ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e

General

Target

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
Size

1.9MB
MD5

7429b8f292f85ffa84e1657e60abc887
SHA1

b6aa0c059bb76a4928f4d2d9854bf8a0b5ebad67
SHA256

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e
SHA512

5f426ce668781d2b1ac2f4155fc4198a241c8394227b9b0e51763d3ea06c7f229591e07e9cfc1061c0af3449b7554c97f332a1c1757483b63bff5cbc2bfdf51e
SSDEEP

24576:PdDIebyqqi2saCSwBjDfx+5w/R13lrUi8DZCTfQxVPBkZQpFXSKQZCTfQxVPBkZo:PtvJqiGQ1+m1RpWCTav4CTavX

Score

9^/10

evasion trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Wine	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

pid process

1972 ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

description	pid	process	target process
PID 1972 set thread context of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72F3D241-72A7-11ED-8DB1-7A3897842414} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddb17e0440156d40b3a3e201eb7186c900000000020000000000106600000001000020000000bd1e8d23e466d6be5f6b50cf8e70e902b5773184f7f4827c0b4a6c782e2bee89000000000e8000000002000020000000179c4fe3fad1965afa0070f42b34e30ad10e0301e73c3415c8036a639f36b35920000000a453b0e68edb67aaf5322498c603ef9e882310be65be6e2c861f0527595737e940000000a03ba030a508edf81999363ce9dea91586d2ea62c3ce082fcf5827818b4eff36a1ca27e9f40107919fc28c7705552262eb0d7314f038fec1e799d14891eee0e4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ddb17e0440156d40b3a3e201eb7186c9000000000200000000001066000000010000200000002ff8fd5db5ab8b0ec8ed8280826a71e9ffec4761e3b4a1827c243d43d2c02e85000000000e80000000020000200000003e8763f9fb64cf72f861121bf90f920731dd6f2ca6cf0236e5fbff9c5721233390000000ddc937145ee04af6e4bac139b69a7f479093924343c5ab07336fde2ab358464096e16c4dd27b40cd7757b6aff729bfa077209c4bbcb836b3e80d0af145a4176c62133fc0110b149a06c325e65057bd6f3508ca2b6ae44f35574a757e55022ad15ed4c11d5356fba8e8170174f717c5d0fdfecc4d22f9500f3633a2a75fe39690f4da2339ee0ba6488f98991b5fca4dd74000000089b52d6e88cea48f620a15c0543759a71b546076b2221bc6c02904f34ac2f0ad2cc1398f162dea35e6b0a1bfad45b27ec76b9656cf76c47c587526769057abfc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ffb163b406d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376794878"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe

pid process

1972 ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1124 iexplore.exe

pid	process
1124	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exeiexplore.exeIEXPLORE.EXE

pid	process
1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
1124	iexplore.exe
1124	iexplore.exe
1068	IEXPLORE.EXE
1068	IEXPLORE.EXE
1068	IEXPLORE.EXE
1068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exeae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exeiexplore.exe

description	pid	process	target process
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1972 wrote to memory of 1588	1972	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
PID 1588 wrote to memory of 1124	1588	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	iexplore.exe
PID 1588 wrote to memory of 1124	1588	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	iexplore.exe
PID 1588 wrote to memory of 1124	1588	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	iexplore.exe
PID 1588 wrote to memory of 1124	1588	ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe	iexplore.exe
PID 1124 wrote to memory of 1068	1124	iexplore.exe	IEXPLORE.EXE
PID 1124 wrote to memory of 1068	1124	iexplore.exe	IEXPLORE.EXE
PID 1124 wrote to memory of 1068	1124	iexplore.exe	IEXPLORE.EXE
PID 1124 wrote to memory of 1068	1124	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
"C:\Users\Admin\AppData\Local\Temp\ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972

C:\Users\Admin\AppData\Local\Temp\ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1588

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=ae814e6e500b38e79f0e5541148857657b78da331e1f2b8e6959e90e7f427a6e.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1124

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1124 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NSI31JUT.txt
Filesize
539B

MD5
1ab25c87166de1fc4c805a15718e1a05

SHA1
480d1a5f828c663025c5629ae17618515ce26315

SHA256
a02f1b2ccb31437413a682629391874ac91a1beb54a63212279f15faf8e3b7df

SHA512
9dff7470ae579e4d85cff28cf9481f27b17d3328df022706e5a61d403e8df0d1655639b240ea6d4f36dc24857a388c95250cc55d8f48c035af1a3919e3c61590

Download Submit
memory/1588-64-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1588-58-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1588-59-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1588-61-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1588-62-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1588-65-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1588-66-0x000000000042CF2E-mapping.dmp

Download
memory/1588-69-0x0000000000402000-0x000000000042D000-memory.dmp

Filesize
172KB

Download
memory/1588-68-0x0000000000402000-0x000000000042D000-memory.dmp

Filesize
172KB

Download
memory/1972-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1972-70-0x00000000774C0000-0x0000000077640000-memory.dmp

Filesize
1.5MB

Download
memory/1972-57-0x00000000774C0000-0x0000000077640000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads