7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153

General

Target

7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
Size

50KB
MD5

3c25768310a2e6d8c98c4bb7da444ced
SHA1

fd87ffb3fc6a5bab35afbff5afcc38bc173366e0
SHA256

7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153
SHA512

a8f1b7e80e10fff634de1e4ecb3ac7ac0b422bf08a89328f77b28c5d8e720865a6ae772491ee8b4f507d60307ec548727612e9539c06d4d8e9bffb913d50123a
SSDEEP

768:6uwihNqM9h/MdC/pqzRXWmpFtgjrUW+XyiNULxYJo:NqM9h/MdTppFy3UW1iNUqo

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe

description	pid	process	target process
PID 2000 set thread context of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376719211"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{45EAA5E0-71F7-11ED-A8EF-5A9C998014C3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c350200406d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da0000000002000000000010660000000100002000000053aec2bdfcbb66d2eae4c2843b0d34970212236bf43e325f1255f28d7f72ffcf000000000e8000000002000020000000eaa3fdf8cdcc0180d805413e6844a3b492f721d5fc426e28f7af680f9f986d6020000000dbe598ca445ac7e26860aa0af6b879223cdc1f06a1a0135ac8f691b2f1de35e84000000043b2017c3e94e690bb4777d3b180596beb9df7b00620c41c5292195970c26960eb828304fc83b9d600e41dac4aed5cabac8937508394aed57b521a00762da081	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000eb3b7411a3dff87e822298d118751d11b9659e8e5aa1426dae6c9018a2e9251e000000000e80000000020000200000003602a3ad5f203503a45299bf8ffc2543de11165a337dbb9f94f600ce791fea3790000000d643f07b4a0d34110ab91ff10f3d8d05362cfb1b728fb256b6301ca515d53b6f9b919d012756d32e85d8f89a5d8e67c0c6ec40bd6a9d3cab2567c5c2cc013753720cada7d576d0b00d88b0a895665b497bcfc90f735c37b37ce62badaa386f3a61d6fece7e4b44c21e0859cf168e9fe168f79fc4f247849c8eb37844fce6d329cbb4e89bf6b54de32098260471219edf40000000d832f065edc4d997484d2a11c8933be4339a46520fc51084dbbdbb870d560554dc9cfdd0002e935bd04cd092ca247ea79e40dceea848f67044f47b60040d9fe9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

564 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

564 iexplore.exe
564 iexplore.exe
1528 IEXPLORE.EXE
1528 IEXPLORE.EXE
1528 IEXPLORE.EXE
1528 IEXPLORE.EXE

pid	process
564	iexplore.exe

pid	process
564	iexplore.exe
564	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exeiexplore.exe

description	pid	process	target process
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 2000 wrote to memory of 1464	2000	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
PID 1464 wrote to memory of 564	1464	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	iexplore.exe
PID 1464 wrote to memory of 564	1464	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	iexplore.exe
PID 1464 wrote to memory of 564	1464	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	iexplore.exe
PID 1464 wrote to memory of 564	1464	7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe	iexplore.exe
PID 564 wrote to memory of 1528	564	iexplore.exe	IEXPLORE.EXE
PID 564 wrote to memory of 1528	564	iexplore.exe	IEXPLORE.EXE
PID 564 wrote to memory of 1528	564	iexplore.exe	IEXPLORE.EXE
PID 564 wrote to memory of 1528	564	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
"C:\Users\Admin\AppData\Local\Temp\7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
C:\Users\Admin\AppData\Local\Temp\7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1464

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=7e6fe50fa5ebd2c2756daa1c43b81f553344fddd841e604d2392f74dfb550153.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:564

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:564 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\P9J84215.txt
Filesize
533B

MD5
9d2efd9ae0017b5a3464d9b1d14b8901

SHA1
466e0a2e3182b4093d58db497aa7f5548bb7cab2

SHA256
809469ba9643c7a750b6f2a2be8f1a7555e86e979af8737c5a5f5b02b153b41a

SHA512
64a6b60ee016bf344fe6e0a401e9f4d874386e078d989d90a2a92f977d10925ae90658acd45c09e47e8189f67ba2276798cbd0365e7829b8ff0adac45ec94c82

Download Submit
memory/1464-54-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1464-55-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1464-57-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1464-58-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1464-59-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1464-60-0x0000000000407E1E-mapping.dmp

Download
memory/1464-62-0x0000000000402000-0x0000000000408000-memory.dmp

Filesize
24KB

Download
memory/1464-63-0x0000000000402000-0x0000000000408000-memory.dmp

Filesize
24KB

Download
memory/1464-64-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads