78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729

General

Target

78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
Size

104KB
MD5

262501d948eb900c269e4888d0d416f7
SHA1

25f87d16ce571588a9171b0d0f6b6d80014c2cde
SHA256

78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729
SHA512

113b8599391080c544730a7ace3258dc5f7f9d9c0bdda9c110843e1fa0a97e8dfd9511827b3e638d3dd4e6204830a15874866864376914092657faf741b1efcb
SSDEEP

1536:lP7LRKwGuF6Cp7/LPLrVcwZxFsEBv2cfRPexCCUy1FCs:Fo7CZ/bLTFsOvLRYgyfCs

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe

description	pid	process	target process
PID 1492 set thread context of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003ee7a23549430c45afc3a2afd63c2c0600000000020000000000106600000001000020000000081bb3cff192300b8210fc5df6cbbe2c22831ffa945bca704a627b6d97aac6e4000000000e80000000020000200000007177755db9ad8e1b3c5f13706cb801bc931f3bd5a4a2b853a8a68c25d218acdd2000000012c225bdcdbdc7526aa624286c4ef4f9c9ceac60ef82d52dc1f32e14bc35a86140000000739ce3c94517e1b3f36431b4eb8eea62f8025fb507964436f072608032649efacc9f91ee69ef2b177659f73834145558aee2a6153a9b1809b3a2ab327e04a28a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{434C7D71-711D-11ED-A03D-460E09B1FADA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f6cd1e2a05d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376625577"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003ee7a23549430c45afc3a2afd63c2c060000000002000000000010660000000100002000000045c38819b96171d4a148a38b9835cd0b7f78911476c110a4f55927681312cd0e000000000e8000000002000020000000f7c2bd4f6bbeaaba3b55fb8dc4bbe29e934fa4f55369c2e106124974dff9737490000000d8b240205b1e573d265570d07b0da6e166bfcc52c680f0759f48df2018a5f41717b460cd5511f33423d4d141fd06e1734e39cbd42d9b9f8fe9c2563c9d9f73381d522d27ebf412d54424d985c410a7d726e3da72b7e052fb7c42741d2bfe954ef1a6a4e6229c8798fc8a5ea6b4705ffeab96377e7ee79ecb4bf5c998fd1839c0bfd099af342f93e1341cc64299c2849240000000eff71fbb87b758294a7456f07aa6b8e115a67bde0240620ec26a20bd92e41c3cc86ade7e87e22d21c9a0d97a58676b2c4b72828402ceb89e66ebe66c4b4ab8f4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1276 iexplore.exe

pid	process
1276	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exeiexplore.exeIEXPLORE.EXE

pid	process
1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
1276	iexplore.exe
1276	iexplore.exe
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE
1924	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exeiexplore.exe

description	pid	process	target process
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1492 wrote to memory of 1688	1492	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
PID 1688 wrote to memory of 1276	1688	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	iexplore.exe
PID 1688 wrote to memory of 1276	1688	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	iexplore.exe
PID 1688 wrote to memory of 1276	1688	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	iexplore.exe
PID 1688 wrote to memory of 1276	1688	78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe	iexplore.exe
PID 1276 wrote to memory of 1924	1276	iexplore.exe	IEXPLORE.EXE
PID 1276 wrote to memory of 1924	1276	iexplore.exe	IEXPLORE.EXE
PID 1276 wrote to memory of 1924	1276	iexplore.exe	IEXPLORE.EXE
PID 1276 wrote to memory of 1924	1276	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
"C:\Users\Admin\AppData\Local\Temp\78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
C:\Users\Admin\AppData\Local\Temp\78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=78f4f21126072e959bbe9876cee1bc17100703a62304954d01c2e16dd9956729.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1276

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ODW0I4GL.txt
Filesize
535B

MD5
b6aa9221ae076b0b05b7cfeb292795eb

SHA1
ddce4d43d83502eaa36e44f91a05a4fb9cb90c20

SHA256
cbec697543be57eaab3b2a0fad6b6bf0e16d0a2cbe99a2e86e51d8d57950fd16

SHA512
60f185572c6c7c2625195c9253bb4cc62317de68a91d08cefffc3dea2aa1e7f91305f4d4efcfc4c689bb632e0f9baa18a20c42226eea8ded7d9c5ebfa0ca5591

Download Submit
memory/1688-56-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1688-57-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1688-59-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1688-61-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1688-63-0x000000000040C50E-mapping.dmp

Download
memory/1688-62-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1688-65-0x0000000000402000-0x000000000040C600-memory.dmp

Filesize
41KB

Download
memory/1688-66-0x0000000000402000-0x000000000040C600-memory.dmp

Filesize
41KB

Download
memory/1688-67-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads