8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d

General

Target

8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe
Size

101KB
MD5

3e5e12a10b7f74c7d51de5cc5e166f3b
SHA1

0cea7e03b823c46228ba62c5a7c465ffca409412
SHA256

8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d
SHA512

978cba07a36362753b7a23f17bb5c8aea95aaa83c86eafd111a9c1f83cb469a81839df65c464039da4de3a3f19cc6ce78fc08decdc7d4224fa9999bd2256f48b
SSDEEP

1536:9edHm9yYNetrQnKHTJKqOZ2QjLc9b1Qp/aKiHp64HlQf6o//hOU7wuOG:9eYPe1QmTJK5ZtjLc9xrHprSfHHhOzrG

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1752 svchost.exe
Loads dropped DLL 1 IoCs

Processes:

8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe

pid process

1584 8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe

pid	process
1752	svchost.exe

pid	process
1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe

description	pid	process	target process
PID 1584 set thread context of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8172051-713F-11ED-A8EF-5A9C998014C3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376640431"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da000000000200000000001066000000010000200000003c0f498eeb9c64fd17794246d15460c849a0b918d418bd1dcc24bcb51b5437f1000000000e800000000200002000000079d286633e477fbc673dec4f33ff4ec171f8b47d4c242526bc91428e93830d7f900000008ed072ab7a15474400688b4d40b945ef5a0a00181058bc8eea071dc5280390da47c3a653567cb8e4e345cdce4eb90d38df7b0bcb7d29e0f58fc2c6712c95feaea091fac29b0a7e2b4a7776fb2311101fd24dbced67eb08e5709cf602699d931cf0675a96394afe25c631d56377e9b46e28645193f237008a0b532fc0a3273a2d10e29471f560e74672f6426cb0fb9380400000001fc4af96078535f2cfef3d020b0b3754b75cba537e2c67490fb27914698e9aad18f08f7a1f1d908fea7bd570ec73741266328bf551fbefeeeb04bbf9ca04fa19	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000084e669b920cac6800e4ad9c348bd698a7f86dadd4f4ba2005744f59c5b80cdc5000000000e800000000200002000000031759939be4dc6ddcd8d0dca969c1ee4df6481509476dde03a8535c6f05583182000000040e6c4c6bdf84dfc967627d8c21064e269f690f54af670a6d300661c8ed3562b400000008574a543e87f2142c543a60e1b04848b85136b8dbd2e3dbe3c5de2da2d0f73b36a060eadc00cb90340f90cf441e1a646d589bf546c31e22843d8558d8db33860	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302b3bd84c05d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1172 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1172 iexplore.exe
1172 iexplore.exe
1344 IEXPLORE.EXE
1344 IEXPLORE.EXE
1344 IEXPLORE.EXE
1344 IEXPLORE.EXE

pid	process
1172	iexplore.exe

pid	process
1172	iexplore.exe
1172	iexplore.exe
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exesvchost.exeiexplore.exe

description	pid	process	target process
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1584 wrote to memory of 1752	1584	8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe	svchost.exe
PID 1752 wrote to memory of 1172	1752	svchost.exe	iexplore.exe
PID 1752 wrote to memory of 1172	1752	svchost.exe	iexplore.exe
PID 1752 wrote to memory of 1172	1752	svchost.exe	iexplore.exe
PID 1752 wrote to memory of 1172	1752	svchost.exe	iexplore.exe
PID 1172 wrote to memory of 1344	1172	iexplore.exe	IEXPLORE.EXE
PID 1172 wrote to memory of 1344	1172	iexplore.exe	IEXPLORE.EXE
PID 1172 wrote to memory of 1344	1172	iexplore.exe	IEXPLORE.EXE
PID 1172 wrote to memory of 1344	1172	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe
"C:\Users\Admin\AppData\Local\Temp\8ee6e99a1b8ac02d28db0f30b4375a574edfb6dd43aef6d84aa9d3cb821feb1d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1584

C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\\plugtemp\svchost.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Q48D29GX.txt
Filesize
515B

MD5
d248846cd93cc9a1fcfc129720951f36

SHA1
bcb733ed91d11eecc6f74694701c272d139c20c6

SHA256
92a0b8d38ef2bf07f00a6d5f1ab9bc1e7904d1e1ea98906cda5609b3a358b34d

SHA512
1820221ef135427d6ec386d2e2cd30ba6c0c85b8521b3f9070e1848a768a1f97232506cec2a87cd8eaf4a5c8b01ad9ab7154f0a68932bc4621569f8a7dc126cf

Download Submit
\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe
Filesize
1.1MB

MD5
34aa912defa18c2c129f1e09d75c1d7e

SHA1
9c3046324657505a30ecd9b1fdb46c05bde7d470

SHA256
6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

SHA512
d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

Download Submit
memory/1584-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1584-55-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1584-56-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1584-71-0x00000000742E0000-0x000000007488B000-memory.dmp

Filesize
5.7MB

Download
memory/1752-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1752-65-0x000000000040AB6E-mapping.dmp

Download
memory/1752-63-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1752-68-0x0000000000402000-0x000000000040AC00-memory.dmp

Filesize
35KB

Download
memory/1752-69-0x0000000000402000-0x000000000040AC00-memory.dmp

Filesize
35KB

Download
memory/1752-61-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1752-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1752-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads