b0e5316cf1ddbd3d3c36bdd54eda842af8054b550467bc402b8

Download Submit
memory/1536-62-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2040-56-0x000000007A590000-0x000000007A5B0000-memory.dmp

Filesize
128KB

Download
memory/2040-57-0x000000007A59C03E-mapping.dmp

Download
memory/2040-59-0x000000007A590000-0x000000007A5B0000-memory.dmp

Filesize
128KB

Download
memory/2040-61-0x000000007A590000-0x000000007A5B0000-memory.dmp

Filesize
128KB

Download
memory/2040-63-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2040-64-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads