6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76

General

Target

6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe
Size

231KB
MD5

25361e1188398c1b7d3fea6d4b0eb7d0
SHA1

3336dd7937c7887571f7f53645380f1e3f35924b
SHA256

6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76
SHA512

26f658e70d4b8b8f1b53461922ce6ebe0a3f1c7879400f52fa51dbb1373081c313039917f41f45237b0ad91971e7b7b19a49ae299b20b9b3ec283deffaa5d020
SSDEEP

6144:2/3+cBezHTGvRzbsWpJuIDMzYlmpOkIpkZ1hZl:2/9Ci1bRkSQBl

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4656	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Boot Check = "C:\\Windows\\system32\\sysbmw.exe"	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sysbmw.exe	notepad.exe

Modifies Internet Explorer settings 1 TTPs 25 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "518910481"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{45CDFC6A-7079-11ED-919F-6EDF9685419A} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "518910481"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999686"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376555174"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999686"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5048	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5048	IEXPLORE.EXE
5048	IEXPLORE.EXE
4512	IEXPLORE.EXE
4512	IEXPLORE.EXE
4512	IEXPLORE.EXE
4512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 5048	1588	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe	81
PID 1588 wrote to memory of 5048	1588	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe	81
PID 5048 wrote to memory of 4512	5048	IEXPLORE.EXE	82
PID 5048 wrote to memory of 4512	5048	IEXPLORE.EXE	82
PID 5048 wrote to memory of 4512	5048	IEXPLORE.EXE	82
PID 1588 wrote to memory of 4260	1588	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe	83
PID 1588 wrote to memory of 4260	1588	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe	83
PID 1588 wrote to memory of 4260	1588	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe	83
PID 1588 wrote to memory of 5048	1588	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe	81
PID 1588 wrote to memory of 4260	1588	6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe	83
PID 4260 wrote to memory of 4656	4260	notepad.exe	84
PID 4260 wrote to memory of 4656	4260	notepad.exe	84
PID 4260 wrote to memory of 4656	4260	notepad.exe	84

C:\Users\Admin\AppData\Local\Temp\6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe
"C:\Users\Admin\AppData\Local\Temp\6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\program files\Internet Explorer\IEXPLORE.EXE
  "C:\program files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5048 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4512
- C:\Windows\SysWOW64\notepad.exe
  C:\Windows\system32\notepad.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Users\Admin\AppData\Local\Temp\6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe
    C:\Users\Admin\AppData\Local\Temp\6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe
    3⤵
    - Executes dropped EXE
    PID:4656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\6b9ba3998d267ec9ff37f0d4b42080c64b14da2ecbed87be4fba9e15207b5c76.exe

Filesize
158KB

MD5
c353ef35218272c2242233b4a818784b

SHA1
5f3e7bb6baab70100305af72ff1c439d3a7f6b9d

SHA256
20426ed9cc5e9234b8090d4bf6b949597912923477049d105b9509b16646bafc

SHA512
f4a5daac9efadb86af78fe5ccfd7eb5d513991d0784726c5e4008420977155f4dc416ba88ddeb4e330ea344f6fe0c64e9981c30b2f7ed6437cb83e3f764c50e7

Download Submit
memory/4260-132-0x0000000000000000-mapping.dmp

Download
memory/4260-133-0x0000000013150000-0x0000000013165000-memory.dmp

Filesize
84KB

Download
memory/4656-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads