e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23

General

Target

e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Size

4.5MB
MD5

5bc17108151316c630bdd303decfcbbe
SHA1

e349af6b631124efded0bc5cf0afe54b8fcaaabc
SHA256

e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23
SHA512

9bab39b7f5cdcec2cbd80b382c02a571c5ddbd0505cee8d6f225022850602f59d3e34afb6fcf180a2641bbee308587d6e6e3c5a8f715e8a9114686ce405c7a7c
SSDEEP

98304:xYWQttDiH2LMlG4ZbJNn/5WWI4/5/4I7VQXR:xYeH2Cgl4/5QXR

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1948-55-0x0000000010000000-0x0000000010038000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

description ioc process

File opened for modification \??\PhysicalDrive0 e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

Modifies Internet Explorer settings 1 TTPs 17 IoCs

adware spyware

Modify Registry

T1112

Processes:

e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.dataoying.com	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.dataoying.com\ = "63"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\dataoying.com\Total = "63"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\dataoying.com\Total = "126"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe = "11001"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe = "1"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "126"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.dataoying.com\ = "126"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\dataoying.com	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DOMStorage\dataoying.com\NumberOfSubdomains = "1"	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

pid process

1948 e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

pid process

1948 e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

pid	process
1948	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
1948	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
1948	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
1948	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
1948	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
1948	e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe

C:\Users\Admin\AppData\Local\Temp\e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe
"C:\Users\Admin\AppData\Local\Temp\e4e7ca598920797bae102110bf975c2204c59fb4795e42f730a95be111389f23.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1948-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1948-55-0x0000000010000000-0x0000000010038000-memory.dmp

Filesize
224KB

Download
memory/1948-61-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-63-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-65-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-67-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-71-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-73-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-81-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-85-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-91-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-95-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-99-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-97-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-93-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-89-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-87-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-101-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-83-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-79-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-77-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-75-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-69-0x0000000010001000-0x0000000010028000-memory.dmp

Filesize
156KB

Download
memory/1948-102-0x0000000003C50000-0x0000000003D50000-memory.dmp

Filesize
1024KB

Download
memory/1948-104-0x0000000003CCE000-0x0000000003CD2000-memory.dmp

Filesize
16KB

Download
memory/1948-106-0x0000000003CCE000-0x0000000003CD2000-memory.dmp

Filesize
16KB

Download
memory/1948-108-0x0000000003CCE000-0x0000000003CD1000-memory.dmp

Filesize
12KB

Download
memory/1948-110-0x0000000003CCE000-0x0000000003CD1000-memory.dmp

Filesize
12KB

Download
memory/1948-112-0x0000000003C50000-0x0000000003D50000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads