b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78

General

Target

b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe
Size

3.5MB
MD5

3f4b912ed5481aa71ce00a82a3b48be6
SHA1

96f1bf2deee38e0272d1c5d6782bc988c7a33bb7
SHA256

b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78
SHA512

b0894d056f30defae618d4fcd289da9e89d49cd23274df882fbf089a8a13ddc00769456c708b819db19db13c1c2d31635c3709fbe2dbf5f6bd4c656e31b363e1
SSDEEP

98304:KqoKUUypUG/q/x8Cm+tqjLJ/0U3Bd8BSBRqm:eKNw/VCLIjLH3ngg

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a000000000200000000001066000000010000200000003791324a8c79b2dfe21360fe67eeb302a36050fda05d8b808a1061718cc3c60e000000000e8000000002000020000000496675f519a0e35cb46a86b41046af7761892eeaf93e71b856748268b5bc00ea90000000b3734624538dc8c3a2eb9346ca5405f3658765d3f54595eb8e066600af26d458d2c46898b75fadc92c2265abe1d7b93b086a8a75fe40429cae5ec983bb42b7c59b0f93184937dd59120a9bc4a0ff7989d2c09bd334579faaa958d43a2e8ccb5057179937602657acd380d473401337e1c7581a74c3a3bb35ddd14735e6fad6d56071ee80fa177f56a07146028c457fce4000000045fc04b64bd1c9abfd607e366e767480b83d0326e050f4e9702f9e70067b6bf0735a55750a004d7f33d573f2c0c212748b9d7fb504a8b10115785ec23ca85488	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376519291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204b74963204d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048ca5449a4d21846ba8a995ea0abd35a00000000020000000000106600000001000020000000cfade9ed8526939301e58025173535bfc2b46fa454ac351d6749b84a516a5c5d000000000e8000000002000020000000a0772d90ed9b090a878cc676f33f2c6b0e9737dfb0b3f567a539eba23960314120000000fdc8476bb836784d16fb3725205fcb2bfe52631620b0964976ce06bd1d91e0ef40000000288844090a67541381dfc548b9fb961d116b9f8d245aae3f152ec510b4072a211ba2831a5b519aa083f0fa5a5c17e0738e8f1c77828887c27b402443bcd7ee96	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CA08AB21-7025-11ED-AD72-5E7A81A7298C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1736 iexplore.exe

pid	process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exeiexplore.exeIEXPLORE.EXE

pid	process
2028	b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe
2028	b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe
1736	iexplore.exe
1736	iexplore.exe
796	IEXPLORE.EXE
796	IEXPLORE.EXE
796	IEXPLORE.EXE
796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exeexplorer.exeiexplore.exe

description	pid	process	target process
PID 2028 wrote to memory of 2020	2028	b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe	explorer.exe
PID 2028 wrote to memory of 2020	2028	b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe	explorer.exe
PID 2028 wrote to memory of 2020	2028	b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe	explorer.exe
PID 2028 wrote to memory of 2020	2028	b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe	explorer.exe
PID 1628 wrote to memory of 1736	1628	explorer.exe	iexplore.exe
PID 1628 wrote to memory of 1736	1628	explorer.exe	iexplore.exe
PID 1628 wrote to memory of 1736	1628	explorer.exe	iexplore.exe
PID 1736 wrote to memory of 796	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 796	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 796	1736	iexplore.exe	IEXPLORE.EXE
PID 1736 wrote to memory of 796	1736	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe
"C:\Users\Admin\AppData\Local\Temp\b0ff2f5a59e8e4d3a81165a4170c5343a572484bc2963b54c1288b8fa07cae78.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\explorer.exe
explorer http://www.mlplay.com/download.html
2⤵
PID:2020

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:1628

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://www.mlplay.com/download.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e7096db725aa2e266b4e25f8ce1d7e57

SHA1
9c7c62fa6174c7d39e21342a6b867901810ad5db

SHA256
2df7329d86c859bae0d6e7ad0123410049220ae6366837543ba318e61153e7eb

SHA512
4126a0a33fef6ca5f55832000768bc2e91f9700c5c364e51f476f8d16f954a243718c6de6337011d69e2d47f2e9c6c05e2d0ecfa41e43b9d8d2b2bdf6ea90f2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat
Filesize
4KB

MD5
b20977d58af75fc366f5f76e7160e845

SHA1
4fa88afd93920a9786809423b40d97ec9ee654ca

SHA256
d10eb69600bd2b211dca9b30b525445ea1ee02eddd7dc5df8472a3f12b64d48a

SHA512
9796253502c681a26b90f0befe1a3dc912d2f5c71b47b5f51c506a6b0437e90755d88265b2d71acaa3a9afb76d933bd8577065ac2c658099cad84d620801cb19

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\D8IUPS9Q.txt
Filesize
608B

MD5
ec1c8b4446a21623ff1b569776c64133

SHA1
5b977625ce42bb337e396b23e2d41bc9cab24757

SHA256
f075c54a8a5ebeefb72d008976a21f2eae7979949cc513124d56e319f28bb7bb

SHA512
104c529f234489d197a061599ba97a83b082ffd51a344e042dde7227a190e2d9aaea9d60a4e8297f2aacec0884777f5294153a324b8b9af2ad51de0387fe1815

Download Submit
memory/1628-59-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download
memory/2020-56-0x0000000000000000-mapping.dmp

Download
memory/2020-58-0x0000000074421000-0x0000000074423000-memory.dmp

Filesize
8KB

Download
memory/2028-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000000400000-0x0000000000790000-memory.dmp

Filesize
3.6MB

Download
memory/2028-60-0x0000000000400000-0x0000000000790000-memory.dmp

Filesize
3.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads